0ee5c0226c4da1244aed0f77a576c310_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

0ee5c0226c4da1244aed0f77a576c310_NeikiAnalytics.exe
Size

2.1MB
MD5

0ee5c0226c4da1244aed0f77a576c310
SHA1

432f0463c0da73ae8bc4370cce0b09570b970afc
SHA256

63bec8c1f3f014e056c6a9637fbbc3e1d533dedd0416711290e9e612eb2f0a22
SHA512

51291c6470bb645526734a2229498a2fc758d0ec06837d5da47bdd1ddf9c21daaa62db472150a934c373e1d43f9eb0ae008c126c8e659eb85f903f926212a2b5
SSDEEP

49152:KfeYIAhgaaYgt7oduxahRYWJq0/ucl5ZmSEhijQZ/w:K2YIAhgRt7SLhRYd0/3PciM2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ee5c0226c4da1244aed0f77a576c310_NeikiAnalytics.exe

Files

0ee5c0226c4da1244aed0f77a576c310_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

b4fbd82121049876206e786198f9cbbe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msi

ord46
ord34
ord145
ord120
ord114
ord67
ord70
ord47
ord147
ord144
ord31
ord158
ord20
ord117
ord204
ord112
ord189
ord48
ord118
ord103
ord170
ord124
ord73
ord171
ord74
ord163
ord160
ord159
ord121
ord125
ord17
ord8
ord32
ord49

kernel32

WriteFile
InterlockedExchange
SetEndOfFile
TerminateProcess
OpenProcess
lstrcmpiA
FreeLibrary
lstrcmpW
OpenMutexA
Sleep
GetProcAddress
LoadLibraryA
lstrcatW
FindClose
lstrcmpiW
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
RemoveDirectoryA
lstrcatA
lstrcpyA
LocalAlloc
LocalFree
WideCharToMultiByte
lstrlenA
GetVersionExA
lstrcmpA
GetTempPathW
GetTempFileNameW
CreateFileW
GetTempPathA
GetTempFileNameA
CreateFileA
DuplicateHandle
GetCurrentProcess
GetStdHandle
CreateProcessW
CreateProcessA
DeleteFileW
DeleteFileA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
ReadFile
SetFilePointer
LockFile
RaiseException
UnlockFile
GetLastError
GetLocaleInfoA
lstrcpynA

user32

GetWindowLongA
GetClassNameA
PostMessageA
IsWindow
GetWindowTextW
EnumWindows
GetWindowThreadProcessId
wsprintfA
GetForegroundWindow
MessageBoxW
EnumChildWindows
SendMessageA
wsprintfW

comdlg32

GetOpenFileNameA

advapi32

RegOpenKeyExW
RegEnumValueA
EnumServicesStatusA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegQueryValueExW
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryInfoKeyA
RegCloseKey

ole32

CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

Exports

Exports

AI_AuthorSinglePackage
AI_ResolveKnownFolders
AI_SearchOfficeAddins
ActiveInternetConnection
AddCaspolSecurityPolicy
BrowseForFile
CheckFreeTCPPort
CheckIfUserExists
CloseApplication
ComputeReplaceProductsList
CreateExeProcess
DeleteEmptyDirectory
DeleteFromComboBox
DeleteFromListBox
DeleteShortcuts
DetectProcess
DetectService
EnumStartedServices
ExtractComboBoxData
ExtractListBoxData
GetArpIconPath
GetFreeTCPPort
GetVideoMemory
IsRunningOnVM
JoinFiles
LaunchApp
LoadShortcutDirs
MsgBox
MsmTrialMessage
PlayAudioFile
PopulateComboBox
PopulateListBox
PrepareUpgrade
PreserveInstallType
PrintRTF
RemoveCaspolSecurityPolicy
RequiredJdkExists
RequiredJreExists
ResolveKnownFolder
RestoreLocation
RunAsAdmin
RunFinishActions
SetLatestVersionPath
StopProcess
TrialMessage
UninstallPreviousVersions
UpdateMsiEditControls
ViewReadMe
WarningMessageBox

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 517B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4fbd82121049876206e786198f9cbbe

Headers

DLL Characteristics

File Characteristics

Imports

msi

kernel32

user32

comdlg32

advapi32

ole32

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 34KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 512B - Virtual size: 517B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 34KB - Virtual size: 34KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 512B - Virtual size: 517B

.reloc
Size: 2KB - Virtual size: 2KB