16e3d92f16e9ccc3752437a114d82ac0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
16e3d92f16e9ccc3752437a114d82ac0_NeikiAnalytics.exe
Size 463KB
Sample240526-vplbbadf3w
SHA256 ad7053f43a80b0565bf8939f6e65eb0387d5bca3a22ec2e217e0a027beeb8d54
MD5 16e3d92f16e9ccc3752437a114d82ac0
SHA1 a06991b8c646fd262b241f34f8613f478228fac6
SHA512 b008d3d738ebb18cac46e524398b1fae3dd2ca1d8640748158d1b1b7ac44a500c5e3345c6b9cc8ae720326c67bf7e464a88a287c858f96b16a6824c8b37ad633
SSDEEP 12288:5NUhiHOR4mucvSFSrux88ndNtJXzLFziVbs0:LUhiHOeB8rin3thLof
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16e3d92f16e9ccc3752437a114d82ac0_NeikiAnalytics.exe

File Explorer

16e3d92f16e9ccc3752437a114d82ac0_NeikiAnalytics.exe

.exe 463KB

16e3d92f16e9ccc3752437a114d82ac0_NeikiAnalytics.exe

IMPHASH 8adadb30040f7c8f83dd61a4aaaa08ea
SHA256 ad7053f43a80b0565bf8939f6e65eb0387d5bca3a22ec2e217e0a027beeb8d54
MD5 16e3d92f16e9ccc3752437a114d82ac0
SHA1 a06991b8c646fd262b241f34f8613f478228fac6
SHA512 b008d3d738ebb18cac46e524398b1fae3dd2ca1d8640748158d1b1b7ac44a500c5e3345c6b9cc8ae720326c67bf7e464a88a287c858f96b16a6824c8b37ad633
SSDEEP 12288:5NUhiHOR4mucvSFSrux88ndNtJXzLFziVbs0:LUhiHOeB8rin3thLof
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses GetModuleFileNameExW

msi

ord131 ord16 ord88 ord159 ord160 ord92 ord70 ord118 ord32 ord141 ord205 ord8

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock UnloadUserProfile

kernel32

GetCurrentDirectoryW ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead LCMapStringW GetStdHandle ExitProcess GetCommandLineW GetCommandLineA GetModuleHandleExW HeapQueryInformation GetFileType SetStdHandle RtlUnwind OutputDebugStringW SetEvent GlobalFlags WriteConsoleW GetFileTime GetFileSizeEx GetFileAttributesExW GetCurrentProcessId LocalReAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection CompareStringW GlobalFindAtomW GlobalAddAtomW GlobalDeleteAtom FreeLibrary GetSystemDirectoryW GetCurrentThreadId EncodePointer FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindNextFileW FileTimeToLocalFileTime LoadLibraryA LoadLibraryExW DuplicateHandle UnlockFile SetEndOfFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers GlobalFree GlobalUnlock GlobalLock GlobalAlloc LoadLibraryW GetModuleHandleA GetModuleFileNameW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetACP WideCharToMultiByte CreateThread lstrcmpW lstrcmpA LocalAlloc FindResourceExW SetFilePointer FindFirstFileW FindClose SystemTimeToFileTime GetSystemTime Process32NextW Process32FirstW CreateToolhelp32Snapshot MultiByteToWideChar CopyFileW GetProcAddress GetModuleHandleW GetWindowsDirectoryW GetTickCount64 OpenProcess CreateProcessW GetExitCodeProcess Sleep CreateEventW WaitForSingleObject RemoveDirectoryW ReadFile GetLongPathNameW MoveFileW FormatMessageW LocalFree FindResourceW SizeofResource LockResource LoadResource GetLocalTime DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError RaiseException DecodePointer GetTempPathW SetFileAttributesW WritePrivateProfileStringW GetPrivateProfileStringW lstrlenW GetCurrentThread GetCurrentProcess GetLastError CloseHandle WriteFile GetFileAttributesW DeleteFileW CreateFileW GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx GetDriveTypeW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW IsDebuggerPresent

user32

PostQuitMessage LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem DestroyMenu RealChildWindowFromPoint ClientToScreen TabbedTextOutW GrayStringW DrawTextExW DrawTextW GetSysColorBrush ReleaseDC GetWindowThreadProcessId GetForegroundWindow MessageBoxW IsWindowEnabled GetMonitorInfoW MonitorFromWindow WinHelpW LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassNameW GetClassLongW SetWindowLongW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient AdjustWindowRectEx GetWindowRect RemovePropW GetPropW SetPropW GetDC SetCursor LoadCursorW GetDlgItem SetWindowTextW FindWindowW GetClientRect SetRectEmpty OffsetRect GetParent GetSubMenu GetMenuItemID GetMenuItemCount CharUpperW GetSystemMetrics SendMessageW GetScrollPos GetWindowTextW GetWindowLongW GetWindow RegisterWindowMessageW DispatchMessageW PeekMessageW GetMessagePos RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow SetMenu GetMenu EnableWindow GetCapture GetKeyState GetFocus GetDlgCtrlID IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos DestroyWindow IsMenu IsWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW PostMessageW GetMessageTime

gdi32

ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW SetMapMode SelectObject SaveDC RestoreDC RectVisible PtVisible DeleteDC GetDeviceCaps SetBkColor SetTextColor CreateBitmap DeleteObject Escape GetClipBox GetStockObject

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegQueryInfoKeyW CheckTokenMembership OpenThreadToken OpenProcessToken DuplicateToken GetLengthSid GetSidLengthRequired GetSidSubAuthority InitializeSid IsValidSid CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW SetNamedSecurityInfoW GetNamedSecurityInfoW ConvertSidToStringSidW RegDeleteKeyW RegSetValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumValueW RegDeleteValueW RegCreateKeyExW RegCreateKeyW LookupAccountSidW GetTokenInformation GetSidSubAuthorityCount DuplicateTokenEx CreateProcessAsUserW RegQueryValueExW RegOpenKeyExW RegCloseKey CopySid

shell32

SHGetFolderPathW ShellExecuteW SHCreateDirectoryExW SHChangeNotify

shlwapi

PathStripToRootW PathFindFileNameW PathIsUNCW

ole32

CoUninitialize CoCreateInstance CoTaskMemFree CoInitialize

oleaut32

VariantInit VariantClear VariantChangeType

crypt32

CryptDecodeObject CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject

wintrust

WinVerifyTrust

oleacc

CreateStdAccessibleObject LresultFromObject