f42d1293a1cdc6771d17207552453490_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

f42d1293a1cdc6771d17207552453490_NeikiAnalytics.exe
Size

5.8MB
MD5

f42d1293a1cdc6771d17207552453490
SHA1

f48ecf424a804da64fb62565637ce5f2ca73fd81
SHA256

0982c674b9b7f47ce5af3d8d673656a23398f25a87ba76c8984afb980b75c52c
SHA512

e83c2463210c9d71d0bbcd31dd1da4271107420c71416df9054e8eff44bff1226ea27540bece0307dd6db3d143adb5b15404e8d6caf104e584722992a94ad659
SSDEEP

98304:eK5yMFsSynocXPSGqkSfBzTj1WRu5CSPYPAsRcgHBUp4ac9BBjx:TyMFsSynocXPSGqb9Tjc9CCNBUpvc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f42d1293a1cdc6771d17207552453490_NeikiAnalytics.exe

Files

f42d1293a1cdc6771d17207552453490_NeikiAnalytics.exe
.exe windows:6 windows x86 arch:x86

f680cfeaf917b138f29c83cf6ef2a7a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

NeXAS（マスター用）（Steam）.pdb

Imports

kernel32

DecodePointer
InitializeCriticalSectionEx
DeleteCriticalSection
GetLocalTime
GetFileAttributesW
GetNumaProcessorNodeEx
GetNumaHighestNodeNumber
LoadLibraryA
VirtualUnlock
GetLargePageMinimum
VirtualProtect
GetCurrentProcessorNumberEx
K32GetProcessMemoryInfo
GetProcessTimes
FlsFree
FlsSetValue
FlsAlloc
GetEnvironmentVariableA
GetFullPathNameA
DeleteFileW
WideCharToMultiByte
GetModuleHandleW
GetVolumeInformationW
GetLogicalDrives
GetDriveTypeW
MultiByteToWideChar
SetThreadExecutionState
GetSystemTimeAdjustment
LoadLibraryW
OpenProcess
lstrcpyA
IsDebuggerPresent
lstrcmpA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
CreateMutexW
GetTempPathW
CreateFileW
CreateDirectoryW
SetCurrentDirectoryW
GetUserDefaultUILanguage
FormatMessageW
LocalFree
GetNativeSystemInfo
GetLastError
FindNextFileW
FindFirstFileW
FindClose
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
CloseHandle
ReadProcessMemory
GetProcAddress
FreeLibrary
MoveFileW
DisableThreadLibraryCalls
lstrcmpiW
GetVersionExW
GetThreadPriority
MulDiv
lstrlenW
lstrcpynW
lstrcmpW
VirtualFree
VirtualAlloc
GetSystemInfo
CreateSemaphoreW
ReleaseSemaphore
DuplicateHandle
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
WriteConsoleW
SetEndOfFile
GetConsoleOutputCP
HeapSize
ReadConsoleW
GetConsoleMode
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
CopyFileW
GetModuleFileNameW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
HeapReAlloc
SetConsoleCtrlHandler
SetFilePointerEx
GetFileSizeEx
GetFileType
HeapAlloc
HeapFree
GetCurrentThread
EnumSystemLocalesW
GetUserDefaultLCID
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockShared
Sleep
FormatMessageA
SetFileInformationByHandle
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
GetLocaleInfoEx
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
WakeAllConditionVariable
SleepConditionVariableSRW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
TerminateProcess
GetFileSize
FindResourceW
LoadResource
SizeofResource
LockResource
SetFilePointer
FreeResource
ReadFile
WriteFile
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FlushFileBuffers
GlobalAlloc
GlobalFree
GetFullPathNameW
CreateProcessW
GetExitCodeProcess
GetSystemDefaultUILanguage
ReleaseMutex
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
WaitForMultipleObjects
SetThreadPriority
ResumeThread
lstrcpyW
InitializeCriticalSection
CreateThread
OutputDebugStringW
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
ExitThread
FreeLibraryAndExitThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetTickCount

user32

GetDC
ReleaseDC
SetWindowTextW
DefWindowProcW
IsWindowVisible
SetWindowPos
PostQuitMessage
MessageBoxW
GetSystemMetrics
SetRectEmpty
SetCapture
ReleaseCapture
BeginPaint
GetKeyState
IsRectEmpty
ScreenToClient
GetWindowRect
SendMessageW
GetDoubleClickTime
GetCursorPos
ShowWindow
SetFocus
SetForegroundWindow
DestroyWindow
SetTimer
EnableWindow
UpdateWindow
SetActiveWindow
CloseWindow
OpenIcon
PostMessageW
GetWindowTextW
GetDlgItem
IsWindowEnabled
SetPropW
MapWindowPoints
IsWindowUnicode
GetPropW
IsWindow
IsDialogMessageW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
PeekMessageW
LoadAcceleratorsW
FillRect
LoadCursorW
RegisterClassW
CreateMDIWindowW
KillTimer
CreateDialogParamW
SendDlgItemMessageW
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckDlgButton
CheckRadioButton
IsDlgButtonChecked
DialogBoxParamW
EndDialog
EnumDisplaySettingsW
EnumWindows
ChangeDisplaySettingsExW
ChangeDisplaySettingsW
GetWindowTextLengthW
EnumChildWindows
PostThreadMessageW
GetQueueStatus
wvsprintfW
wsprintfW
RegisterWindowMessageW
MsgWaitForMultipleObjects
EndPaint
UnregisterClassW
GetWindow
GetWindowLongW
ShowCursor
DefMDIChildProcW
DefFrameProcW
SetWindowPlacement
GetWindowPlacement
MoveWindow
CreateWindowExW
CallWindowProcW
GetMonitorInfoW
MonitorFromWindow
SetWindowLongW
ClipCursor
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetParent
ClientToScreen
SetCursorPos
GetClientRect

gdi32

GetTextMetricsW
SelectObject
GetGlyphOutlineW
DeleteObject
CreateFontW
GetStockObject
EnumFontFamiliesW
CreateFontIndirectW
SetBkMode
SetTextColor
TextOutW
SetBkColor
GetBitmapDimensionEx
CreateCompatibleDC
GetDIBits
DeleteDC
StretchDIBits
BitBlt
SetStretchBltMode
SetBrushOrgEx
StretchBlt
AddFontMemResourceEx
RemoveFontMemResourceEx
GetDeviceCaps
CreateDIBSection

advapi32

LookupPrivilegeValueA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumValueW
OpenProcessToken
AdjustTokenPrivileges

shell32

ShellExecuteW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW
Shell_NotifyIconW

winmm

timeGetDevCaps
timeGetTime
timeSetEvent
timeKillEvent
timeEndPeriod
timeBeginPeriod

dbghelp

MiniDumpWriteDump

steam_api

SteamAPI_UnregisterCallback
SteamAPI_Init
SteamAPI_Shutdown
SteamAPI_RestartAppIfNecessary
SteamAPI_WriteMiniDump
SteamAPI_SetMiniDumpComment
SteamInternal_FindOrCreateUserInterface
SteamInternal_CreateInterface
SteamInternal_ContextInit
SteamAPI_GetHSteamUser
SteamAPI_RunCallbacks
SteamAPI_RegisterCallback

shlwapi

ord219

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

dinput8

DirectInput8Create

mf

MFCreateMediaSession
MFCreateTopology
MFCreateAudioRendererActivate
MFCreateVideoRendererActivate
MFCreateTopologyNode
MFGetService

mfplat

MFShutdown
MFCreateSourceResolver
MFCreateMFByteStreamOnStream
MFStartup

msvfw32

MCIWndCreateW

wmvcore

WMCreateSyncReader

ole32

CoTaskMemAlloc
PropVariantClear
CoCreateInstance
CoFreeUnusedLibraries
GetRunningObjectTable
CoTaskMemFree
CoInitialize
CoUninitialize
CreateItemMoniker

oleaut32

SysFreeString
SysAllocString

bcrypt

BCryptGenRandom

Sections

.text
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1009KB - Virtual size: 1008KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f680cfeaf917b138f29c83cf6ef2a7a1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

winmm

dbghelp

steam_api

shlwapi

version

dinput8

mf

mfplat

msvfw32

wmvcore

ole32

oleaut32

bcrypt

Sections

.text Size: 4.7MB - Virtual size: 4.7MB

.rdata Size: 1009KB - Virtual size: 1008KB

.data Size: 42KB - Virtual size: 1.2MB

.rsrc Size: 7KB - Virtual size: 6KB

.text
Size: 4.7MB - Virtual size: 4.7MB

.rdata
Size: 1009KB - Virtual size: 1008KB

.data
Size: 42KB - Virtual size: 1.2MB

.rsrc
Size: 7KB - Virtual size: 6KB