367ebe5cfe033c91bba7b2f7de80f360_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

367ebe5cfe033c91bba7b2f7de80f360_NeikiAnalytics.exe
Size

73KB
MD5

367ebe5cfe033c91bba7b2f7de80f360
SHA1

3d3b022ed653e201230db0e4ee8000bf34816be2
SHA256

006c10c91fad58c580646a31390db30a317f5dcc4fa32a5f687208a1c770301c
SHA512

8a481ba7c9c13ce1dbffcdf887a59a4fd5010f4cbffb3335cfcd7f03f539a08fc182bf35d2df74ad609689e8c3d1b1185440f929456908acdb00a6c7859a499e
SSDEEP

1536:qKsY9scX+gP0h95GVm+Kq+dV2Cp8hkpjNrFSI4XvR:qbY+Vg+qmuTE8apjNh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
367ebe5cfe033c91bba7b2f7de80f360_NeikiAnalytics.exe

Files

367ebe5cfe033c91bba7b2f7de80f360_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

958eb303cf23462ca16b7c310f2d8fc8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventW
GetCurrentThread
GetSystemDirectoryW
SetUnhandledExceptionFilter
SetErrorMode
CopyFileW
CreateDirectoryW
GetWindowsDirectoryW
GetModuleFileNameW
OpenEventW
OpenProcess
GetCommandLineW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetSystemDefaultLangID
UnmapViewOfFile
ResumeThread
SetThreadContext
GetThreadContext
VirtualFreeEx
GetVolumeNameForVolumeMountPointW
FlushFileBuffers
GetExitCodeProcess
MoveFileExW
SetFileAttributesW
TryEnterCriticalSection
LocalFree
WideCharToMultiByte
MapViewOfFile
CreateFileMappingW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetSystemTimeAsFileTime
GetSystemTime
FileTimeToSystemTime
SetThreadAffinityMask
CreateRemoteThread
WaitForMultipleObjects
SetLastError
ReadProcessMemory
CreateThread
WaitForSingleObject
GetExitCodeThread
ExitProcess
VirtualProtect
LoadLibraryExA
IsProcessorFeaturePresent
GetProcessHeap
HeapAlloc
HeapFree
LoadLibraryW
GetModuleHandleW
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
VirtualAllocEx
QueueUserWorkItem
WriteProcessMemory
VirtualAlloc
LoadLibraryA
FreeLibrary
VirtualFree
GetCurrentThreadId
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetLastError
GetCurrentProcess
CreateProcessW
GetFileSize
ReadFile
WriteFile
DeleteFileW
GetTempPathW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
Sleep
CreateFileW
GetCurrentProcessId
DeviceIoControl
CloseHandle
GetSystemDirectoryA
GetTickCount
GetModuleFileNameA
WinExec
GetModuleHandleA
GetProcAddress
TerminateProcess

user32

RegisterClassExW
CreateMenu
AppendMenuW
CreatePopupMenu
EnableScrollBar
GetPropA
RemovePropA
GetMenuItemRect
GetClientRect
CreateWindowExW
DestroyWindow
SendInput
GetSystemMetrics
UnregisterClassW
SetPropA
ExitWindowsEx
DefWindowProcW

gdi32

DeleteObject
CreatePalette

advapi32

CryptDestroyKey
OpenServiceW
DeleteService
StartServiceW
RegOpenKeyW
RegSetValueExW
RegFlushKey
RegCloseKey
SetServiceStatus
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid
GetTokenInformation
EqualSid
FreeSid
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptEncrypt
CryptDestroyHash
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerA
CreateServiceA
CloseServiceHandle
StartServiceA
OpenSCManagerW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
SetTokenInformation
RegCreateKeyW
RegQueryValueExW
CryptVerifySignatureW
CryptImportKey
CryptGenRandom
DuplicateTokenEx
CheckTokenMembership
CreateProcessAsUserW
CreateServiceW

shell32

ShellExecuteA
ord680
SHGetFolderPathW

wininet

InternetConnectW
InternetCrackUrlW
HttpOpenRequestW
HttpQueryInfoW
InternetCloseHandle
InternetSetOptionW
InternetOpenW
HttpSendRequestW
HttpAddRequestHeadersW
InternetQueryOptionW
InternetReadFile

ws2_32

listen
bind
htons
recv
getaddrinfo
shutdown
send
sendto
accept
recvfrom
__WSAFDIsSet
select
socket
connect
freeaddrinfo
WSAStartup
getsockname
getpeername
closesocket
setsockopt
inet_addr

dnsapi

DnsQuery_W
DnsFree

userenv

ExpandEnvironmentStringsForUserW
DestroyEnvironmentBlock
CreateEnvironmentBlock

uxtheme

IsThemeActive

msvcrt

_unlink
fclose
fwrite
fopen
sprintf
free
_time64
_wcsicmp
_wcsdup
_vsnwprintf
malloc
memcpy
memset
_except_handler3
_stricmp
getenv
memmove
calloc
wcschr
wcsstr
_wcsnicmp
_wtoi
_ftol
wcsrchr
_errno
_itoa
qsort
bsearch
strcspn
realloc

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

958eb303cf23462ca16b7c310f2d8fc8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

wininet

ws2_32

dnsapi

userenv

uxtheme

msvcrt

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 6KB

.reloc Size: 4KB - Virtual size: 4KB

.reloc Size: 9KB - Virtual size: 12KB

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 6KB

.reloc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 9KB - Virtual size: 12KB