a0073862ce7094c077bc09f16a2adcb0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
a0073862ce7094c077bc09f16a2adcb0_NeikiAnalytics.exe
Size 2.6MB
Sample240603-mfvjmacd98
SHA256 4e5344104a91febc4c0a875c1449e332ed5b798f41aff7aff76af17ae5d5502d
MD5 a0073862ce7094c077bc09f16a2adcb0
SHA1 c80514ecc14ee9aaadc78414b0bf6d3a226dfd91
SHA512 2fbb505243b5c17568997d70fe76382b745fa4e63f9c9a73104277ea7119857aacbb4832a32b51e802d2147f88ba2c392a8f91abd3743530a0888889e41abe6a
SSDEEP 49152:erOO53RTqtiQ+V8tgJd8z2RAR5FeA6wJlj4hKPgssSt2gB:erOO53w+Cga5Chv7StX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a0073862ce7094c077bc09f16a2adcb0_NeikiAnalytics.exe

File Explorer

a0073862ce7094c077bc09f16a2adcb0_NeikiAnalytics.exe

.exe 2.6MB

a0073862ce7094c077bc09f16a2adcb0_NeikiAnalytics.exe

IMPHASH c997d9e4f7bf98aca34adf373bd51c4f
SHA256 4e5344104a91febc4c0a875c1449e332ed5b798f41aff7aff76af17ae5d5502d
MD5 a0073862ce7094c077bc09f16a2adcb0
SHA1 c80514ecc14ee9aaadc78414b0bf6d3a226dfd91
SHA512 2fbb505243b5c17568997d70fe76382b745fa4e63f9c9a73104277ea7119857aacbb4832a32b51e802d2147f88ba2c392a8f91abd3743530a0888889e41abe6a
SSDEEP 49152:erOO53RTqtiQ+V8tgJd8z2RAR5FeA6wJlj4hKPgssSt2gB:erOO53w+Cga5Chv7StX
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

120700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathFileExistsW PathIsDirectoryW

wininet

InternetConnectW InternetReadFile InternetCrackUrlW HttpSendRequestW InternetQueryOptionW InternetOpenW HttpOpenRequestW InternetCloseHandle InternetSetOptionW HttpQueryInfoW InternetSetStatusCallbackW InternetQueryDataAvailable

kernel32

MultiByteToWideChar FindFirstFileW FreeLibrary CompareFileTime LoadLibraryW CopyFileW GetVersionExW CreateFileW GetProcAddress FindClose FindNextFileW GetFileTime GetFileAttributesExW CloseHandle FileTimeToLocalFileTime DeleteFileW WideCharToMultiByte FindResourceW LoadResource SizeofResource LockResource GetLastError ReadFile GetModuleFileNameW Sleep GetCurrentProcess GetModuleHandleW HeapAlloc HeapFree GetProcessHeap lstrlenW InterlockedIncrement InterlockedDecrement WaitForSingleObject CreateMutexA ReleaseMutex EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapReAlloc HeapSize LocalFree FormatMessageA GetUserDefaultLCID GetStringTypeExA LCMapStringA LoadLibraryA FindResourceExW IsProcessorFeaturePresent RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent DecodePointer InterlockedExchange InterlockedCompareExchange HeapSetInformation TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter EncodePointer

advapi32

RegSetValueExW RegCloseKey RegOpenKeyExW RegQueryValueExW GetUserNameW

shell32

SHFileOperationW SHCreateDirectoryExW SHGetFolderPathW

ole32

CoTaskMemFree CoCreateGuid

msvcp100

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ?id@?$codecvt@DDH@std@@2V0locale@2@A ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Decref@facet@locale@std@@QAEPAV123@XZ ?_Incref@facet@locale@std@@QAEXXZ ??Bid@locale@std@@QAEIXZ ?id@?$codecvt@_WDH@std@@2V0locale@2@A ??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ ??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@XZ ?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@_WDH@std@@QBEHAAHPAD1AAPAD@Z ?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z ?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Init@locale@std@@CAPAV_Locimp@12@XZ ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?toupper@?$ctype@D@std@@QBEDD@Z ??1_Container_base12@std@@QAE@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ?classic@locale@std@@SAABV12@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z ??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?tolower@?$ctype@D@std@@QBEDD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPBD@Z ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?_Xout_of_range@std@@YAXPBD@Z ?_BADOFF@std@@3_JB ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ

msvcr100

??0exception@std@@QAE@ABV01@@Z ??8type_info@@QBE_NABV0@@Z memmove memcmp _unlock_file strlen ungetc fgetpos _fseeki64 memchr fflush fgetc tolower fsetpos setvbuf memset _lock_file ??_V@YAXPAX@Z _purecall ??3@YAXPAX@Z memcpy_s fwrite fclose ??2@YAPAXI@Z fputwc ungetwc wcslen fgetwc wcscmp memmove_s _vscwprintf wmemcpy_s wcsnlen vswprintf_s iswspace _wsopen_s _close _time32 strtok_s _getpid strftime _gmtime32_s pow signal exit sprintf_s isspace atoi ispunct _localtime64 _time64 rand srand __CxxFrameHandler3 _CxxThrowException ferror fread _errno free malloc strerror ftell fprintf _fdopen fopen sprintf _unlock __dllonexit _lock _onexit _amsg_exit __getmainargs _cexit _exit _XcptFilter __initenv _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _invoke_watson _controlfp_s ??0exception@std@@QAE@ABQBD@Z ??1exception@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ ??0bad_cast@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z ??1bad_cast@std@@UAE@XZ fputc memcpy

user32

LoadStringA