66b80a445f240778df3edc0929fe85d0_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

66b80a445f240778df3edc0929fe85d0_NeikiAnalytics.exe
Size

805KB
MD5

66b80a445f240778df3edc0929fe85d0
SHA1

a9766cd2fbc3b287a57c49d977adb9318fdafb5f
SHA256

490bd2381597e8d61c985a258c9b553a91ff0b74e2dce241d4e428a83eb91f8a
SHA512

3917030eeacdfc812b0d442eb432db00758320e03ba8721e5fdead034c82c1380ef9e02c7425c5e09e7da0e51bd317d042e4f1308a527a455edb23c0a0fa2023
SSDEEP

24576:5QfPD3XTLxq9qyFppFrgpZR9B0NA0vv6Ypqo/VExJPEdEKYV7jSK2Ee2MQEUVrkI:5QfPD3XTLrs4TR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
66b80a445f240778df3edc0929fe85d0_NeikiAnalytics.exe

Files

66b80a445f240778df3edc0929fe85d0_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

83d49f5f922dfe4617458caab2df2cd5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeGetTime

shell32

ShellExecuteA

kernel32

GetSystemDirectoryA
GetWindowsDirectoryA
FreeLibrary
GetVersion
Sleep
CloseHandle
WriteProfileStringA
OpenProcess
GetDiskFreeSpaceA

gdi32

BitBlt

user32

SetWindowPos
IsWindow
GetWindowTextA
SetParent
GetWindowLongA
EnableWindow
ShowWindow
GetAsyncKeyState
CallWindowProcA
GetParent

msvbvm50

EVENT_SINK_GetIDsOfNames
__vbaVarTextTstLe
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLineInputStr
__vbaLenBstr
ord588
__vbaStrVarMove
__vbaEnd
__vbaPut3
__vbaFreeVarList
_adj_fdiv_m64
__vbaPut4
__vbaFpCDblR8
EVENT_SINK_Invoke
__vbaRaiseEvent
ord622
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
__vbaVarTextTstLt
_adj_fprem1
ord625
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaVarTextTstEq
ord660
__vbaRecDestruct
__vbaSetSystemError
__vbaNameFile
__vbaHresultCheckObj
__vbaVargVarCopy
_adj_fdiv_m32
ord667
Zombie_GetTypeInfo
__vbaAryDestruct
ord669
__vbaLateMemSt
ord592
__vbaBoolStr
__vbaStrBool
__vbaExitProc
ord593
__vbaForEachCollObj
ord300
ord301
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
ord306
__vbaBoolVar
ord520
ord307
__vbaStrTextCmp
ord309
__vbaRefVarAry
ord523
__vbaFpR8
__vbaBoolVarNull
_CIsin
ord631
__vbaLateMemStAd
ord632
ord525
__vbaVargVarMove
__vbaNextEachCollObj
__vbaChkstk
__vbaCyVar
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord527
ord528
__vbaCyI2
ord529
__vbaGet3
__vbaExitEachColl
__vbaPutOwner3
__vbaCyI4
__vbaObjVar
DllFunctionCall
ord563
__vbaVarOr
__vbaCastObjVar
__vbaStrR4
__vbaLbound
__vbaAryConstruct
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
ord569
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
__vbaStrR8
__vbaR8Cy
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaVarTextTstNe
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarTextCmpEq
__vbaVarMul
__vbaExceptHandler
__vbaStrToUnicode
ord314
ord606
_adj_fprem
_adj_fdivr_m64
ord315
__vbaFailedFriend
ord607
__vbaR8ErrVar
__vbaVarDiv
ord316
ord530
ord608
ord531
__vbaFPException
__vbaInStrVar
ord532
ord319
__vbaUbound
__vbaGetOwner3
ord533
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord644
__vbaFileSeek
ord537
ord645
_CIlog
ord647
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
ord648
__vbaInStr
__vbaR8Str
__vbaCyMulI2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
ord681
__vbaI4Str
__vbaVarNot
__vbaFreeStrList
ord576
__vbaVarTextTstGt
_adj_fdivr_m32
ord577
__vbaPowerR8
_adj_fdiv_r
ord578
ord685
ord100
__vbaI4Var
__vbaFpCy
__vbaAryLock
__vbaLateMemCall
__vbaVarAdd
ord320
__vbaStrToAnsi
__vbaVarDup
ord321
__vbaUnkVar
__vbaVarCopy
ord616
__vbaFpI4
__vbaRecDestructAnsi
ord617
__vbaLateMemCallLd
_CIatan
__vbaUI1Str
ord618
__vbaCastObj
__vbaStrMove
__vbaStrVarCopy
__vbaR8IntI4
__vbaI4Cy
ord619
_allmul
__vbaLenVarB
__vbaLateIdSt
__vbaVarTextCmpNe
__vbaLateMemCallSt
_CItan
ord546
__vbaFPInt
__vbaAryUnlock
_CIexp
__vbaMidStmtBstr
__vbaI4ErrVar
ord580
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 703KB - Virtual size: 702KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83d49f5f922dfe4617458caab2df2cd5

Headers

File Characteristics

Imports

winmm

shell32

kernel32

gdi32

user32

msvbvm50

Sections

.text Size: 703KB - Virtual size: 702KB

.data Size: 512B - Virtual size: 26KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 9KB - Virtual size: 8KB

.reloc Size: 86KB - Virtual size: 85KB

.text
Size: 703KB - Virtual size: 702KB

.data
Size: 512B - Virtual size: 26KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 86KB - Virtual size: 85KB