0479e498af1b9af0d8ce2affc93ec350_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
0479e498af1b9af0d8ce2affc93ec350_NeikiAnalytics.exe
Size 877KB
Sample240603-1akdcshe7x
SHA256 ae2de8e82a51d4986b14f7a50b418a5e15da786ada33767583158494f8c0121b
MD5 0479e498af1b9af0d8ce2affc93ec350
SHA1 9ba8f6912ad4569dfa6778bc654be82e7a2470b4
SHA512 13f5a013c3635d9e519242d6c96990a00a165aee9172561de0989f7c1beaef79a6c8e4c3b193e866754aa90efbacd13fc9bc5d30f8d570e992fa16fe53323456
SSDEEP 12288:4Zl6/yg1gdfRTOUi3b1fqGe5i3Hkm3mpFB+jSj7aeDT+J11xNc9vQGjV1MPpkqiW:4YsreeT+jOFGDju93jL02NW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0479e498af1b9af0d8ce2affc93ec350_NeikiAnalytics.exe

File Explorer

0479e498af1b9af0d8ce2affc93ec350_NeikiAnalytics.exe

.exe 877KB

0479e498af1b9af0d8ce2affc93ec350_NeikiAnalytics.exe

IMPHASH f028bd134275f35d7c3cc852b1216601
SHA256 ae2de8e82a51d4986b14f7a50b418a5e15da786ada33767583158494f8c0121b
MD5 0479e498af1b9af0d8ce2affc93ec350
SHA1 9ba8f6912ad4569dfa6778bc654be82e7a2470b4
SHA512 13f5a013c3635d9e519242d6c96990a00a165aee9172561de0989f7c1beaef79a6c8e4c3b193e866754aa90efbacd13fc9bc5d30f8d570e992fa16fe53323456
SSDEEP 12288:4Zl6/yg1gdfRTOUi3b1fqGe5i3Hkm3mpFB+jSj7aeDT+J11xNc9vQGjV1MPpkqiW:4YsreeT+jOFGDju93jL02NW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

421499

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\XF Code\DLPlugins_proj\branches\Tencentdl_v109\Output\Release\Tencentdl.pdb

kernel32

WaitForSingleObject GetCurrentThreadId QueueUserAPC TerminateThread WaitForMultipleObjects GetQueuedCompletionStatus CreateIoCompletionPort SetLastError InterlockedCompareExchange FlushInstructionCache GetCurrentProcess GetSystemTimeAsFileTime GetTickCount SleepEx CreateEventW CreateWaitableTimerW DeleteFileW lstrcpynW OpenProcess CreateToolhelp32Snapshot CopyFileW Sleep CreateThread GetCommandLineW LoadLibraryW GetVersionExW lstrlenA DeviceIoControl CreateFileW RemoveDirectoryW SetFileAttributesW MoveFileW GetFileSize FlushFileBuffers WriteFile ReadFile SetFilePointer WideCharToMultiByte ResetEvent WritePrivateProfileStringW GetPrivateProfileIntW lstrcmpW RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc VirtualProtect VirtualAlloc GetModuleHandleA GetSystemInfo VirtualQuery ExitThread FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeW CreateDirectoryW GetVersionExA GetStartupInfoW GetCurrentThread GetStdHandle GetModuleFileNameA HeapDestroy HeapCreate VirtualFree HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetFullPathNameW GetCurrentDirectoryA HeapAlloc SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA QueryPerformanceCounter GetCurrentProcessId LoadLibraryA GetLocaleInfoA GetLocaleInfoW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode GetTimeZoneInformation SetStdHandle CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetDriveTypeA SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA CreateWaitableTimerA SystemTimeToFileTime ResumeThread OpenEventA FormatMessageA LocalFree GetThreadLocale IsProcessorFeaturePresent ReadProcessMemory GetThreadSelectorEntry VirtualQueryEx DeleteFileA WritePrivateProfileStringA OutputDebugStringA GetSystemDirectoryA PostQueuedCompletionStatus SetFileTime SetWaitableTimer TlsSetValue TlsGetValue GetProcessHeap HeapFree InitializeCriticalSectionAndSpinCount FindFirstFileW FindNextFileW FindClose GetFileAttributesW TlsAlloc InterlockedExchangeAdd SetEvent CreateEventA LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary GetModuleFileNameW TlsFree CloseHandle InterlockedExchange lstrcmpiW GetLastError DeleteCriticalSection InitializeCriticalSection RaiseException LeaveCriticalSection EnterCriticalSection GetSystemDirectoryW GetModuleHandleW GetProcAddress InterlockedIncrement lstrlenW InterlockedDecrement

user32

FindWindowW RedrawWindow SetWindowLongW GetWindowLongW DrawTextW LoadBitmapW EndDialog GetDlgItem GetClientRect GetWindowRect PostMessageW GetActiveWindow DialogBoxParamW GetWindow SystemParametersInfoW MapWindowPoints GetSysColor WindowFromPoint SetWindowTextW LoadStringW GetCapture ReleaseCapture DestroyWindow IsWindow SendMessageW CharNextW CreateDialogParamW PostThreadMessageW CharUpperW TranslateMessage DispatchMessageW GetMessageW CreateWindowExW PtInRect SetRect GetParent CallWindowProcW DefWindowProcW ShowWindow EnableWindow GetSystemMetrics IsIconic MoveWindow BringWindowToTop ClientToScreen InvalidateRect IsWindowVisible ShowOwnedPopups LoadIconW GetLastActivePopup DrawIconEx LoadMenuW DestroyMenu GetMonitorInfoW GetWindowTextW LoadImageW GetCursorPos GetSubMenu UnregisterClassA SetWindowPos GetIconInfo DestroyIcon TrackPopupMenu MonitorFromPoint SetForegroundWindow

gdi32

RestoreDC SaveDC DeleteDC CreateCompatibleDC SelectObject SetBkMode SetTextColor BitBlt StretchBlt CreateCompatibleBitmap DeleteObject CreateFontW GetObjectW ExtTextOutW SetBkColor CreateSolidBrush

advapi32

RegOpenKeyExA RegQueryValueExA AllocateAndInitializeSid CheckTokenMembership FreeSid RegOpenKeyW RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW IsTextUnicode

shell32

ShellExecuteW SHGetSpecialFolderPathW Shell_NotifyIconW SHGetFileInfoW

ole32

CoFreeLibrary CoLoadLibrary CoCreateGuid CoInitializeEx StringFromGUID2 CoRegisterClassObject CoRevokeClassObject CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CLSIDFromProgID

oleaut32

RegisterTypeLi UnRegisterTypeLi SysAllocStringByteLen VariantClear VariantInit LoadTypeLi LoadRegTypeLi VarUI4FromStr SysStringLen SysFreeString SysAllocString

shlwapi

wnsprintfW

comctl32

_TrackMouseEvent

ws2_32

recvfrom htonl ntohl WSAStartup WSACleanup closesocket htons gethostbyname inet_addr select __WSAFDIsSet ntohs inet_ntoa accept getpeername WSAGetLastError listen connect recv ioctlsocket bind sendto socket send setsockopt

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueA

netapi32

NetApiBufferFree NetWkstaTransportEnum Netbios

psapi

GetModuleFileNameExW

imagehlp

SymLoadModule SymGetModuleInfo SymFunctionTableAccess SymInitialize SymSetOptions StackWalk