0272e1cd910e40d43b2f123db668b710_NeikiAnalytics[.]exe

resource
0272e1cd910e40d43b2f123db668b710_NeikiAnalytics.exe
unpack001/$PLUGINSDIR/ButtonEvent.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LogEx.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsProcess.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

0272e1cd910e40d43b2f123db668b710_NeikiAnalytics.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 492df6f4fc4b890b577cce8dc7b96746f5b78d556946343ab85faca9174a6761
MD5 0272e1cd910e40d43b2f123db668b710
SHA1 ed7b10ef1f7d637dd613bc486f8eab7046d1e7eb
SHA512 a4072d2e20783ca119a40afa38769a455e874d9cd357ff7c8d54fca5b0b564102939c908e217779bad2b5fa2b88440b392f744246334fa39b801cd9f07a2d8ba
SSDEEP 98304:gPLJHN63ViG9QZwGScbG865Qmm1erlC4Jis9s/yZAMoGlPKq:AJt6l2bv96C1MrHiU7PNlPKq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/ButtonEvent.dll

IMPHASH f6b3bf118c165362ce7d90c8b59bd5eb
SHA256 85c1e40bc78380f478fd38d4dc02e862f61d972f79b934d2d0a73f2f86f1afab
MD5 d90e9ed537ebd1e040e02c8c00195fe5
SHA1 08030a716207bb704b1115c322307b4415b12bd6
SHA512 f27743246e36b7ab69db82e75129ff7185694a9a7f9577873debaacc554b08d4c8e04c7cd7885ec498506dc779af36e64f3f32dfcfba8285a1e7dbf9095ec10a
SSDEEP 192:bKnVTFlMW3AF8viRotcnl63XuEqk6SzFGSL:b+NMW3W8K2tcg+SRG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

6289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Program Files (x86)\NSIS\Plugins\ButtonEvent.pdb

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LogEx.dll

IMPHASH cc1698ea7adafebb0d87210da8a4f5a8
SHA256 f6d21ef2fa853b922c94d66d3abd9277ad71bc1be73a8d8418bc06635925a343
MD5 1c440ec84001c94327082aca9bdbd0d1
SHA1 4f35b29e8e1ca44368d15506c28a0873bed1c9f3
SHA512 32a2c9641d1390295249a52fab38f8bc8379be80395a9b27b4e157d37b66a1c1f9f49f940ccd24725c59f9de9a585690292119e11faea3e93d4054d9db00e93a
SSDEEP 768:I+mRGgtvKEeTLD4GKx1oj+aYb7+ZDomgfHx:IbG27eTLcGP+N/0o3fR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6767

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 8cf5dbc8faf0856e6ce0e1c3a196d197
SHA256 9f47ec720d74e538bbc8d0c1118efcbc52e52050dbe98c27029fc35329996f7c
MD5 0d422e0c03a7d9428c6c02175d7dc9f8
SHA1 5e13d49521cfbbe52cd74de8e1682789f0268969
SHA512 2edf47b24c4201e082841824d6ad9047a06e9a877d799e87befaf5d54179c924849d2e608cf9f60a1480828edcd98e19f3d139d19bdb4b96ee4939fe58bf0887
SSDEEP 192:GqzPEcSUa9KbONtrHf9IyMx7A+iCooYJlgNkGcioGZ5vQhjN9ZmyCaMAWkah+2oD:5rEcSUuv4xkOooPXci/ShZKaMAWk5ys
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14407

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameA SetLastError CloseHandle GlobalFree LocalFree FormatMessageA MultiByteToWideChar GetLastError CreateProcessA GlobalAlloc lstrlenA GetVersionExA lstrcmpiA GetCurrentThreadId lstrcatA FreeLibrary GetProcAddress lstrcpynA GetExitCodeProcess WaitForSingleObject lstrcpyA GetCurrentProcess GetCurrentThread GetCurrentProcessId Sleep CreateThread GetStartupInfoA GetCommandLineA GetPrivateProfileIntA GetPrivateProfileStringA LoadLibraryA GetModuleHandleA

user32

ShowWindow GetWindowLongA DestroyWindow LoadImageA SetWindowLongA EndDialog MessageBoxA SendMessageW DialogBoxParamA CharNextA UnhookWindowsHookEx CallNextHookEx GetClassNameA SetWindowsHookExA SendMessageTimeoutA WaitForInputIdle DefWindowProcA PostMessageA GetLastActivePopup PostQuitMessage SetForegroundWindow DispatchMessageA GetMessageA CreateWindowExA RegisterClassA UnregisterClassA GetWindowTextA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects IsWindow SetWindowTextA wsprintfA GetDlgItem SendMessageA LoadStringA EnableWindow

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExA

ole32

CoInitialize CoUninitialize

$PLUGINSDIR/features.txt

SHA256 b715f4747f10f8e51334510461889198c66347346229f3f8689b0bcd8caaf8e8
MD5 81c76135e53a812a15ba9c49d58eed3a
SHA1 433aa3fb1440080db33a842cdede29e5a7ff4af3
SHA512 c349dfc9efe5e695999785298f587073dd4a6321019b0950131a664315ba3805ce4ada321ca5c944930cf31ae3bbcf1344bde4415080665c1d79c77b860c71d6
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/intro-banner.bmp

SHA256 93eb54c3ee36938d6976ad2c3943b64a4091dbc9cffd3e4c2cbf88e64bda579a
MD5 26dbdf3f941cc2075247b819567bb8dd
SHA1 3b11c4b85cb122b5f7b3ccfb569a4bf5faaf6ff2
SHA512 5ce07146cd3211add948b55fa77118d86ab8b640086eb3428c388d3ea6cede5c18361ca425c55b10c69090e5b90ecbf95300db3a76560d01a5986968e321ffef
SSDEEP 192:dayKKAEtQyrcy44444342YqetaoKDX1R3a7s3WqM4ZS8i72+kZ:dY3BWtao42s3WEx+kZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/intro-prod.bmp

SHA256 768b4457e1cea0f690a3a95564634865dc5957fc419084337ba5b67a697e948d
MD5 0a06edac03e1785a2048f5702692082b
SHA1 05300a70d716fed0b8065e99286b44dfe071d293
SHA512 2d0c2ee929d4407c9e1b688ec3bf5a24e479d34cd781e56fbf71c73f20d905bf14688645e70afc18263282da55e5af97535c45e8d2bbf4b32a9df0acd1e4d164
SSDEEP 768:9Zbs80Wi4My7TC6zBc4ncxyr8Q8lfrcqa:9ZbiVzW8Q8lfrcqa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 93eb54c3ee36938d6976ad2c3943b64a4091dbc9cffd3e4c2cbf88e64bda579a
MD5 26dbdf3f941cc2075247b819567bb8dd
SHA1 3b11c4b85cb122b5f7b3ccfb569a4bf5faaf6ff2
SHA512 5ce07146cd3211add948b55fa77118d86ab8b640086eb3428c388d3ea6cede5c18361ca425c55b10c69090e5b90ecbf95300db3a76560d01a5986968e321ffef
SSDEEP 192:dayKKAEtQyrcy44444342YqetaoKDX1R3a7s3WqM4ZS8i72+kZ:dY3BWtao42s3WEx+kZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 780643863fc2ca68984562963ab2ec891d1a874a6615a85603da4c539fb8fa6c
MD5 1259dbb786db512ea5c521456d8d9b46
SHA1 525a245a7d42ff786654b8620a9e08f8129c9d8b
SHA512 2e0805de1243d4924c2a32cab151c5036f16f3289f75061b242d65ad10a0242d4023791adb34b36d30767aba28d9cfc482d364f51c94f3914d7fdf503549ff8c
SSDEEP 3072:r57x46kq25aC23W3aajzKYnIEQUv0RxEHT9Fop3NEylBCSm/6UPaw0DbPmf2EAls:r57x46kq25aC23W3aajzKYnIEQUv0RxU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/mystart-manifest.xml

SHA256 3ea13a1b23e5b3999220fa70cf5cf370bbe8a513690d9ab6bb3b729ec350751e
MD5 c69bcd79f9ef72d51def1029fc4b74f9
SHA1 8f65d525b1c3559fdfb7a8ea964d196d10548b01
SHA512 02c4fd7f0800a4537d3dcc1212d8344242898565c8d28f3cf9130fd4aebae5d567ecbbc557387ab62404fac0df2aed74150c79847f5bf7f8ce021d27fb0bc148
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/mystart-toolbar.xml

SHA256 e4a1eef92e0f5b81cd3098ccac7c24fc21f4b8caea3c523e02f0c12c8f2d52d7
MD5 c0d5fe06fd97b41060fa798e6a524e02
SHA1 f823f7255739d7ede42173414c27e555724458c5
SHA512 1ca48b3682f63d4822a104a751dd37868c4d852282c4fd8f938003bb737f3c37889a2ccd3fbd9281da060f9ee51db31d3df67f62dda738d381562a08ef07de8c
SSDEEP 192:zB6Cw9hWNWCa127xDw/4cWY502znnw0LJkBLf8gEie8oGBLA7d14lUuEW9Pe/jn1:Fv218eVJNvl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_56_/extensions/{607b689f-7600-45e4-b8e5-887f72dab15c}/manifest.xml

SHA256 3ea13a1b23e5b3999220fa70cf5cf370bbe8a513690d9ab6bb3b729ec350751e
MD5 c69bcd79f9ef72d51def1029fc4b74f9
SHA1 8f65d525b1c3559fdfb7a8ea964d196d10548b01
SHA512 02c4fd7f0800a4537d3dcc1212d8344242898565c8d28f3cf9130fd4aebae5d567ecbbc557387ab62404fac0df2aed74150c79847f5bf7f8ce021d27fb0bc148
MD5 SHA1 SHA512

NSIS installer

installer

$_6_/$R0

IMPHASH c1d2aed717cf88e5124e951a678a05f9
SHA256 d198cf9a5e0f9933f5ddddcc289ba9364e4226dcee12d8210875a7ed4dae59e7
MD5 2edab491b5bcb39f0357746643ce41a3
SHA1 4622c21b6bff84cc3dfe342a96968daf2808cbba
SHA512 9504a6e807fb7b1584a5aadea72f298fbe8cd79c5a2563e124e8871a6c10e07a94e18bfa18ae7d13cedabfa25073aeada5afdfa6cdbc3fef6f66724bef07c6f0
SSDEEP 12288:cS/J0Ychwa7zMfABl3oO4lV9n+KY7e1kgdB6Sb/0VTaC:0YracImO1+1kgrcVuC
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ab:b4:f3:fe:4f:f0:1b:80:d1:0f:4c:20:51:9c:60:40:db:a3:27:c2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Visicom Media Inc.,OU=SECURE APPLICATION DEVELOPMENT,O=Visicom Media Inc.,L=Brossard,ST=Quebec,C=CA

Chains

Jun 4, 2014

Minor OS version

0

Major OS version

5

Entry point

283257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetReadFile HttpSendRequestW HttpOpenRequestW InternetConnectW InternetCrackUrlW InternetGetConnectedState FindNextUrlCacheEntryA DeleteUrlCacheEntry FindFirstUrlCacheEntryA InternetCloseHandle HttpQueryInfoA HttpQueryInfoW FtpOpenFileW InternetOpenW

ws2_32

inet_ntoa gethostbyname

kernel32

lstrcmpiA InterlockedIncrement InterlockedDecrement GetModuleFileNameA GetModuleHandleW IsDBCSLeadByte FreeLibrary LoadLibraryExA GetCurrentProcessId FlushInstructionCache GetCurrentProcess ActivateActCtx CreateActCtxA GetVersionExA ReleaseActCtx DeactivateActCtx TerminateThread WaitForSingleObject GetTickCount OpenMutexA CloseHandle ReleaseMutex GetCurrentThreadId CreateThread SetLastError lstrcmpA MulDiv GlobalUnlock GlobalLock GlobalAlloc CreateMutexA WritePrivateProfileStringA GetPrivateProfileStringA Sleep MapViewOfFile CreateFileMappingA OpenFileMappingA UnmapViewOfFile LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency VirtualAlloc VirtualFree GetVersion IsBadCodePtr TlsGetValue GetEnvironmentVariableA SetEnvironmentVariableA SetFilePointer SystemTimeToFileTime GetFileAttributesA CreateFileA lstrlenA GetCurrentDirectoryA LocalFileTimeToFileTime CreateDirectoryA SetFileTime WriteFile GlobalFree CreateProcessA WaitForMultipleObjects CreateEventA SetEvent GetSystemInfo VirtualProtect IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind HeapSize HeapReAlloc HeapDestroy IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange GetACP GetOEMCP IsValidCodePage TlsAlloc TlsSetValue TlsFree HeapCreate ExitProcess GetStdHandle SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetModuleHandleA GetProcAddress GetLastError FindResourceExA FindResourceA LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException lstrlenW WideCharToMultiByte MultiByteToWideChar GetUserDefaultLCID GetCPInfo GetLocaleInfoA EnumSystemLocalesA IsValidLocale InitializeCriticalSectionAndSpinCount InterlockedExchange GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle SetEndOfFile LocalFree VirtualQuery GetSystemTimeAsFileTime GetCommandLineA ReadFile CreateFileW

user32

SetWindowTextA GetActiveWindow SetWindowTextW CreateAcceleratorTableA UnhookWindowsHookEx IsWindow GetDesktopWindow SetFocus DestroyAcceleratorTable BeginPaint EndPaint DestroyWindow FillRect ReleaseCapture GetClassNameA IsChild SetCapture RedrawWindow InvalidateRgn InvalidateRect ReleaseDC GetDC GetWindowTextA GetWindowTextLengthA RegisterWindowMessageA OffsetRect ScreenToClient ClientToScreen DialogBoxParamA WindowFromPoint EndDialog LoadIconA GetMonitorInfoA CallWindowProcW GetDlgItem IsDlgButtonChecked CheckDlgButton CreateWindowExA RegisterClassExA CharUpperBuffA CharLowerBuffA MapWindowPoints SetRect IntersectRect EqualRect PtInRect GetCursorPos MessageBoxA GetKeyState LoadStringA GetSystemMetrics CreateIcon GetClassInfoA UnregisterClassA UpdateWindow SetForegroundWindow IsWindowVisible SetParent SetMenu GetSystemMenu DeleteMenu SetCursorPos SetActiveWindow GetMessageA GetWindowInfo SetWindowLongW GetWindowLongW IsIconic PostQuitMessage SetTimer SetPropA SetWindowsHookExA FindWindowExA ShowWindow KillTimer SetWindowPos RegisterClassA CallNextHookEx GetSysColor SendMessageA LoadCursorA GetClassInfoExA GetWindowRect MoveWindow TranslateMessage DispatchMessageA GetClientRect CallWindowProcA GetFocus GetWindow GetParent PostMessageA GetWindowLongA SetWindowLongA DefWindowProcA CharNextW CharNextA SetWindowRgn MonitorFromWindow SendMessageW GetPropA

gdi32

GetDIBits GetBitmapBits CreateDIBitmap CreateDIBSection ExtCreateRegion CreateICA CreateRectRgn CreateRoundRectRgn OffsetWindowOrgEx SetWindowOrgEx GetPixel GetStockObject GetObjectA CreateSolidBrush BitBlt CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject CreateDCA GetDeviceCaps DeleteDC

advapi32

RegCreateKeyExW RegSetValueExW RegQueryValueExW RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegOpenKeyExW

shell32

ShellExecuteExW SHGetFolderPathA ShellExecuteA

ole32

StringFromGUID2 StringFromCLSID CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoCreateInstance WriteClassStm CoInitialize OleSaveToStream ReadClassStm OleRun CLSIDFromProgID OleLockRunning CoGetClassObject CreateStreamOnHGlobal OleInitialize OleUninitialize CoGetObject CoCreateGuid CLSIDFromString

oleaut32

GetErrorInfo GetActiveObject SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData OleCreateFontIndirect VarBstrCmp SysAllocStringLen VarBstrCat LoadRegTypeLi SysStringByteLen SysAllocStringByteLen VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi VariantClear VariantChangeType VariantCopy VariantInit SysAllocString SysStringLen SysFreeString

shlwapi

PathCanonicalizeA SHDeleteKeyA PathStripPathA PathRemoveFileSpecA SHCreateStreamOnFileA UrlEscapeW PathAddBackslashA

urlmon

CoInternetGetSession URLDownloadToFileA IsValidURL

$_6_/manifest.xml

SHA256 3ea13a1b23e5b3999220fa70cf5cf370bbe8a513690d9ab6bb3b729ec350751e
MD5 c69bcd79f9ef72d51def1029fc4b74f9
SHA1 8f65d525b1c3559fdfb7a8ea964d196d10548b01
SHA512 02c4fd7f0800a4537d3dcc1212d8344242898565c8d28f3cf9130fd4aebae5d567ecbbc557387ab62404fac0df2aed74150c79847f5bf7f8ce021d27fb0bc148
MD5 SHA1 SHA512

NSIS installer

installer

$_6_/mystarttb.dll

IMPHASH c1d2aed717cf88e5124e951a678a05f9
SHA256 d198cf9a5e0f9933f5ddddcc289ba9364e4226dcee12d8210875a7ed4dae59e7
MD5 2edab491b5bcb39f0357746643ce41a3
SHA1 4622c21b6bff84cc3dfe342a96968daf2808cbba
SHA512 9504a6e807fb7b1584a5aadea72f298fbe8cd79c5a2563e124e8871a6c10e07a94e18bfa18ae7d13cedabfa25073aeada5afdfa6cdbc3fef6f66724bef07c6f0
SSDEEP 12288:cS/J0Ychwa7zMfABl3oO4lV9n+KY7e1kgdB6Sb/0VTaC:0YracImO1+1kgrcVuC
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ab:b4:f3:fe:4f:f0:1b:80:d1:0f:4c:20:51:9c:60:40:db:a3:27:c2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Visicom Media Inc.,OU=SECURE APPLICATION DEVELOPMENT,O=Visicom Media Inc.,L=Brossard,ST=Quebec,C=CA

Chains

Jun 4, 2014

Minor OS version

0

Major OS version

5

Entry point

283257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetReadFile HttpSendRequestW HttpOpenRequestW InternetConnectW InternetCrackUrlW InternetGetConnectedState FindNextUrlCacheEntryA DeleteUrlCacheEntry FindFirstUrlCacheEntryA InternetCloseHandle HttpQueryInfoA HttpQueryInfoW FtpOpenFileW InternetOpenW

ws2_32

inet_ntoa gethostbyname

kernel32

lstrcmpiA InterlockedIncrement InterlockedDecrement GetModuleFileNameA GetModuleHandleW IsDBCSLeadByte FreeLibrary LoadLibraryExA GetCurrentProcessId FlushInstructionCache GetCurrentProcess ActivateActCtx CreateActCtxA GetVersionExA ReleaseActCtx DeactivateActCtx TerminateThread WaitForSingleObject GetTickCount OpenMutexA CloseHandle ReleaseMutex GetCurrentThreadId CreateThread SetLastError lstrcmpA MulDiv GlobalUnlock GlobalLock GlobalAlloc CreateMutexA WritePrivateProfileStringA GetPrivateProfileStringA Sleep MapViewOfFile CreateFileMappingA OpenFileMappingA UnmapViewOfFile LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency VirtualAlloc VirtualFree GetVersion IsBadCodePtr TlsGetValue GetEnvironmentVariableA SetEnvironmentVariableA SetFilePointer SystemTimeToFileTime GetFileAttributesA CreateFileA lstrlenA GetCurrentDirectoryA LocalFileTimeToFileTime CreateDirectoryA SetFileTime WriteFile GlobalFree CreateProcessA WaitForMultipleObjects CreateEventA SetEvent GetSystemInfo VirtualProtect IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind HeapSize HeapReAlloc HeapDestroy IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange GetACP GetOEMCP IsValidCodePage TlsAlloc TlsSetValue TlsFree HeapCreate ExitProcess GetStdHandle SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetModuleHandleA GetProcAddress GetLastError FindResourceExA FindResourceA LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException lstrlenW WideCharToMultiByte MultiByteToWideChar GetUserDefaultLCID GetCPInfo GetLocaleInfoA EnumSystemLocalesA IsValidLocale InitializeCriticalSectionAndSpinCount InterlockedExchange GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle SetEndOfFile LocalFree VirtualQuery GetSystemTimeAsFileTime GetCommandLineA ReadFile CreateFileW

user32

SetWindowTextA GetActiveWindow SetWindowTextW CreateAcceleratorTableA UnhookWindowsHookEx IsWindow GetDesktopWindow SetFocus DestroyAcceleratorTable BeginPaint EndPaint DestroyWindow FillRect ReleaseCapture GetClassNameA IsChild SetCapture RedrawWindow InvalidateRgn InvalidateRect ReleaseDC GetDC GetWindowTextA GetWindowTextLengthA RegisterWindowMessageA OffsetRect ScreenToClient ClientToScreen DialogBoxParamA WindowFromPoint EndDialog LoadIconA GetMonitorInfoA CallWindowProcW GetDlgItem IsDlgButtonChecked CheckDlgButton CreateWindowExA RegisterClassExA CharUpperBuffA CharLowerBuffA MapWindowPoints SetRect IntersectRect EqualRect PtInRect GetCursorPos MessageBoxA GetKeyState LoadStringA GetSystemMetrics CreateIcon GetClassInfoA UnregisterClassA UpdateWindow SetForegroundWindow IsWindowVisible SetParent SetMenu GetSystemMenu DeleteMenu SetCursorPos SetActiveWindow GetMessageA GetWindowInfo SetWindowLongW GetWindowLongW IsIconic PostQuitMessage SetTimer SetPropA SetWindowsHookExA FindWindowExA ShowWindow KillTimer SetWindowPos RegisterClassA CallNextHookEx GetSysColor SendMessageA LoadCursorA GetClassInfoExA GetWindowRect MoveWindow TranslateMessage DispatchMessageA GetClientRect CallWindowProcA GetFocus GetWindow GetParent PostMessageA GetWindowLongA SetWindowLongA DefWindowProcA CharNextW CharNextA SetWindowRgn MonitorFromWindow SendMessageW GetPropA

gdi32

GetDIBits GetBitmapBits CreateDIBitmap CreateDIBSection ExtCreateRegion CreateICA CreateRectRgn CreateRoundRectRgn OffsetWindowOrgEx SetWindowOrgEx GetPixel GetStockObject GetObjectA CreateSolidBrush BitBlt CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject CreateDCA GetDeviceCaps DeleteDC

advapi32

RegCreateKeyExW RegSetValueExW RegQueryValueExW RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegOpenKeyExW

shell32

ShellExecuteExW SHGetFolderPathA ShellExecuteA

ole32

StringFromGUID2 StringFromCLSID CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoCreateInstance WriteClassStm CoInitialize OleSaveToStream ReadClassStm OleRun CLSIDFromProgID OleLockRunning CoGetClassObject CreateStreamOnHGlobal OleInitialize OleUninitialize CoGetObject CoCreateGuid CLSIDFromString

oleaut32

GetErrorInfo GetActiveObject SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData OleCreateFontIndirect VarBstrCmp SysAllocStringLen VarBstrCat LoadRegTypeLi SysStringByteLen SysAllocStringByteLen VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi VariantClear VariantChangeType VariantCopy VariantInit SysAllocString SysStringLen SysFreeString

shlwapi

PathCanonicalizeA SHDeleteKeyA PathStripPathA PathRemoveFileSpecA SHCreateStreamOnFileA UrlEscapeW PathAddBackslashA

urlmon

CoInternetGetSession URLDownloadToFileA IsValidURL

Sharing

General

Malware Config

Signatures

File Explorer

0272e1cd910e40d43b2f123db668b710_NeikiAnalytics.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/ButtonEvent.dll

kernel32

user32

msvcr90

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/LogEx.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UAC.dll

kernel32

user32

advapi32

shell32

ole32

generic

$PLUGINSDIR/features.txt

$PLUGINSDIR/intro-banner.bmp

$PLUGINSDIR/intro-prod.bmp

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsProcess.dll

kernel32

generic

$TEMP/mystart-manifest.xml

$TEMP/mystart-toolbar.xml

$_56_/extensions/{607b689f-7600-45e4-b8e5-887f72dab15c}/manifest.xml

$_6_/$R0

PE Signature issue

wininet

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

urlmon

generic

$_6_/manifest.xml

$_6_/mystarttb.dll

PE Signature issue

wininet

ws2_32

kernel32

user32

gdi32

advapi32

shell32