2cf6af5829807f349ebd5179c5f74590_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2cf6af5829807f349ebd5179c5f74590_NeikiAnalytics.exe
Size

807KB
MD5

2cf6af5829807f349ebd5179c5f74590
SHA1

03b23a61dea6ef5857ea0017c65229921385cbf8
SHA256

a13726255907ffcd616342263c68e9ee0a7fec5cce98d204f47d570d1282ed8e
SHA512

bc3da69f5d6756a5a2f12b2f21f47ab5809b2362eefa8167f767b78d7b9ef7479b464a9b2e1e70b9bcabf4c17ef34320660993feb278a53163a2a375ba7dcebb
SSDEEP

24576:6dRn5BZbuiYks0fDoLH2VACP4Az4xfJkva:eRn5BIjkdroLH2VACP4Az4xfJkva

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cf6af5829807f349ebd5179c5f74590_NeikiAnalytics.exe

Files

2cf6af5829807f349ebd5179c5f74590_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

8dd6fb568be97a5eaa8030fbef80a731

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\BranchAI\win\Release\custact\x86\AICustAct.pdb

Imports

msi

ord67
ord114
ord120
ord46
ord26
ord48
ord34
ord145
ord118
ord103
ord70
ord124
ord73
ord171
ord74
ord163
ord160
ord159
ord121
ord125
ord17
ord8
ord32
ord147
ord47
ord144
ord31
ord158
ord20
ord117
ord139
ord58
ord204
ord112
ord189
ord116
ord170
ord49

kernel32

GetStdHandle
GetTickCount
SetEndOfFile
TerminateProcess
OpenProcess
lstrcmpiA
FreeLibrary
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
lstrcmpW
OpenMutexA
Sleep
ExpandEnvironmentStringsW
GetDiskFreeSpaceW
lstrcatW
FindClose
lstrcmpiW
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
RemoveDirectoryA
lstrcatA
lstrcpyA
lstrcpynA
GetLastError
UnlockFile
WriteFile
LockFile
SetFilePointer
ReadFile
GetExitCodeProcess
CloseHandle
WaitForSingleObject
DeleteFileA
DeleteFileW
CreateProcessA
CreateProcessW
GetLocaleInfoA
InterlockedExchange
GetVersionExA
LocalAlloc
LocalFree
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
LoadLibraryA
GetProcAddress
lstrcmpA
GetTempPathW
GetTempFileNameW
CreateFileW
GetTempPathA
GetTempFileNameA
CreateFileA
DuplicateHandle
GetCurrentProcess
RaiseException

user32

GetWindowThreadProcessId
PostMessageA
IsWindow
GetWindowTextW
EnumWindows
GetWindowLongA
wsprintfW
wsprintfA
GetForegroundWindow
MessageBoxW
EnumChildWindows
SendMessageA
GetClassNameA

comdlg32

GetOpenFileNameA

ole32

CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize

Exports

Exports

AI_AuthorSinglePackage
AI_ResolveKnownFolders
AI_SearchOfficeAddins
ActiveInternetConnection
AddCaspolSecurityPolicy
BrowseForFile
CheckFreeTCPPort
CheckIfUserExists
ChooseTextStyles
CloseApplication
CollectFeaturesWithoutCab
ComputeReplaceProductsList
CreateExeProcess
DeleteEmptyDirectory
DeleteFromComboBox
DeleteFromListBox
DeleteShortcuts
DetectProcess
DetectService
DisableFeatures
DoEvents
EnumStartedServices
ExtractComboBoxData
ExtractListBoxData
GetArpIconPath
GetFreeTCPPort
GetLocalizedCredentials
GetPathFreeSpace
GetVideoMemory
IsRunningOnVM
JoinFiles
LaunchApp
LaunchLogFile
LoadShortcutDirs
LogOnAsAService
MixedAllUsersInstallLocation
MsgBox
MsmTrialMessage
PlayAudioFile
PopulateComboBox
PopulateListBox
PrepareUpgrade
PreserveInstallType
PreventInstancesUpgrade
PrintRTF
RemoveCaspolSecurityPolicy
RequiredJdkExists
RequiredJreExists
ResolveKnownFolder
ResolveServiceProperties
RestoreLocation
RunAllExitActions
RunAsAdmin
RunFinishActions
SetLatestVersionPath
StopProcess
StopWinService
TrialMessage
UninstallPreviousVersions
UpdateFeatureStates
UpdateInstallMode
UpdateMsiEditControls
ValidateInstallFolder
ViewReadMe
WarningMessageBox

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8dd6fb568be97a5eaa8030fbef80a731

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msi

kernel32

user32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 47KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 1024B - Virtual size: 1008B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 47KB - Virtual size: 47KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 1024B - Virtual size: 1008B

.reloc
Size: 3KB - Virtual size: 3KB