dad129acfc83b08e14e293be9ed2fa60_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dad129acfc83b08e14e293be9ed2fa60_NeikiAnalytics.exe
Size

581KB
MD5

dad129acfc83b08e14e293be9ed2fa60
SHA1

9d9da9f93d5a40941819bee45ff6ca47b9b3ea89
SHA256

ee9851236637eb8cc5857b1960b213fb2fcfc40789e35484d13b6473226e539b
SHA512

0c934119cc06e7de9029cb8ef4b51807c38a2e4781526929daecf44936671cdcb5615c7e1c666d0243404ecdcaef01c75921dd72b4bad09f32499326a95ff389
SSDEEP

12288:QZ3lkgmDC2lKVC8EZaBTsAtcRBOfw5DeP9V0ml460TPgf0:03lTP2lB8puLTPgc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dad129acfc83b08e14e293be9ed2fa60_NeikiAnalytics.exe

Files

dad129acfc83b08e14e293be9ed2fa60_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

a3bf91ef75f3ab500c07715351d8d654

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\BuildAgent\work\982f22576abf55ce\pw_lobby_sources\CrashRpt\bin\CrashSender.pdb

Imports

ws2_32

inet_ntoa
gethostbyname
WSAGetLastError
inet_addr
WSACleanup
htonl
getservbyname
WSAStartup
socket
connect
closesocket
send
recv
WSASetLastError
getservbyport
ntohs
gethostbyaddr
htons

dnsapi

DnsQuery_W
DnsFree

wininet

InternetOpenW
HttpOpenRequestW
HttpSendRequestExW
HttpEndRequestW
InternetWriteFile
InternetCloseHandle
InternetConnectW
InternetReadFile

rpcrt4

UuidToStringA
RpcStringFreeA

gdi32

SetLayout
CreateDCW
GetDIBits
CreateFontW
TextOutW
CreateRectRgn
SelectClipRgn
BitBlt
SelectPalette
RealizePalette
SetStretchBltMode
DeleteObject
SelectObject
GetObjectW
SetBkMode
StretchBlt
DeleteDC
CreateFontIndirectW
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
CreatePen
Polygon
CreateSolidBrush
SetBkColor
CreateHalftonePalette
CreatePalette
GetDIBColorTable
SetDIBits
SetViewportOrgEx
SetTextColor

shell32

ExtractIconW
CommandLineToArgvW
SHGetFileInfoW
Shell_NotifyIconW
SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

psapi

GetProcessMemoryInfo

kernel32

UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
Sleep
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
CreateDirectoryW
FormatMessageW
GlobalFree
GetPrivateProfileStringW
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetTempPathW
GetTempFileNameW
SystemTimeToFileTime
WritePrivateProfileStringW
GetSystemDirectoryA
LoadLibraryA
SetEvent
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
lstrlenW
ResetEvent
InterlockedIncrement
CreateEventW
lstrcpyW
FindNextFileW
FindClose
SetLastError
GetFullPathNameW
FindFirstFileW
lstrlenA
DebugBreak
OutputDebugStringW
GetSystemTime
FileTimeToSystemTime
GetProcessTimes
FreeLibrary
GetProcAddress
LoadLibraryW
OpenProcess
SystemTimeToTzSpecificLocalTime
GetFileSizeEx
CreateFileW
CloseHandle
WideCharToMultiByte
MultiByteToWideChar
GetFileAttributesW
RaiseException
GetLastError
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
GetModuleHandleW
lstrcmpiW
MulDiv
CompareStringW
lstrcmpW
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
CreateMutexW
GetCommandLineW
GetVersionExW
lstrcpynW
CreateProcessW
ReadFile
GetFileInformationByHandle
WriteFile
CreateThread
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetSystemInfo
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcessId
OpenFileMappingW

user32

DrawTextExA
CharUpperW
SetScrollInfo
GetScrollInfo
PostMessageW
DialogBoxParamW
PostQuitMessage
LoadIconW
CopyRect
AdjustWindowRectEx
IsDialogMessageW
EnableWindow
KillTimer
SetTimer
MoveWindow
GetMenu
GetIconInfo
DrawTextExW
DrawIcon
GetActiveWindow
GetSubMenu
TrackPopupMenu
LoadMenuW
GetWindow
MonitorFromWindow
MonitorFromPoint
UnregisterClassA
DestroyMenu
SetMenuItemInfoW
CheckMenuRadioItem
DeleteMenu
EndDialog
MessageBoxW
SetProcessDefaultLayout
LoadImageW
GetDesktopWindow
GetSysColorBrush
GetKeyState
CreateDialogParamW
GetClassNameW
LoadCursorW
GetSysColor
EnumDisplayMonitors
OffsetRect
GetCapture
ReleaseCapture
AnimateWindow
EndPaint
BeginPaint
GetCursorPos
SetCursor
DrawFocusRect
FillRect
DrawTextW
PtInRect
CallWindowProcW
IsWindow
GetDlgCtrlID
GetParent
SetFocus
SetCapture
IsWindowEnabled
UpdateWindow
ScreenToClient
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateWindowExW
DestroyWindow
SetRectEmpty
MapWindowPoints
GetDlgItem
RedrawWindow
IsWindowVisible
ShowWindow
InvalidateRect
SendMessageW
GetWindowRect
SetWindowPos
GetWindowLongW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetWindowLongW
DestroyIcon
GetGuiResources
CharNextW
wvsprintfW
LoadStringW
GetCursorInfo
GetWindowThreadProcessId
EnableMenuItem
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetSystemMetrics
ReleaseDC
IntersectRect
EnumWindows
GetFocus
GetDC
GetMonitorInfoW

advapi32

RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumValueW

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateGuid
CoTaskMemAlloc

oleaut32

VarUI4FromStr
VarDateFromStr
VarI4FromStr
VarR8FromStr
VarDecFromStr
VarDecCmp
SysFreeString

comctl32

_TrackMouseEvent
ImageList_Create
ImageList_ReplaceIcon
InitCommonControlsEx

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr90

fabs
abs
pow
abort
sprintf
fopen
_wfopen
_fseeki64
_ftelli64
srand
rand
isalpha
tolower
isspace
strncmp
atof
fseek
ftell
ferror
fopen_s
_vsnprintf_s
sscanf_s
fputc
swprintf_s
strftime
_wdupenv_s
_time64
_gmtime64_s
wcscspn
strcat_s
strtoul
strncpy_s
calloc
strcpy_s
strchr
__CxxLongjmpUnwind
fprintf
atoi
wcsncmp
_wtol
_setjmp3
rewind
_gmtime64
_lock
fwprintf
sprintf_s
_wstat64i32
feof
fread
wcscpy_s
wcschr
wcsncpy_s
memcpy_s
malloc
wcsstr
_recalloc
_wcsicmp
free
_purecall
strcmp
_wfopen_s
fclose
memcmp
wcslen
_wtoi
wcscmp
iswspace
iswdigit
wcsrchr
memmove
memmove_s
strlen
isalnum
??2@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??_V@YAXPAX@Z
memcpy
memset
_CxxThrowException
??3@YAXPAX@Z
strcpy
sscanf
exit
fflush
strtod
longjmp
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__iob_func
fwrite
strncpy
getenv
tmpfile
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
_onexit
_wcmdln
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
?terminate@@YAXXZ
_decode_pointer

Sections

.text
Size: 447KB - Virtual size: 446KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3bf91ef75f3ab500c07715351d8d654

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

dnsapi

wininet

rpcrt4

gdi32

shell32

comdlg32

version

psapi

kernel32

user32

advapi32

ole32

oleaut32

comctl32

msvcp90

msvcr90

Sections

.text Size: 447KB - Virtual size: 446KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 5KB - Virtual size: 7KB

.rsrc Size: 28KB - Virtual size: 28KB

.text
Size: 447KB - Virtual size: 446KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 28KB - Virtual size: 28KB