c5568321b40f1d51afac49234d2de480_NeikiAnalytics[.]exe

resource
c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe
unpack001/$PLUGINSDIR/Banner.dll
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe

IMPHASH b34f154ec913d2d2c435cbd644e91687
SHA256 560b3bba2f6d3e74b1901904c7ea9e7c61f94c754e648cb6503abaa233d7c485
MD5 c5568321b40f1d51afac49234d2de480
SHA1 c5169e1d05419bb698b86704ae8f3cbe7011d42e
SHA512 f15d0141a89e1a6d89b030d10f2e7e60efbf5d2b21a905335f6ba79de8908796bfd4df928f398e984e06a86d3023cde783690843871f222432677dd5a848674e
SSDEEP 6144:wQ606xhLK0o+/zqdPCb3m2aOmjpygIb20PM+Drhvnv/6:wK0bqdM2EVbv3hvnH6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess GetShortPathNameW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW MoveFileW GetFullPathNameW SetFileTime SearchPathW CompareFileTime lstrcmpW CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose lstrlenA MulDiv MultiByteToWideChar WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow GetDC SetTimer SetWindowTextW LoadImageW SetForegroundWindow ShowWindow IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu EndPaint CreateDialogParamW SendMessageTimeoutW wsprintfW PostQuitMessage

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/Banner.dll

IMPHASH 767a5b32183c6c4ff645882480adc9a6
SHA256 4083bef584ad6793b3d57e3e3f764a31afac876412df65c5da5afee76bbd1e10
MD5 0d5428f7920274caedfa8f2ae980e196
SHA1 ce2ca2381a4b9ed9f06f6af5a183a840de290c3f
SHA512 78419752f3e6579f7caf1f9bab70a46ac2b0a7c5f08eb8604e927baea611c182133ce8d58929a059f22e6c2befb5ff0c24ee6500d0708bc884a65e395ea7c4cf
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/BgImage.dll

IMPHASH 32b0f5880a0efd258c6be2f7a14f4a9f
SHA256 286f246ee18bf91c4a80fa2cdb61077a4bcf0a3fd6582be4b4ab6a5cb3de44c9
MD5 9436196007f65f0ae96f64b1c8b2572e
SHA1 4b004b5c2865c9450876be83faa8cc96e1d12c01
SHA512 5c172675fbbea214471ac35eebaa6ab9bd1306268144085adbad3bba4a815430ed028cac169e8b5a6fd00818684f65d7bdd32f11773bc6152e62ef80f895d35e
SSDEEP 96:8egk1LFJaO1/radJEaYtv1Zs4lkL8y3A2EN8Cmy3uT24j7J3kWyy/:t7TJa2roqJyA2EN8diuTHje
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7202

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 f004c568d305cd95edbd704166fcd2849d395b595dff814bcc2012693527ac37
MD5 8b3830b9dbf87f84ddd3b26645fed3a0
SHA1 223bef1f19e644a610a0877d01eadc9e28299509
SHA512 d13cfd98db5ca8dc9c15723eee0e7454975078a776bce26247228be4603a0217e166058ebadc68090afe988862b7514cb8cb84de13b3de35737412a6f0a8ac03
SSDEEP 192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 59cdb2c12d5635fd25af4007b70222507948be41fa9885b7f07967c2510a5311
MD5 82c3f38cd34739872af07443c65d0bd8
SHA1 1f4ee2d394404a291eda6419f856adaf4b960237
SHA512 3a81c0613b1ea906ad4f103b02620217de69a8676dbb7ec41cf31f342a0a74562815a8d4f2efe9866fc16365f58524ac71652e99920acea355f020028775743d
SSDEEP 192:ow8cSzvTyl4tgi8pPjQM0PuAg0YNy+IFtSP:lBSzm+t18pZ0WAg0R+IFg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Antimysticism/maga.amo

SHA256 859b473416878c5b8df172b88411fc95ebe3567c2a248bdf912b33fb2dd21a2c
MD5 3bfa3fc47efae291c7a323d217b988ba
SHA1 1880f33480d4809fbeb48aa190f9a27eb8718dc6
SHA512 96a5eb0a696fe78d1512db46cef3c0f4358a1ed4cdc740c2c3e881e6c6dad2f593ba7690b6f309efe8df7346a965f20746801c737c92c29a6de62ce02b885e44
MD5 SHA1 SHA512

Antimysticism/peruvian.arb

SHA256 436035dd581b5f49f857ec1c28e9139b6827b3d2900972b01c45b4fc1e69d2df
MD5 a7185c14c6e3f9c4b7a930418b436520
SHA1 59268f92379b769ff975a96c8ddba436519b681d
SHA512 d3054d61223522b22ecc4e6a38fe6320671b2a4821f41960febd580323f5fc6e523a90988e591fd45a35ca1b5e23f5ebb6ceb25e0e344ab5bf6f66b3aa726976
SSDEEP 96:WGo9yr4WVDppaKiKDiSWe+Vcn+myVGs1dJFEBiy9c:ek4QPT0StBy71bFEBiz
MD5 SHA1 SHA512 SSDEEP

Antimysticism/produktionsprisen.bec

SHA256 eebbe8820673aab704b090e4bc54420a0980353c2f093f0d4daff0a231c43f76
MD5 eec6e8634b4760186277fcda2a5729ec
SHA1 c3681bf683b78f569283a7a984b7a0a98167cd44
SHA512 f693a66b72b3ca33960b731acaef1f0c5232e31e37e8e3cea928162d7909d3a79683eb814fc9aa56c1e26a98e541f49db02c934bec3dad34808c4688ae253606
MD5 SHA1 SHA512

Antimysticism/sapota.sea

SHA256 5c32d1e7512d5514e460b80582af8e6045ae5e8a63fd962cd4fe51477aa11bb3
MD5 a6d326d0622826b10f379d3298934673
SHA1 4d422a45e1a8c2a25a1a30baeaa900cf848f01eb
SHA512 d6160ac8d0b71bda3fafc582f61f0e3bd456b6880905732b9839e69492e87877b7b30a6a5de622037f46627367e9e9be48475779746819fc5a44339bbfd17113
MD5 SHA1 SHA512

Antimysticism/unharping.ran

SHA256 af27d4b3305b809d64659a3b5a02389d412c906c4f592954a81def970bd9747a
MD5 1e50c3524552877dd948770c9ff92dc8
SHA1 0e87f93c3c875db3d8b02b5870217a1394b1e51d
SHA512 68f7ea34ba75bbf2588a65fa2e296c46d9b05e809410a349b8c928e4ce64ab9b0743126475c83942a9412ae59b6daf6da76e330a6c0e4d343366e388c04f0ca4
MD5 SHA1 SHA512

Antimysticism/ydervgselementet.bin

SHA256 ebf578ca1fbafff1fcaa75a44fa4e8c7b275a773b006de0bdd2713e5b4d73bc5
MD5 b9d53633f865356f4ef7e2d5ccb9696b
SHA1 b2f65737d0c3db82e441e5247131c33b38c42560
SHA512 d3961eab3b61661b819193b5c240384833633fbfd21219db6e335af7c8965b1efdeaaa3c9051c22320e91d85082d81ed1ec1610b2ad5ab3b8d8e988ad167f82d
MD5 SHA1 SHA512

Boligsager.nut

SHA256 0b02fa7743a7b99949b035f9ba634dacadb3750f84692756e3931b9892b9fd5f
MD5 b06a6ee33e50bc75d872bea06f75578b
SHA1 e7aa1543686fc05f3f05ccac75030685016ea338
SHA512 ba75b26b3a47b51f7c9b5aec749b431947b074e0de2e8da5f53998b5b4aa293f452d411f4b90ac226bfe060eb454f93da5fc23fab5f937bf18d99a2f0d6f0a9a
SSDEEP 96:0Ex2/ClcMjuTNb2vAlUFVdyg01V2RANcF:xlluZ2ISrdyHH2P
MD5 SHA1 SHA512 SSDEEP

Charlet.paa

SHA256 809943f0707c458250f2f723ee102cc8e514c1a5d8dd14c0e4372bd913a4eb1b
MD5 19f4b6f2c0071e09baaf89e2b6760ec0
SHA1 c53de929b36544969f7bddf3c21e4e13152ae70e
SHA512 b58a12cf0a83722db70b5120e454750a4925aa084f1eeed3450c527a60c44f9a38a6deced58f8ecca815e45e0cf880e9a2b38b8866a52e1c421d0a1c5911c712
MD5 SHA1 SHA512

Folkekulturs.unf

SHA256 9188ed20089b5a8b23385ea46d73120565541b5d9b3f6752c6b0168de98c1acd
MD5 f0a3ef4a4c309425f9e66efe2b82773f
SHA1 df5e3834fb6d6b42c361a714db06bf7186ea24a4
SHA512 41afcb6a400af1d69347da51151d260e292fd1369e8746ee93906e8fa87420200232c6bcf71adb84776ee0b3c0d7c1ed4e456b4f09e24ca5725dbd4e72d11ddf
MD5 SHA1 SHA512

Milieubeskyttelseskonventioners.Com

SHA256 3e6531b08e539f4d71527a3b6b5ce6934b557e8da67a554d51b6ba122256bb4c
MD5 4486b19c9039bce7f7cb4e385ceb77d7
SHA1 abf05caa17da604bb945764f78d72fda513d40ba
SHA512 6d0409013fc2edb8a1ba573d9c2edd6d490c2d63474adae3876592fb73a9675e400b1a0fae225affeb1752b83d0a29a4846d6270764dab24530a5b58b0b96b65
SSDEEP 192:0fOPCFpkXDR+Zh4S3y8UVoNhZLpDt2KYMa/9y:0fOqi+ZGXopLhtMMaFy
MD5 SHA1 SHA512 SSDEEP

Sabbatters.app

SHA256 68c60b54d23a7eac7decbd381934147857868b1b5f14a5087cc7d691f68670d6
MD5 6d05f4d490578ac56f35a2fb0fdc48c3
SHA1 98cbe66769dca00383a1e6345a0af8d8f5158802
SHA512 0d038240e209b7b478d66800c76668fe40b10ffca149b1920946fb025ba5f1be9f20cd75e689cae6c9e5d9c2f722bf54b5bc2783602a0379def34be48e6753b5
MD5 SHA1 SHA512

macos

Underproficient101.Non252

SHA256 4b820f95812e5406b839121578cb8ed94b634e6ddf8bb1482176f5313eaebb3f
MD5 183c74889cd8ed46136dcb90a3c2537f
SHA1 886240fbfa3c4c2f71671b813a73af715fe919e5
SHA512 26ab1e4108b8592ca6f365ac2d774dd5df9422c34a577eed71bcfeefdb69e1faa88272c447a1ef0c21ce0f5d6a515121dece35df4245befafc63256484816357
SSDEEP 3072:nCPlYSxVGYzygU72P5SmZchsVVobeXDF1ed/ayVQQ7MHaaAqSLnWMeo34gXfhrPp:nk+YPU7Q5Drr1Pc0lrSSm4kPlDfvLw3q
MD5 SHA1 SHA512 SSDEEP

albuminurophobia.epi

SHA256 e1a1f4dedfd1565fe90c4ed80c5a9ad02a5d47db9bb7086e2a4a3a3249857a4c
MD5 eb2b5f2c9c169e58377641d7987948fc
SHA1 241bec9ad054cb725dff062a2f7b3dd61bfd5f83
SHA512 5a44ed28da13d0b5225d2a332405e034359fa9b1e0d434e982853f6ba99b3eed3415dddec1ae674bf3c0cf79a8db3ba4fa7a7b1ef35f570aaf3786132b3f9f6d
MD5 SHA1 SHA512

blout.unm

SHA256 8be5116bf871c3c2f12763c732a7c23cb965ad76367b144711991e2859d2b6c8
MD5 e1c5b53e9928d1abed5e30e1e8c8a301
SHA1 6e4891770a873fc842c5a446500af1cbb4d2b82a
SHA512 ef14bf48141883d9175e8eea38231667517ef7576675a48484e4105f0ed61e089011521b29dcb76954d83dda388aad7e6fcd378f8fa7a4e003f5793c696219d1
SSDEEP 96:bEdXb/ugHJ9RYcS0OuvopsUKfRv2dIH/1maCcj6mY81k5Ny:b/gpvTyYtSIf1maCe1kDy
MD5 SHA1 SHA512 SSDEEP

craftwork.for

SHA256 7a36b98211ba5c13d89467f85873a88b628e2a307c0081270b92f9a70cc14b68
MD5 b718d04820e1d3c54e83103b5f6e33c0
SHA1 f217d0bb818c5957be381f3bb2b7504a585e9de1
SHA512 574e1e3895764a88f158c2c934e2e707e284d6d803bbd7a7fa501814d14c2670e4584c3c4147782521e6314590eb80e3778efbe72732ac80bcf1e534af689393
MD5 SHA1 SHA512

depel.txt

SHA256 ebc5dbdb52b413aaf0b958763fe8ad35e8a98d77c51daf8b519d3815e44dd818
MD5 13d8deb35288701927da205f3c887787
SHA1 5ba9084d199f24c3348d3197e97f253d281ef853
SHA512 6264560f031bf903dd8f3be05c35144d2d98b61fc790684893473e63a2806b4a8bd07dafb9e75e20aa7f2859ca1ec0c92190672cbad06f97d7ea74cf34e1e632
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer

c5568321b40f1d51afac49234d2de480_NeikiAnalytics.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/Banner.dll

kernel32

user32

generic

$PLUGINSDIR/BgImage.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Antimysticism/maga.amo

Antimysticism/peruvian.arb

Antimysticism/produktionsprisen.bec

Antimysticism/sapota.sea

Antimysticism/unharping.ran

Antimysticism/ydervgselementet.bin

Boligsager.nut

Charlet.paa

Folkekulturs.unf

Milieubeskyttelseskonventioners.Com

Sabbatters.app

Underproficient101.Non252

albuminurophobia.epi

blout.unm

craftwork.for

depel.txt