5e456ad9974e95cafb281813f0022560_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
5e456ad9974e95cafb281813f0022560_NeikiAnalytics.exe
Size 607KB
Sample240613-e2kmjstgqg
SHA256 ba713460a1080f4900776ac46ef4fd6ebe36e80ffe7bd822463deead3fa04ea9
MD5 5e456ad9974e95cafb281813f0022560
SHA1 d154e8ba4414b563251b19e33f971a2c26c08271
SHA512 e48c364ac6379201c984c04efd53ec82ceb6888b29c9f7c5f4acd6465af2582150d8c4e86cfc21f15f27b380903a09d400c81fe8b44b0d2b789c7ba60959e031
SSDEEP 12288:mq0fs20hFF8B9VKJwLcumwkitVryWwXVwP3SpfZvaSdlVCQ1D7vgcZ:mq048V+pfOry/VwCBfV/1/gcZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
5e456ad9974e95cafb281813f0022560_NeikiAnalytics.exe
unpack001/$PLUGINSDIR/ButtonEvent.dll
unpack001/$PLUGINSDIR/MyNsisExtend.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/locate.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsRandom.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/xml.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

5e456ad9974e95cafb281813f0022560_NeikiAnalytics.exe

.exe 607KB
$PLUGINSDIR/ButtonEvent.dll

.dll 4KB
$PLUGINSDIR/MyNsisExtend.dll

.dll 536KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/locate.dll

.dll 17KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsRandom.dll

.dll 21KB
out.upx

.dll 39KB
$PLUGINSDIR/xml.dll

.dll 118KB
$TEMP/$_89_/GMSkin_Image_2012_v1.zip

226KB

5e456ad9974e95cafb281813f0022560_NeikiAnalytics.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 ba713460a1080f4900776ac46ef4fd6ebe36e80ffe7bd822463deead3fa04ea9
MD5 5e456ad9974e95cafb281813f0022560
SHA1 d154e8ba4414b563251b19e33f971a2c26c08271
SHA512 e48c364ac6379201c984c04efd53ec82ceb6888b29c9f7c5f4acd6465af2582150d8c4e86cfc21f15f27b380903a09d400c81fe8b44b0d2b789c7ba60959e031
SSDEEP 12288:mq0fs20hFF8B9VKJwLcumwkitVryWwXVwP3SpfZvaSdlVCQ1D7vgcZ:mq048V+pfOry/VwCBfV/1/gcZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/ButtonEvent.dll

IMPHASH 0ece15e7d9bb35972aec701f46192460
SHA256 5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
MD5 fad9d09fc0267e8513b8628e767b2604
SHA1 bea76a7621c07b30ed90bedef4d608a5b9e15300
SHA512 b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5170

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/MyNsisExtend.dll

IMPHASH 9cb11d0d4bed69c64ae8d0549b4ce4ce
SHA256 7690f9653732bf3d8ec0b0a89eaf6763171864d23bb41971e5b9649bbea80b60
MD5 ae20c78878bffd789a4f900d420a47fd
SHA1 166bb9311a99a4bb42dcb9337e704e0248ca8f58
SHA512 c0a9b177ca962e5fcd308c49e2f71afdb7d9498ef80547b2febece9765df6bb6f0d0623518aff22bf908189f26a8e1fb9aa326e9790501465d9e985f9993595b
SSDEEP 12288:zQXznhWxifqPG8yDAay0BQeMrtQW27ZJ6ObWTE5lqtmsV:zQXznYybPJnWTE5lqws
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

272112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\SVN\v2.2\install\build\MSVC.2005\Tool\GMNsisExtend\release_staticA2\MyNsisExtend.pdb

shlwapi

PathSkipRootA PathCombineA

wininet

InternetOpenUrlA InternetCloseHandle HttpOpenRequestA HttpSendRequestA InternetSetOptionA InternetSetFilePointer InternetConnectA HttpQueryInfoA InternetReadFile InternetOpenA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

kernel32

InitializeCriticalSection GlobalFree lstrcpyA SetEvent Sleep ResetEvent CreateEventA lstrcpynA GlobalAlloc lstrcmpiA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA lstrlenA GetLogicalDriveStringsA TerminateProcess GetExitCodeProcess WaitForSingleObject GetLastError CreateProcessA DisableThreadLibraryCalls CloseHandle GetFileSize CreateFileA GetFileAttributesA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetPrivateProfileStringA lstrcmpA CreateFileW ReadFile WriteFile SetFilePointer GetVersionExA SetFileTime GetFileTime SetEndOfFile ResumeThread GetCurrentThreadId GetTickCount GetVersion ExpandEnvironmentStringsA GetSystemInfo SetFileAttributesA WritePrivateProfileStringA SetEnvironmentVariableA MultiByteToWideChar WideCharToMultiByte GetCurrentDirectoryA DeleteFileA SearchPathA CreateDirectoryA GetFullPathNameA GetFileSizeEx InterlockedExchange DeviceIoControl GetTempFileNameA GetSystemDirectoryA MoveFileExA GetLongPathNameA GetFileInformationByHandle RemoveDirectoryA GetTempPathA MoveFileA GetWindowsDirectoryA CopyFileA GetProcAddress FreeLibrary GetModuleFileNameA LoadLibraryA GetModuleHandleA LoadLibraryExA GetPrivateProfileSectionNamesA GetPrivateProfileSectionA FindClose FindFirstFileA FindNextFileA GetLocaleInfoW GetLocaleInfoA SetConsoleCtrlHandler FlushFileBuffers GetConsoleMode GetConsoleCP LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetCPInfo GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings TlsFree FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount ExitProcess HeapSize HeapReAlloc VirtualAlloc EnterCriticalSection FatalAppExitA LeaveCriticalSection DeleteCriticalSection GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetTimeZoneInformation CompareStringA InterlockedIncrement SetLastError SetCurrentDirectoryA CompareStringW TlsSetValue TlsAlloc TlsGetValue GetStdHandle CreateThread ExitThread VirtualFree HeapCreate HeapDestroy GetCurrentThread GetProcessHeap GetCommandLineA IsDebuggerPresent RtlUnwind RaiseException HeapFree HeapAlloc GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter InterlockedDecrement

user32

GetDlgItem wsprintfA SetTimer KillTimer SetForegroundWindow GetWindow GetWindowRect AttachThreadInput GetWindowLongA SystemParametersInfoA IsWindowVisible IsIconic GetForegroundWindow SetWindowTextA GetWindowTextA MapWindowPoints IsZoomed GetClientRect GetWindowTextLengthA GetWindowThreadProcessId GetActiveWindow SendMessageTimeoutA GetParent LoadStringW SetWindowPos GetSystemMetrics ShowWindow EnumThreadWindows GetClassNameA SendMessageA

advapi32

RegDeleteValueA RegQueryInfoKeyA RegLoadKeyA RegRestoreKeyA RegEnumValueA RegEnumKeyExA RegSaveKeyA AllocateAndInitializeSid FreeSid CheckTokenMembership RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegCloseKey RegDeleteKeyA

shell32

SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteExA ShellExecuteA SHGetSpecialFolderPathA

ole32

CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

SysFreeString SysAllocString

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/locate.dll

IMPHASH 7f8181c74f882a780c7cd485241e8b51
SHA256 d88a04c1e39db583eaad727fd390fe599ab10198ee040bfbdd22daefadbd2372
MD5 7d3317f57c1a368480ace3c0ca804eeb
SHA1 d4c7e185bc64aac82339f51ba6c21cf0713c9f1a
SHA512 5598c2e6caa2f66edd48f8c8305e054d4b0740b5f2b7ed92cf197a13ac66ba99a32013d34b3c2e28d007ab7979eb90a50681324eb736b1410e7df1902e4ec32a
SSDEEP 384:ev/vPBkA6dK8wiLe45naPji7hpx2kRV+qgm:evyvwiNnGji7Xxjc8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsRandom.dll

SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

68128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 5e5303e06d8457a10b294fafa628e115b403569703a1ae80c416916c5ed9b08b
MD5 501650d47110eec0b72b7d73b41478f7
SHA1 eaec655c4a6d175cf152a8d533b1cf611e445c01
SHA512 0615b3d50d57f3248f66cb2532fb43c494e5c9e97d1ea288bcd74d935cf0baa9f7fea5479418a34fc3532f7fbc0692376183c36bcd31dfe84ced42da853af7d6
SSDEEP 768:oCeqBQGwr4MINuUFp6dgUL5f9sC63x2mM6TyTFIK:PeqBQgMgNbASPtTyTSK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

33064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/xml.dll

IMPHASH b5ed5b3a951d4443ce56e5453702d536
SHA256 e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845
MD5 42df1fbaa87567adf2b4050805a1a545
SHA1 b892a6efbb39b7144248e0c0d79e53da474a9373
SHA512 4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d
SSDEEP 1536:U2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KC:OzjLkarn7O+n9z2L6whFtGF42bK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

60879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

5e456ad9974e95cafb281813f0022560_NeikiAnalytics.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/ButtonEvent.dll

kernel32

user32

generic

$PLUGINSDIR/MyNsisExtend.dll

shlwapi

wininet

version

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/locate.dll

kernel32

user32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsRandom.dll

generic

out.upx

generic

$PLUGINSDIR/xml.dll

kernel32

generic

$TEMP/$_89_/GMSkin_Image_2012_v1.zip