67cd27bd8cae932814e38b86ad141f60_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

67cd27bd8cae932814e38b86ad141f60_NeikiAnalytics.exe
Size

272KB
MD5

67cd27bd8cae932814e38b86ad141f60
SHA1

5e3a151b8dd2e7089800885445983927f27b8b89
SHA256

8981a5f3a9033e608150fa5ae4e7c167efbc81c7290f52d39866fa6a457d752c
SHA512

77298d19351491eec2e437a4d60fd33b8b4e51f962c3323abb5a8f586e6ae322928f5fd3b26c7a40ef5b8707f45a6c8c122e182e51729e0d5eff9e2769392e58
SSDEEP

3072:k1OYMuDnujUYXzRvPjaOyBaQmqcPWPboUDs+jqXnfoSLV14bOp5TRv4OQ0FqrSew:koYdn4/3+PbR2XfznPgrSeoK5LGLVCL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67cd27bd8cae932814e38b86ad141f60_NeikiAnalytics.exe

Files

67cd27bd8cae932814e38b86ad141f60_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

977ed8d5fadfa7f5c53cc31d5ac4ca65

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

mfc42

ord3996
ord3663
ord6007
ord800
ord858
ord3301
ord6143
ord2818
ord540
ord537
ord6883
ord4278
ord6696
ord2100
ord3797
ord4299
ord6675
ord2862
ord5981
ord6215
ord6199
ord2380
ord2860
ord2089
ord3874
ord6888
ord6905
ord5440
ord6383
ord5450
ord6394
ord656
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord2514
ord941
ord860
ord2621
ord1134
ord641
ord616
ord609
ord795
ord692
ord818
ord539
ord1601
ord924
ord535
ord2820
ord3811
ord2915
ord5710
ord4129
ord2764
ord6334
ord2642
ord5265
ord4376
ord4853
ord4998
ord4710
ord3286
ord1775
ord5280
ord4425
ord3597
ord324
ord4234
ord2411
ord2023
ord6907
ord2578
ord4398
ord3582
ord1771
ord6366
ord2413
ord2024
ord4219
ord2581
ord4401
ord3639
ord2575
ord4396
ord3574
ord3721
ord1146
ord1168
ord2135
ord2362
ord2299
ord2301
ord2298
ord2370
ord2302
ord1105
ord2558
ord4160
ord2863
ord5856
ord1200
ord755
ord470
ord6877
ord5683
ord3499
ord2515
ord355
ord3873
ord926
ord922
ord4220
ord2584
ord3654
ord2438
ord6270
ord1175
ord1644
ord2688
ord690
ord5207
ord389
ord6197
ord6880
ord3092
ord1949
ord4034
ord6282
ord4275
ord3742
ord348
ord1576
ord939
ord1799
ord614
ord290
ord4226
ord940
ord6778
ord1158
ord4243
ord567
ord384
ord693
ord686
ord3640
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3370
ord6928
ord6930
ord2864
ord3998
ord541
ord801
ord2408
ord6453
ord4218
ord2379
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4402
ord1776
ord4078
ord6055
ord2582
ord3610
ord3402
ord4407
ord932
ord936
ord5216
ord825
ord823
ord6052
ord663

msvcrt

memmove
strtod
strtoul
__CxxFrameHandler
atoi
_mbscmp
_splitpath
strstr
sprintf
malloc
wcscmp
fclose
fputs
_setmbcp
_CxxThrowException
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
fopen
fgets
_beginthread
exit
fread
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
strncmp
isdigit
isupper
islower
sscanf
_wcsicmp
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
ftell
fseek
free
rand
srand
_mbsrchr
fwrite
time
_controlfp

kernel32

WritePrivateProfileStringA
Sleep
lstrlenA
MultiByteToWideChar
CreateMutexA
GetCommandLineA
GetLastError
SetCurrentDirectoryA
GetCurrentProcessId
ResumeThread
WriteProcessMemory
CreateProcessA
WaitForSingleObject
TerminateThread
GetModuleHandleA
DeviceIoControl
GetPrivateProfileStringA
VirtualFree
VirtualAlloc
GetWindowsDirectoryA
HeapAlloc
HeapFree
GetProcessHeap
GetStartupInfoA
CreateEventA
CloseHandle
TerminateProcess
OpenProcess
GetTickCount
GetProcAddress
CreateFileA
LoadLibraryA

user32

SendMessageA
GetSysColor
GetDesktopWindow
GetWindowRect
GetCursorPos
LoadMenuA
GetSubMenu
ModifyMenuA
CheckMenuItem
IsWindowVisible
FindWindowExA
UnhookWindowsHookEx
IsIconic
GetSystemMetrics
DrawIcon
GetWindowTextA
GetClassNameA
EnumWindows
IsWindow
PostMessageA
GetWindowThreadProcessId
GetSystemMenu
AppendMenuA
LoadIconA
MessageBoxA
FindWindowA
ShowWindow
SetForegroundWindow
EnableWindow
GetClientRect
CopyRect
GetWindowLongA
SetWindowLongA
RedrawWindow
GetParent
LockWindowUpdate

advapi32

RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey

shell32

DragFinish
ShellExecuteA
DragQueryFileA

oleaut32

SysAllocString
VariantClear
SysAllocStringLen
SysFreeString
VariantCopy

libmysql

mysql_close
mysql_real_connect
mysql_fetch_row
mysql_store_result
mysql_query
mysql_init
mysql_error

winmm

sndPlaySoundA

Sections

.text
Size: 124KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 567KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

977ed8d5fadfa7f5c53cc31d5ac4ca65

Headers

File Characteristics

Imports

rpcrt4

mfc42

msvcrt

kernel32

user32

advapi32

shell32

oleaut32

libmysql

winmm

Sections

.text Size: 124KB - Virtual size: 121KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 20KB - Virtual size: 567KB

.rsrc Size: 92KB - Virtual size: 88KB

.text
Size: 124KB - Virtual size: 121KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 20KB - Virtual size: 567KB

.rsrc
Size: 92KB - Virtual size: 88KB