1d4f43ae16e995561ea2cfd0d7b59610_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1d4f43ae16e995561ea2cfd0d7b59610_NeikiAnalytics.exe
Size

192KB
MD5

1d4f43ae16e995561ea2cfd0d7b59610
SHA1

b64894c642d189ce6951d981054adf0b6c6fe8fa
SHA256

995d9a12fb167bf465ed1119feeb5a12db90bc09fe9390016c223e1daa009049
SHA512

e4f8191e199b76b7e2d92ea939d540af84c713c53e657190af651582b48249bfabd6f7aab9efbcedf600b107374ddd31d9ee98f6aafc99d46052209559c68102
SSDEEP

3072:KKspiWc40UsrzTNO1y9iLWrtm3eRIZValxWx7:ipw4ZOzH9OWOSIZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d4f43ae16e995561ea2cfd0d7b59610_NeikiAnalytics.exe

Files

1d4f43ae16e995561ea2cfd0d7b59610_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

a3cf9776a06c88470dd855ed0cc017ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
Sleep
CloseHandle
ReadFile
GetFileSize
MapViewOfFile
WriteFile
DeleteFileA
GetTickCount
GetProcessHeap
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
ReleaseMutex
LoadLibraryExA
CopyFileA
HeapCreate
GetSystemDirectoryA
ExpandEnvironmentStringsA
UpdateResourceA
EndUpdateResourceA
BeginUpdateResourceA
CreateMutexA
GetTempPathA
UnmapViewOfFile
WideCharToMultiByte
GetSystemInfo
CreateFileA

user32

DispatchMessageA
IsWindow
GetWindowThreadProcessId
GetDCEx
wsprintfA
MessageBoxA
WindowFromDC
GetAncestor
PrintWindow
GetWindowInfo
GetWindowRect
IsIconic
ReleaseDC
GetDC
IsWindowVisible
GetWindow
GetKeyboardLayoutList
UnloadKeyboardLayout
SystemParametersInfoA
CallWindowProcA

shlwapi

PathFileExistsA
PathFindFileNameA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

imm32

ImmInstallIMEA

gdi32

SelectObject
CreateDIBSection
BitBlt
GetObjectA
GetCurrentObject
CreateCompatibleDC
GetStockObject
GetDIBits

msvcrt

strrchr
??3@YAXPAX@Z
rand
_atoi64
strncpy
strncmp
_ftol
atoi
sprintf
_CIfmod
_stricmp
??2@YAPAXI@Z
__CxxFrameHandler
floor
strchr
memmove
modf
free
malloc
_strnicmp

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA

Exports

Exports

Lw_GetUserFunction
lw_BaseNamedObjects
lw_CallFunc
lw_CopyObj
lw_CreateMapping
lw_CreateThread
lw_FindColorBlock
lw_FindMultiColor
lw_FindMultiColorEx
lw_FindMultiColorEx0
lw_FreeLibrary
lw_FreeLibrary_Memory
lw_GdiToDx
lw_GetNtId
lw_GetObjNameIdx
lw_GetProcessPEB
lw_GetWindowPic
lw_HeapAlloc
lw_HeapFree
lw_HeapSize
lw_InstallIMEA
lw_IshProcessDebuggerPresent
lw_LoadLibraryA
lw_LoadLibraryA_Memory
lw_MapView
lw_OpenProcess
lw_OpenThread
lw_OpneMapping
lw_ReadMemory
lw_SendStringA
lw_UnInstallIMEA
lw_UnMapView
lw_VirtualAlloc
lw_VirtualAllocEx
lw_VirtualFree
lw_VirtualFreeEx
lw_VirtualProtect
lw_VirtualQuery
lw_WriteMemory
lw_findPic0
lw_getD3dHookAddr
lw_isProcessX64

Sections

.text
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3cf9776a06c88470dd855ed0cc017ff

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

version

imm32

gdi32

msvcrt

advapi32

Exports

Exports

Sections

.text Size: 168KB - Virtual size: 165KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 8KB - Virtual size: 54KB

.rsrc Size: 4KB - Virtual size: 684B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 168KB - Virtual size: 165KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 8KB - Virtual size: 54KB

.rsrc
Size: 4KB - Virtual size: 684B

.reloc
Size: 4KB - Virtual size: 3KB