0162ca1d7dbea3144218a7b21aefb340_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0162ca1d7dbea3144218a7b21aefb340_NeikiAnalytics.exe
Size

74KB
MD5

0162ca1d7dbea3144218a7b21aefb340
SHA1

67ad36d66a46ea46be4b330bf83f816323ac36ca
SHA256

84483f3a1c2825a6fcfb941321c32b85031c21f78ddd32e314944e9ab12d8593
SHA512

f3dfad28e5ceb567b4c23261d5f9e804d822fc42514971903eb9491e0b1b3870b326b0a1dd0dbc144ccba920ffc66521f80f35ea255b002985fcaa24dd56d76b
SSDEEP

1536:6064Q3ece1YMugSs8/5kvJzhw+r+lmc4Csgh9vGrt7JulAHTE:6v4Q3gY/Xkv5hwihyvatwlQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0162ca1d7dbea3144218a7b21aefb340_NeikiAnalytics.exe

Files

0162ca1d7dbea3144218a7b21aefb340_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

fd405bab932fd4dbb2d2a294d2094748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
CloseHandle
GetCurrentProcessId
FlushInstructionCache
SetLastError
lstrcmpA
FreeLibrary
IsBadReadPtr
GetVersionExA
GetSystemDirectoryA
ExitProcess
WaitForSingleObjectEx
SetEvent
OpenEventA
InterlockedIncrement
WaitForSingleObject
ExitThread
Sleep
DeleteFileA
UnmapViewOfFile
lstrcatA
OutputDebugStringA
WritePrivateProfileStringA
GetPrivateProfileSectionNamesA
GetTickCount
WriteProcessMemory
VirtualFree
VirtualAlloc
MapViewOfFileEx
CreateFileMappingA
SetThreadContext
VirtualProtectEx
GetThreadContext
CreateRemoteThread
ResumeThread
DuplicateHandle
EnterCriticalSection
CreateProcessA
FindNextFileA
FindFirstFileA
GetExitCodeThread
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualAllocEx
VirtualFreeEx
QueryDosDeviceA
GetLogicalDriveStringsA
CreateThread
GetWindowsDirectoryA
CopyFileA
GetFileAttributesA
CreateEventA
CreateFileA
MapViewOfFile
SetFileTime
GetFileTime
RemoveDirectoryA
WideCharToMultiByte
MultiByteToWideChar
ResetEvent
OpenFile
GlobalAlloc
GlobalFree
LeaveCriticalSection
GetCurrentProcess
InitializeCriticalSection
lstrcpynA
HeapAlloc
lstrlenA
HeapReAlloc
GetLastError
lstrcpyA
HeapFree
GetProcessHeap
lstrcmpiA
VirtualQuery
VirtualProtect
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
OpenProcess
LoadLibraryA

user32

wvsprintfA
MessageBoxA
wsprintfA

advapi32

SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
RegSetValueExA
RegQueryInfoKeyA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
InitializeSecurityDescriptor
RegCreateKeyExA
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathA

oleaut32

VariantInit
SysAllocString
SysFreeString

wininet

HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCanonicalizeUrlA
InternetOpenA
InternetSetOptionA
InternetQueryDataAvailable
InternetCrackUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
InternetQueryOptionA
HttpAddRequestHeadersA

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

ws2_32

WSAGetLastError
select
inet_ntoa
accept
listen
closesocket
bind
setsockopt
htonl
htons
socket
getpeername
WSAStartup
WSACleanup
inet_addr
gethostbyname
recv
send
connect
shutdown
ioctlsocket
ntohl

urlmon

ObtainUserAgentString

Exports

Exports

?unzip@@YAPAXPADPAK@Z
InstallHook
_WorkProc@4
__mp@4

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fd405bab932fd4dbb2d2a294d2094748

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

wininet

rpcrt4

ws2_32

urlmon

Exports

Exports

Sections

.text Size: 66KB - Virtual size: 65KB

.reloc Size: 7KB - Virtual size: 8KB

.text
Size: 66KB - Virtual size: 65KB

.reloc
Size: 7KB - Virtual size: 8KB