4fe96b8729976fcd31d019d10c694630_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4fe96b8729976fcd31d019d10c694630_NeikiAnalytics.exe
Size

85KB
MD5

4fe96b8729976fcd31d019d10c694630
SHA1

ecb2da9c70c10a9a9a2b66911028448f7b97ddfb
SHA256

8c8d49dc0a23121587437f309e8f054658886085064bb5972bf20c67bf247f57
SHA512

33fb3509f303b0230b34ef86a01ce3efb38038a78ad626dab69ac975ad16a084e986e23f11bbd45812bb48eea97e3f7f20f399d3c413a1842c518e2489b29dea
SSDEEP

1536:Ifk4LDEZk0pGYSaLuZFFN7LbQoJEoCtQw:Ifk4OhpGYLuZZQwCi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4fe96b8729976fcd31d019d10c694630_NeikiAnalytics.exe

Files

4fe96b8729976fcd31d019d10c694630_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

ac1d1a024c83c44d48bc607a77f2c3a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\KbMedia\kpi_decoder\kbsmaf\source\_temp\Win32\Release(XP)\mrgplay\mrgplay.pdb

Imports

kernel32

GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetCurrentThreadId
MultiByteToWideChar
GetLastError
GlobalAlloc
RaiseException
LoadResource
FindResourceW
DecodePointer
GetProcAddress
GlobalLock
DeleteCriticalSection
InterlockedIncrement
lstrcmpiW
GlobalUnlock
lstrcmpW
MulDiv
LoadLibraryExW
OpenEventW
OpenFileMappingW
UnmapViewOfFile
OpenProcess
GetCommandLineW
LocalFree
WideCharToMultiByte
OutputDebugStringW
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
HeapFree
HeapAlloc
EncodePointer
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
IsBadWritePtr
EnterCriticalSection
SetLastError
SizeofResource
SetDllDirectoryW
FreeLibrary
GetCurrentProcessId
ResetEvent
CreateThread
LoadLibraryW
InterlockedDecrement
CloseHandle
SetEvent
CreateEventW
WaitForSingleObject
WaitForMultipleObjects
VirtualQuery
lstrcmpiA
GetModuleHandleW
VirtualProtect
MapViewOfFile

user32

InvalidateRgn
DispatchMessageW
RedrawWindow
ClientToScreen
DestroyAcceleratorTable
IsChild
IsWindow
RegisterClassExW
SetWindowTextW
UnregisterClassW
SendMessageW
PostThreadMessageW
GetWindowTextW
EndPaint
BeginPaint
ReleaseDC
InvalidateRect
ReleaseCapture
RegisterWindowMessageW
GetParent
GetClassInfoExW
ScreenToClient
CreateWindowExW
FillRect
SetWindowPos
GetDC
DestroyWindow
GetFocus
GetWindow
CallWindowProcW
DefWindowProcW
MoveWindow
GetWindowLongW
GetWindowTextLengthW
GetMessageW
CreateAcceleratorTableW
SetFocus
CharNextW
TranslateMessage
LoadCursorW
GetClassNameW
SetCapture
SetWindowLongW
GetClientRect
GetDlgItem
GetDesktopWindow
GetSysColor

gdi32

CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetStockObject
GetDeviceCaps
DeleteDC
GetObjectW
DeleteObject
BitBlt
CreateSolidBrush

advapi32

RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExA

ole32

CLSIDFromString
OleLockRunning
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CLSIDFromProgID
CoCreateInstance
CoUninitialize
StringFromGUID2
CoTaskMemAlloc
CoInitialize
OleUninitialize
CoTaskMemRealloc

oleaut32

LoadRegTypeLi
VariantInit
LoadTypeLi
SysFreeString
OleCreateFontIndirect
SysAllocString
DispCallFunc
SysStringLen
SysAllocStringLen
VariantClear
VarUI4FromStr
GetErrorInfo

vcruntime140

_except_handler4_common
_CxxThrowException
__std_exception_destroy
memcpy
memset
__std_terminate
wcsstr
__CxxFrameHandler3
__std_exception_copy

api-ms-win-crt-string-l1-1-0

wcscpy_s
_stricmp
wcsncpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s
_set_fmode
__p__commode
__stdio_common_vswprintf_s

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_set_new_mode
free
_recalloc

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_configure_wide_argv
_set_app_type
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_cexit
_controlfp_s
_errno
_crt_atexit
_register_onexit_function
_initialize_onexit_table
terminate
_exit
_invalid_parameter_noinfo

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac1d1a024c83c44d48bc607a77f2c3a0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 54KB - Virtual size: 53KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 54KB - Virtual size: 53KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 5KB