88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe
Size 1.5MB
Sample240613-1edrdavckk
SHA256 3a7201d226876ab8c960abb2f1b58d1e16892af8e1c756adb5cf0b577a9d48f0
MD5 88ddf643d1f87e44ae5b6769fbfb48a0
SHA1 8a2e5caf83cf7f89b1942082d13dccec7c44e7a2
SHA512 28da2057c7a98c106fb24dd49b68d3e225e15e886046cfbe970536b73fbe00614c1670ad84c1a47cef67e0b3e9a799b95fdb4e01eb963d676c3b90d9092b5af8
SSDEEP 49152:cDmZio+wLYxJYIJTcIU3fWbM/snji6attJM:cDmZuwLYxejEnW6at
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe

File Explorer

88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe

.exe 1.5MB

88ddf643d1f87e44ae5b6769fbfb48a0_NeikiAnalytics.exe

IMPHASH c65c63d8c523e5191dbbeed74a83acff
SHA256 3a7201d226876ab8c960abb2f1b58d1e16892af8e1c756adb5cf0b577a9d48f0
MD5 88ddf643d1f87e44ae5b6769fbfb48a0
SHA1 8a2e5caf83cf7f89b1942082d13dccec7c44e7a2
SHA512 28da2057c7a98c106fb24dd49b68d3e225e15e886046cfbe970536b73fbe00614c1670ad84c1a47cef67e0b3e9a799b95fdb4e01eb963d676c3b90d9092b5af8
SSDEEP 49152:cDmZio+wLYxJYIJTcIU3fWbM/snji6attJM:cDmZuwLYxejEnW6at
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

298264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoTaskMemAlloc IIDFromString StringFromGUID2 OleInitialize OleUninitialize OleRun OleSetContainedObject CoInitializeEx CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoUninitialize CoInitialize

shell32

FindExecutableA Shell_NotifyIconA ShellExecuteExA SHGetFolderPathW SHGetFolderPathA

wininet

InternetGetConnectedState InternetTimeToSystemTime InternetCrackUrlA InternetTimeFromSystemTime HttpQueryInfoA HttpOpenRequestA InternetErrorDlg InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile

user32

GetWindowThreadProcessId GetFocus IsChild SetFocus SetRect GetWindowLongW DefWindowProcW GetSystemMenu AdjustWindowRectEx GetWindowRect LoadCursorA GetDC SetWindowPos CreateWindowExW SetWindowTextW RegisterClassExW SendMessageA MessageBoxA RegisterClassExA SetWindowLongW GetClientRect GetDesktopWindow EnableMenuItem GetClassInfoExW TrackPopupMenu ShowWindow GetParent ReleaseDC wsprintfA GetMessageW GetMessageA LoadImageA DispatchMessageA DestroyWindow LoadStringA PostMessageA GetSystemMetrics DispatchMessageW CreatePopupMenu SetWindowLongA GetAncestor CharNextA GetCursorPos SetForegroundWindow IsWindowUnicode PostQuitMessage PeekMessageA AppendMenuA TranslateMessage CreateWindowExA DefWindowProcA RegisterClassA GetWindowLongA MsgWaitForMultipleObjectsEx

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueW

kernel32

GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeSListHead RtlUnwind GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery GetFileType GetConsoleCP GetConsoleMode GetStdHandle GetModuleFileNameW WriteConsoleW ExitThread GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime GetFullPathNameW SetStdHandle HeapAlloc HeapFree FreeLibraryAndExitThread IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize HeapReAlloc GetFileSizeEx FlushFileBuffers GetTimeZoneInformation ReadConsoleW GetCurrentDirectoryW FindFirstFileExW FindNextFileW IsValidCodePage CreateDirectoryW GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW InitializeCriticalSectionAndSpinCount lstrcmpA GetModuleHandleA GetLastError RaiseException DecodePointer DeleteCriticalSection SetEnvironmentVariableW SizeofResource LoadLibraryExA FindResourceA CreateMutexA GetCommandLineA MultiByteToWideChar SetDllDirectoryA CloseHandle IsDBCSLeadByte LoadResource GetProcAddress FreeLibrary WideCharToMultiByte lstrcmpiA lstrlenA WaitForSingleObject DeleteFileA LocalFree FormatMessageA GetExitCodeProcess WaitForMultipleObjects lstrcatA SetEvent lstrcpyA CreateThread ResetEvent CreateEventA lstrcpynA OpenEventA WriteFile Sleep CreateFileA GetSystemTime GetCurrentProcess GetTempPathA ReadFile FileTimeToSystemTime SystemTimeToFileTime MulDiv LocalAlloc GetCurrentThreadId SetEndOfFile SetFilePointerEx FindFirstFileA TerminateProcess FindClose GetSystemDirectoryA LockResource GetWindowsDirectoryA ExitProcess FormatMessageW GetLocalTime GetCurrentProcessId SetLastError FindNextFileA GetFileAttributesA MoveFileExA SetFileAttributesA RemoveDirectoryA CreateDirectoryA GetTickCount GetCommandLineW GetModuleHandleExW GetProcessHeap GetNativeSystemInfo SetHandleInformation CreatePipe PeekNamedPipe CreateProcessA GetSystemDefaultUILanguage GetThreadLocale GetUserDefaultUILanguage GetModuleHandleExA LoadLibraryW GetExitCodeThread OpenThread OpenMutexA LoadLibraryExW ReleaseMutex QueryPerformanceFrequency QueryPerformanceCounter CreateFileW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetStringTypeW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW GetModuleFileNameA

advapi32

CryptDestroyHash CryptGetHashParam RegDeleteValueA RegEnumKeyExA CryptHashData CryptCreateHash RegQueryValueExA CryptAcquireContextA RegEnumKeyA ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegDeleteKeyA RegQueryInfoKeyW RegCloseKey InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptReleaseContext

oleaut32

SysFreeString VarUI4FromStr VariantClear VariantChangeType VariantCopy VariantInit SysStringByteLen GetErrorInfo SysAllocString

shlwapi

ord12

gdi32

GetDeviceCaps GetStockObject

wintrust

WinVerifyTrust

crypt32

CryptProtectData CryptUnprotectData CryptBinaryToStringA CryptStringToBinaryA CertGetNameStringW CryptMsgClose CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore

msi

ord91 ord160 ord31 ord168 ord117 ord137 ord189 ord159 ord115 ord141 ord44 ord67 ord8 ord158 ord204