5bda65872947cab86ed3614566d2e960_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
5bda65872947cab86ed3614566d2e960_NeikiAnalytics.exe
Size 1.9MB
Sample240613-ebmzzstbjd
SHA256 05f15bd09d3c928a864dc2b22239fdb0ab401a8a520f275340aaf2e9a501d079
MD5 5bda65872947cab86ed3614566d2e960
SHA1 ea8db8280330dc40114b2adf17581e0893978ee8
SHA512 737d0ccfdae3d14d2279b28f35f100f2c16e5375058d14854fa8165c25d55c88c25f9a5dc750b9bad8ad6114207cc3ae15b145ef83a2910a23ebaac4838a385c
SSDEEP 24576:cYv0eh0KyWRd6XCv1RzV+E6k1QEabsNkm8SSWTk8S+:cg0Tedjv/1QLY8SHk8S+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5bda65872947cab86ed3614566d2e960_NeikiAnalytics.exe

File Explorer

5bda65872947cab86ed3614566d2e960_NeikiAnalytics.exe

.exe 1.9MB

5bda65872947cab86ed3614566d2e960_NeikiAnalytics.exe

IMPHASH 0ed23546ac24a15f379516f866660c2b
SHA256 05f15bd09d3c928a864dc2b22239fdb0ab401a8a520f275340aaf2e9a501d079
MD5 5bda65872947cab86ed3614566d2e960
SHA1 ea8db8280330dc40114b2adf17581e0893978ee8
SHA512 737d0ccfdae3d14d2279b28f35f100f2c16e5375058d14854fa8165c25d55c88c25f9a5dc750b9bad8ad6114207cc3ae15b145ef83a2910a23ebaac4838a385c
SSDEEP 24576:cYv0eh0KyWRd6XCv1RzV+E6k1QEabsNkm8SSWTk8S+:cg0Tedjv/1QLY8SHk8S+
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

683751

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

SHDeleteValueA SHDeleteKeyA

winmm

waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose waveOutGetNumDevs waveOutOpen midiOutUnprepareHeader midiStreamOpen midiStreamProperty midiOutPrepareHeader midiStreamOut midiStreamStop midiOutReset midiStreamClose midiStreamRestart

ws2_32

accept WSAAsyncSelect closesocket getpeername inet_ntoa WSAStartup WSACleanup select recv ioctlsocket recvfrom send

rasapi32

RasGetConnectStatusA RasHangUpA

kernel32

IsDBCSLeadByte FileTimeToSystemTime lstrcmpA lstrcmpiA lstrcpynA InterlockedIncrement InterlockedDecrement GetSystemInfo IsProcessorFeaturePresent GetTickCount GetCommandLineA MulDiv GetProcAddress InterlockedExchange IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA GetCurrentProcessId GetStringTypeW GetStringTypeA SetUnhandledExceptionFilter IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter SetStdHandle GetACP HeapSize GetFileType RaiseException GetLocalTime GetSystemTime RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom GetThreadLocale SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle FileTimeToLocalFileTime FormatMessageA LocalFree GetModuleHandleA GetVolumeInformationA SetCurrentDirectoryA GetCurrentDirectoryA DeleteFileA MoveFileA GetFileAttributesA SetFileAttributesA FindClose FindFirstFileA GetTempPathA GlobalUnlock GlobalLock GlobalAlloc ExpandEnvironmentStringsA Sleep CreateEventA CreateThread WaitForSingleObject CloseHandle CreateProcessA WritePrivateProfileStringA GetVersionExA lstrlenA LoadLibraryA FreeLibrary GetFullPathNameA HeapAlloc GetProcessHeap HeapReAlloc HeapFree GlobalReAlloc GetDriveTypeA FindNextFileA WideCharToMultiByte GetVersion GetTimeZoneInformation SetLastError MultiByteToWideChar GetSystemDirectoryA GetWindowsDirectoryA TerminateProcess GetCurrentProcess GetFileSize SetFilePointer CreateToolhelp32Snapshot Process32First Process32Next CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource RemoveDirectoryA GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA WinExec lstrcpyA

user32

wsprintfA WaitForInputIdle IntersectRect CloseClipboard GetClipboardData OpenClipboard SetClipboardData UnregisterHotKey RegisterHotKey CreateWindowExA CallWindowProcA CharUpperA SetWindowTextA GetForegroundWindow EnumWindows GetWindowTextA GetDlgItem GetClassNameA GetDesktopWindow EmptyClipboard GetSystemMetrics PostThreadMessageA SystemParametersInfoA TranslateMessage LoadIconA DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem GetNextDlgGroupItem GetSysColorBrush LoadStringA MapDialogRect SetWindowContextHelpId CharNextA GetMenuCheckMarkDimensions GetMenuState SetMenuItemBitmaps CheckMenuItem MoveWindow IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA GetMenuItemCount GetMenuItemID SetWindowsHookExA ClientToScreen EnumDisplaySettingsA LoadImageA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetSystemMenu DeleteMenu GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos InflateRect SetRect UnregisterClassA DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBeep MessageBoxA GetCursorPos GetWindowTextLengthA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx

gdi32

RectVisible PtVisible GetViewportExtEx SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor TextOutA ExtTextOutA Escape GetTextMetricsA GetMapMode SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo ExtSelectClipRgn CreateEllipticRgn TranslateCharsetInfo CreateFontA SetBkColor CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject GetObjectA CreatePen PatBlt FillRgn CreateRectRgn CombineRgn CreateSolidBrush GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA RegSetValueExA RegCreateKeyA RegQueryValueA RegEnumKeyA RegQueryInfoKeyA RegSetKeySecurity CopySid GetLengthSid GetTokenInformation OpenProcessToken GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAce InitializeAcl AllocateAndInitializeSid RegGetKeySecurity RegOpenKeyA GetUserNameA RegCreateKeyExA

shell32

DragQueryFileA DragFinish ShellExecuteA Shell_NotifyIconA SHGetSpecialFolderPathA SHEmptyRecycleBinA DragAcceptFiles

ole32

StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoFreeUnusedLibraries CoRegisterMessageFilter CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard StgOpenStorageOnILockBytes CoGetClassObject CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID CLSIDFromString OleUninitialize OleInitialize

oleaut32

SafeArrayAccessData SysAllocString SafeArrayUnaccessData UnRegisterTypeLi RegisterTypeLi LoadTypeLi VariantCopy SafeArrayGetDim SafeArrayGetLBound SafeArrayGetUBound VariantChangeType SafeArrayCreate VariantClear OleCreateFontIndirect VariantTimeToSystemTime SysStringLen SysFreeString SysAllocStringLen SafeArrayGetElemsize SysAllocStringByteLen

comctl32

ImageList_Add ImageList_BeginDrag ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ord17 ImageList_EndDrag ImageList_DragShowNolock ImageList_DragMove

oledlg

ord8

wininet

InternetCloseHandle FindFirstUrlCacheEntryA FindNextUrlCacheEntryA DeleteUrlCacheEntry

comdlg32

GetOpenFileNameA GetSaveFileNameA GetFileTitleA ChooseColorA

generic

count=5, id=12, version=7291,

count=9, id=11, version=8047,

count=6, id=10, version=8047,

count=49, id=14, version=7299,

count=45, id=19, version=8022,

count=1, id=28, version=9178,

count=117, id=29, version=9178,

count=9, id=95, version=2067,

count=98, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=30, id=19, version=8034,

count=731, id=1, productName=Unmarked objects,

count=3, id=93, version=2179,

count=7, id=18, version=8444,

count=227, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=140, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=114, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=126, productName=Unmarked objects (old),

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,