73ebaa705c3a35f565ad495adafa3330_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

73ebaa705c3a35f565ad495adafa3330_NeikiAnalytics.exe
Size

839KB
MD5

73ebaa705c3a35f565ad495adafa3330
SHA1

abde5c843db3b98d4cb16d2723277a806caa51c4
SHA256

ed4e620f465a75bb9eff79e9270f80fa6b26bffd7815512abc54c474d079f2fe
SHA512

de64daff4320acbdc742015b87de99d17b0cacabba09011363c14aef6ac4c0aef1cc25fb300097fc9478b21bbb10693a37ce13cac46220f2184133f05aab19d4
SSDEEP

24576:bOCrBYZRsVVrvxckUTNjx+mZCkt76f/24pN+XNqNG6hditW:rre6VVrJck8f9Ckt7c20+9qNxUW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
73ebaa705c3a35f565ad495adafa3330_NeikiAnalytics.exe

Files

73ebaa705c3a35f565ad495adafa3330_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

064c8e2021d9572fe3604c597d12237b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

GoogleCrashHandler_unsigned.pdb

Imports

kernel32

SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetACP
GetCurrentThread
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileType
OutputDebugStringA
CloseHandle
CreateThread
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
CreateFileW
CreateDirectoryW
SizeofResource
RemoveDirectoryW
WaitForMultipleObjects
GetSystemTimeAsFileTime
WaitForSingleObject
ReleaseMutex
DuplicateHandle
LockResource
DeleteFileW
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
LocalFree
lstrcmpiW
GetTickCount
GetExitCodeProcess
GetTempPathW
VirtualQuery
OpenProcess
GetCurrentThreadId
Sleep
ReadProcessMemory
ReadFile
lstrlenW
SetFilePointer
GetFileAttributesExW
MoveFileExW
GetFileTime
lstrcmpW
CreateProcessW
SetProcessWorkingSetSize
GetPrivateProfileIntW
GetPrivateProfileStringW
GetLocalTime
VerSetConditionMask
VerifyVersionInfoW
TryEnterCriticalSection
InitializeCriticalSection
CreateMutexW
CreateEventW
SetEvent
ResetEvent
lstrcpynW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
WaitForDebugEvent
GetProcessId
DebugActiveProcessStop
ContinueDebugEvent
GetSystemInfo
GetThreadContext
DebugActiveProcess
VirtualQueryEx
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
CreateSemaphoreW
ReleaseSemaphore
RtlCaptureContext
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
InitializeSListHead
GetSystemDefaultLangID
GetUserDefaultLangID
DeviceIoControl
GetComputerNameExW
ConnectNamedPipe
GetOverlappedResult
DisconnectNamedPipe
CreateNamedPipeW
GetProcessTimes
UnregisterWait
UnregisterWaitEx
RegisterWaitForSingleObject
VirtualProtect
VirtualAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
GetEnvironmentVariableW
HeapFree

user32

GetWindowThreadProcessId
IsWindowVisible
EnumWindows
CharUpperW
CharLowerW
wvsprintfW
MessageBoxW
SetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
PostThreadMessageW
GetMessageW
DispatchMessageW
PeekMessageW
CreateWindowStationW
GetProcessWindowStation
SetProcessWindowStation
CreateDesktopW
CloseDesktop
GetThreadDesktop
SetThreadDesktop
wsprintfW
CloseWindowStation

advapi32

GetTokenInformation
SetSecurityDescriptorGroup
MakeAbsoluteSD
MakeSelfRelativeSD
GetSecurityDescriptorLength
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken
AddAce
IsValidSid
GetSecurityDescriptorOwner
InitializeSid
ConvertStringSidToSidW
CopySid
GetSecurityDescriptorControl
SetNamedSecurityInfoW
GetSidLengthRequired
GetSidSubAuthority
GetSecurityDescriptorGroup
EqualSid
GetAce
SetSecurityDescriptorOwner
GetAclInformation
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
OpenThreadToken
ConvertSidToStringSidW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorSacl
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
SetTokenInformation

ole32

CoCreateGuid
StringFromGUID2

shell32

SHGetFolderPathW

netapi32

NetApiBufferFree
NetWkstaGetInfo

rpcrt4

UuidCreate

shlwapi

PathCanonicalizeW
PathAppendW
PathIsRelativeW
SHQueryValueExW
PathRemoveFileSpecW
PathRemoveExtensionW
PathStripPathW

userenv

UnloadUserProfile

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

064c8e2021d9572fe3604c597d12237b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

shell32

netapi32

rpcrt4

shlwapi

userenv

version

Sections

.text Size: 170KB - Virtual size: 170KB

.rdata Size: 76KB - Virtual size: 75KB

.data Size: 3KB - Virtual size: 9KB

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 576KB - Virtual size: 580KB

.text
Size: 170KB - Virtual size: 170KB

.rdata
Size: 76KB - Virtual size: 75KB

.data
Size: 3KB - Virtual size: 9KB

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 576KB - Virtual size: 580KB