15bef8e5b16c25febfdcb8690a1be9e0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
15bef8e5b16c25febfdcb8690a1be9e0_NeikiAnalytics.exe
Size 1.3MB
Sample240608-qmkjsabh8v
SHA256 d6c44c7ee6cb7ec3f8d810a64e21f77d20672a0e712dbdd952defce5a19cb521
MD5 15bef8e5b16c25febfdcb8690a1be9e0
SHA1 bc9cd634c76472c3c93b85b5606e100bef680464
SHA512 2a778d35ff6880dda8c7e015007984bbbe33c0a372cee64a7d1bb7aee2b5bd61449a4574cf76d1a91a8dfbd63ced0307258e3f7e2f4b27ad9e77ac8bfebee505
SSDEEP 24576:23LutmkEz+PAVV/bOInO4Xs2ztR4iegxLHgZpJE4VDd/SkQ/7Gb8NLEbeZ:2butmkO+wROInO4XrztygxLHkJE4VB6T
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15bef8e5b16c25febfdcb8690a1be9e0_NeikiAnalytics.exe

File Explorer

15bef8e5b16c25febfdcb8690a1be9e0_NeikiAnalytics.exe

.exe 1.3MB

15bef8e5b16c25febfdcb8690a1be9e0_NeikiAnalytics.exe

IMPHASH 5eb440625c49d1fc181879d5ddcfbd20
SHA256 d6c44c7ee6cb7ec3f8d810a64e21f77d20672a0e712dbdd952defce5a19cb521
MD5 15bef8e5b16c25febfdcb8690a1be9e0
SHA1 bc9cd634c76472c3c93b85b5606e100bef680464
SHA512 2a778d35ff6880dda8c7e015007984bbbe33c0a372cee64a7d1bb7aee2b5bd61449a4574cf76d1a91a8dfbd63ced0307258e3f7e2f4b27ad9e77ac8bfebee505
SSDEEP 24576:23LutmkEz+PAVV/bOInO4Xs2ztR4iegxLHgZpJE4VDd/SkQ/7Gb8NLEbeZ:2butmkO+wROInO4XrztygxLHkJE4VB6T
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

433861

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\dw\x86\ship\0\dw20.pdb

version

VerQueryValueW GetFileVersionInfoSizeW VerQueryValueA GetFileVersionInfoW

secur32

GetUserNameExW

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ _controlfp_s _invoke_watson _crt_debugger_hook _decode_pointer _onexit _lock __dllonexit _unlock _vsnprintf_s _except_handler4_common __set_app_type _encode_pointer __p__fmode __p__commode _adjust_fdiv __setusermatherr _configthreadlocale _initterm_e _initterm _acmdln exit _ismbblead _XcptFilter _exit _cexit __getmainargs _amsg_exit fopen_s fwprintf_s fclose vsprintf_s wcscpy_s vswprintf_s wcsrchr _wtoi _CxxThrowException _vsnprintf __CxxFrameHandler3 _CIsqrt memmove _wcsnicmp tolower strncmp ceil strchr strncpy_s _strnicmp wcsncmp _stricmp wcstok_s swprintf_s _wcsicmp memset memcpy wcschr _time32

advapi32

GetSecurityDescriptorDacl RegQueryInfoKeyW ReportEventW RegisterEventSourceW ReportEventA DeregisterEventSource GetUserNameA RegQueryInfoKeyA RegEnumValueA RegEnumKeyExA RegDeleteValueA SetNamedSecurityInfoW ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA RegCreateKeyExA RegDeleteValueW RegSetValueExW RegQueryValueExW RegOpenKeyExA RegQueryValueExA RegCloseKey RegSetValueExA RegOpenKeyExW RegCreateKeyExW RegEnumKeyW RegEnumValueW GetLengthSid AddAccessAllowedAce AddAccessDeniedAce InitializeAcl AllocateAndInitializeSid CopySid OpenThreadToken IsValidSid CheckTokenMembership ConvertStringSecurityDescriptorToSecurityDescriptorW InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid OpenProcessToken GetTokenInformation

comctl32

ImageList_ReplaceIcon ImageList_Create ImageList_Destroy ord17

gdi32

DeleteDC RestoreDC DeleteObject GetTextFaceA SelectObject CreateFontA GetDeviceCaps SetMapMode SaveDC CreateFontIndirectW GetObjectW GetTextExtentPoint32W SetTextAlign GetTextMetricsA GetObjectA ExtTextOutW SetBkMode SetTextColor GetTextFaceW GetOutlineTextMetricsA CreateDCA CreateSolidBrush TranslateCharsetInfo CreateFontIndirectA

kernel32

OpenSemaphoreA CreateEventA OpenEventA GetShortPathNameA LoadLibraryW OutputDebugStringA LoadLibraryExW LocalAlloc GlobalFree GetCurrentThreadId CreateProcessA GlobalAlloc DuplicateHandle GetSystemDirectoryW GetTimeZoneInformation GetDiskFreeSpaceExW GetUserDefaultLCID IsValidLocale GetStringTypeExW IsValidCodePage CompareStringW GetShortPathNameW GetLongPathNameW CreateFileA GetCurrentThread GlobalMemoryStatus ReleaseSemaphore IsProcessorFeaturePresent EnumUILanguagesW EnumSystemLocalesW GetCalendarInfoW GetUserDefaultUILanguage VirtualProtect QueryPerformanceCounter GetTempFileNameA GetTempPathA InterlockedExchange InterlockedCompareExchange GetStartupInfoA UnhandledExceptionFilter IsDebuggerPresent lstrcmpiW GetThreadContext GetThreadTimes GetPriorityClass HeapDestroy HeapCreate TerminateThread GetThreadSelectorEntry GetLastError GetLocalTime LeaveCriticalSection EnterCriticalSection GetCommandLineW MapViewOfFile ReleaseMutex WaitForSingleObject WaitForMultipleObjects SetProcessWorkingSetSize GetCurrentProcess Sleep TerminateProcess DeleteFileW CreateThread CloseHandle GetCurrentProcessId SetUnhandledExceptionFilter GetProcAddress GetModuleHandleA GetVersionExW GetVersionExA GetModuleFileNameW FreeLibrary InitializeCriticalSection GetProcessHeap DeleteCriticalSection MultiByteToWideChar GetSystemTimeAsFileTime GetTimeFormatW GetDateFormatW GetTickCount SetLastError LocalFree WriteFile FindNextFileW FindClose FindFirstFileW GetSystemWindowsDirectoryW MoveFileW SetFilePointer GetComputerNameA SetPriorityClass UnmapViewOfFile GetFileSize CreateFileMappingA SuspendThread ExitThread MulDiv GetModuleFileNameA LoadLibraryA GetSystemDefaultLangID GetSystemDefaultUILanguage GetUserDefaultLangID GetACP GetSystemDefaultLCID SetEvent CreateProcessW ExpandEnvironmentStringsW WideCharToMultiByte GetTempPathW GetFileAttributesW SetEndOfFile IsDBCSLeadByte GetSystemDirectoryA SetThreadPriority CreateRemoteThread OpenProcess LoadLibraryExA SetEnvironmentVariableA CreateDirectoryW ReadProcessMemory VirtualQueryEx GetSystemInfo HeapFree HeapSize HeapValidate HeapAlloc HeapReAlloc VirtualAlloc RaiseException TlsSetValue SetFileAttributesW CreateSemaphoreA FlushFileBuffers ResumeThread InitializeCriticalSectionAndSpinCount TlsAlloc VirtualFree TlsGetValue TlsFree GetModuleHandleW GetVersion GetFileType CreateFileW GetLocaleInfoW GetProcessTimes CreateMutexA OpenMutexA GetThreadPriority

ole32

StringFromIID CoTaskMemFree CoUninitialize CoInitializeEx CoCreateInstance

oleacc

CreateStdAccessibleObject LresultFromObject

oleaut32

SysFreeString SystemTimeToVariantTime VariantTimeToDosDateTime SysAllocString SysStringLen

rpcrt4

UuidCreate

shell32

ExtractIconExA SHGetSpecialFolderPathW ShellExecuteExA

shlwapi

AssocQueryStringW UrlGetPartA wnsprintfA

urlmon

CreateURLMoniker

user32

GetDlgCtrlID IsWindow CreateDialogIndirectParamA DrawTextA DrawTextW MapDialogRect CallWindowProcA MoveWindow GetKeyboardLayout GetMenuCheckMarkDimensions LoadBitmapA GetMonitorInfoA CallWindowProcW SetRectEmpty IsWindowVisible PostMessageA SendMessageA DefWindowProcA SetTimer KillTimer PostQuitMessage DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA CreateWindowExA RegisterClassExA DialogBoxParamA SystemParametersInfoA DestroyIcon LoadStringW DestroyWindow SetWindowPos GetWindowRect GetWindowLongA SetForegroundWindow GetSystemMetrics LoadIconA SetWindowLongA ReleaseDC FillRect GetSysColorBrush MapWindowPoints GetDC SetWindowTextA CreateDialogParamW DialogBoxParamW EnumDisplayMonitors GetDlgItem DrawIconEx ShowWindow LoadCursorA GetClientRect SetCursor DrawFocusRect SetWindowTextW GetWindow InvalidateRect EnableWindow GetSysColor SendDlgItemMessageA EndDialog CheckDlgButton SetFocus LoadStringA IsDlgButtonChecked SetDlgItemTextA GetScrollInfo SetScrollInfo GetFocus FlashWindowEx GetForegroundWindow GetWindowPlacement IsIconic GetWindowThreadProcessId EnumWindows SendMessageTimeoutA GetParent UpdateWindow IsWindowUnicode GetClassNameA SendMessageW GetWindowLongW

wininet

InternetGetConnectedState InternetCloseHandle HttpQueryInfoA InternetReadFileExA HttpEndRequestA InternetWriteFile HttpSendRequestExA InternetCanonicalizeUrlA HttpOpenRequestA InternetConnectA InternetOpenA InternetSetStatusCallback InternetCrackUrlA