29936f4e8df91a87986c26e42ad47cc0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

29936f4e8df91a87986c26e42ad47cc0_NeikiAnalytics.exe
Size

74KB
MD5

29936f4e8df91a87986c26e42ad47cc0
SHA1

4309e70159b09f64a7a5f7375fbfd082f1e9b9dc
SHA256

e80b4fd9c7592484dfe8d6d8b3c5f0c2fd3ff3a7c9bf0a08f810c9ec0e143d43
SHA512

150f39c024401c0aa7f28e97a3b009df84f754057e4e458751a7b0bf86f593ceea8ead3d7317b8cff102ba9525d28183608898ac359dfe932af726ec2e0985e3
SSDEEP

1536:sTK4Q3ece1YMugSs8/5kvJzhw+r+lmc4Csgh9vGrt7JxlAHTx:sm4Q3gY/Xkv5hwihyvatLlQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29936f4e8df91a87986c26e42ad47cc0_NeikiAnalytics.exe

Files

29936f4e8df91a87986c26e42ad47cc0_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

fd405bab932fd4dbb2d2a294d2094748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
CloseHandle
GetCurrentProcessId
FlushInstructionCache
SetLastError
lstrcmpA
FreeLibrary
IsBadReadPtr
GetVersionExA
GetSystemDirectoryA
ExitProcess
WaitForSingleObjectEx
SetEvent
OpenEventA
InterlockedIncrement
WaitForSingleObject
ExitThread
Sleep
DeleteFileA
UnmapViewOfFile
lstrcatA
OutputDebugStringA
WritePrivateProfileStringA
GetPrivateProfileSectionNamesA
GetTickCount
WriteProcessMemory
VirtualFree
VirtualAlloc
MapViewOfFileEx
CreateFileMappingA
SetThreadContext
VirtualProtectEx
GetThreadContext
CreateRemoteThread
ResumeThread
DuplicateHandle
EnterCriticalSection
CreateProcessA
FindNextFileA
FindFirstFileA
GetExitCodeThread
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualAllocEx
VirtualFreeEx
QueryDosDeviceA
GetLogicalDriveStringsA
CreateThread
GetWindowsDirectoryA
CopyFileA
GetFileAttributesA
CreateEventA
CreateFileA
MapViewOfFile
SetFileTime
GetFileTime
RemoveDirectoryA
WideCharToMultiByte
MultiByteToWideChar
ResetEvent
OpenFile
GlobalAlloc
GlobalFree
LeaveCriticalSection
GetCurrentProcess
InitializeCriticalSection
lstrcpynA
HeapAlloc
lstrlenA
HeapReAlloc
GetLastError
lstrcpyA
HeapFree
GetProcessHeap
lstrcmpiA
VirtualQuery
VirtualProtect
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
OpenProcess
LoadLibraryA

user32

wvsprintfA
MessageBoxA
wsprintfA

advapi32

SetSecurityDescriptorDacl
OpenProcessToken
GetTokenInformation
RegSetValueExA
RegQueryInfoKeyA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
InitializeSecurityDescriptor
RegCreateKeyExA
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathA

oleaut32

VariantInit
SysAllocString
SysFreeString

wininet

HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCanonicalizeUrlA
InternetOpenA
InternetSetOptionA
InternetQueryDataAvailable
InternetCrackUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
InternetQueryOptionA
HttpAddRequestHeadersA

rpcrt4

RpcStringFreeA
UuidCreate
UuidToStringA

ws2_32

WSAGetLastError
select
inet_ntoa
accept
listen
closesocket
bind
setsockopt
htonl
htons
socket
getpeername
WSAStartup
WSACleanup
inet_addr
gethostbyname
recv
send
connect
shutdown
ioctlsocket
ntohl

urlmon

ObtainUserAgentString

Exports

Exports

?unzip@@YAPAXPADPAK@Z
InstallHook
_WorkProc@4
__mp@4

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fd405bab932fd4dbb2d2a294d2094748

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

wininet

rpcrt4

ws2_32

urlmon

Exports

Exports

Sections

.text Size: 66KB - Virtual size: 65KB

.reloc Size: 7KB - Virtual size: 8KB

.text
Size: 66KB - Virtual size: 65KB

.reloc
Size: 7KB - Virtual size: 8KB