7787fe10268a46024ca933e60a4ec880_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
7787fe10268a46024ca933e60a4ec880_NeikiAnalytics.exe
Size 2.5MB
Sample240613-nerl1swfjf
SHA256 3f8fac0d0545f17c62d7b4fb3c5645c21177b029782cd7fc858272f91ffb618f
MD5 7787fe10268a46024ca933e60a4ec880
SHA1 f566c1275f7129e21df71eb64c0a664eea54db62
SHA512 e122ae61785827a242c83345c5c3366b8805c18d1f697c51d5d2ba8236edc15deda3d7cd10940ccd809a1653118da4bf9bcc40f2a50bfe4a64527fb7a2114b60
SSDEEP 49152:RT7Qs13XHMRdgpaAbDiPH7PDPVChqfkQ/qoLEw:RF13XYdg/DiPbPDPVChSqo4w
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7787fe10268a46024ca933e60a4ec880_NeikiAnalytics.exe

File Explorer

7787fe10268a46024ca933e60a4ec880_NeikiAnalytics.exe

.exe 2.5MB

7787fe10268a46024ca933e60a4ec880_NeikiAnalytics.exe

IMPHASH e29afbfb52dc8426384a65d4695b86ec
SHA256 3f8fac0d0545f17c62d7b4fb3c5645c21177b029782cd7fc858272f91ffb618f
MD5 7787fe10268a46024ca933e60a4ec880
SHA1 f566c1275f7129e21df71eb64c0a664eea54db62
SHA512 e122ae61785827a242c83345c5c3366b8805c18d1f697c51d5d2ba8236edc15deda3d7cd10940ccd809a1653118da4bf9bcc40f2a50bfe4a64527fb7a2114b60
SSDEEP 49152:RT7Qs13XHMRdgpaAbDiPH7PDPVChqfkQ/qoLEw:RF13XYdg/DiPbPDPVChSqo4w
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1111689

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\pptview\x86\ship\0\pptview.pdb

msvcr80

_initterm_e _initterm _acmdln exit _ismbblead _XcptFilter _exit _cexit __getmainargs _amsg_exit _fpreset rand wcsstr wcstod _wcsnicmp iswspace wcschr memmove _wtoi _configthreadlocale _CIasin _CIacos _CIsinh _CIcosh _CItanh floor _CIexp _CIlog _CIsqrt _CIatan _CItan _finite _CIpow _CIcos _CIsin _wcsicmp strncmp ceil wcsncmp _set_purecall_handler _CxxThrowException memset memcpy __setusermatherr _CIfmod vswprintf_s _vscwprintf _fpclass _CIatan2 __p__commode __p__fmode _encode_pointer __set_app_type ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit _decode_pointer _except_handler4_common _crt_debugger_hook _invoke_watson _controlfp_s ?_type_info_dtor_internal_method@type_info@@QAEXXZ __CxxFrameHandler3 _adjust_fdiv

kernel32

FindFirstFileW GetTempPathW WriteFile GetModuleFileNameA FreeLibrary LoadLibraryExW ResetEvent WaitForMultipleObjects SetEvent GetCurrentThread SetThreadPriority CreateEventW ResumeThread CreateThread GetPrivateProfileStringA Sleep GetUserDefaultLCID lstrcmpW LocalFree GetLocalTime GetFullPathNameW FindResourceExA EnumCalendarInfoA GetUserDefaultLangID GetLocaleInfoW GetLocaleInfoA EnumTimeFormatsA EnumDateFormatsA EnumTimeFormatsW EnumDateFormatsW GetSystemDefaultLCID IsValidCodePage GetOEMCP VirtualProtect FindClose GetCurrentProcessId GetSystemTimeAsFileTime GetProcessHeap InterlockedExchange InterlockedCompareExchange GetStartupInfoA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent lstrlenW DeleteFileW SetErrorMode GetStartupInfoW CreateProcessW GetTempFileNameW GetCurrentProcess SetProcessWorkingSetSize WaitForSingleObject GetTickCount CreateEventA GetCurrentThreadId GetCommandLineW CreateFileW GetFileSize ReadFile SetFilePointer GetCurrentDirectoryW GetLongPathNameW SetCurrentDirectoryW CloseHandle GetVersionExA OutputDebugStringA GetModuleFileNameW SetLastError GetLastError LoadLibraryW LoadLibraryA GetACP WideCharToMultiByte MultiByteToWideChar lstrcmpiA GetFileAttributesW GetProcAddress GetModuleHandleW GetModuleHandleA GetVersion FindResourceW SizeofResource LoadResource LockResource GetStringTypeExW GetSystemDefaultLangID LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection MulDiv GlobalAlloc GlobalSize RaiseException GlobalUnlock GlobalLock GlobalFree GlobalMemoryStatus IsValidLocale TlsAlloc FormatMessageW TlsSetValue TlsGetValue TlsFree FoldStringW GetStringTypeW CompareStringW HeapSize HeapFree HeapAlloc LocalAlloc QueryPerformanceCounter

gdi32

LPtoDP CreateBitmap CreateCompatibleBitmap GetTextAlign DeleteMetaFile DeleteEnhMetaFile CopyMetaFileA GetMetaFileW CopyEnhMetaFileA SetStretchBltMode StretchDIBits CreateFontA EnumFontFamiliesExA GetBitmapBits TextOutW GetGlyphOutlineW GetCharABCWidthsA GetKerningPairsA Escape GetViewportExtEx GetWindowExtEx CreatePen IntersectClipRect RestoreDC GetEnhMetaFileW GetTextFaceA GetFontData CreateFontIndirectW CreateHalftonePalette EndPage StartPage EndDoc StartDocW GetCharWidthA GetCharWidthW GetTextCharset ExtTextOutW StretchBlt OffsetViewportOrgEx CreateDIBSection CreateCompatibleDC GetClipBox MoveToEx LineTo GetCurrentObject AnimatePalette Pie GdiFlush Rectangle Polygon Ellipse GetViewportOrgEx SetTextAlign SetBkMode SetTextColor EnumMetaFile EnumEnhMetaFile PlayMetaFileRecord PlayEnhMetaFileRecord CreateSolidBrush BitBlt CreateDCW SetMapMode SetWindowOrgEx DeleteDC GetRasterizerCaps GetObjectW CreatePalette GetSystemPaletteUse GetSystemPaletteEntries GetPaletteEntries UpdateColors GetRgnBox SelectPalette RealizePalette GetTextColor SelectClipRgn GetStockObject SetBkColor ExtTextOutA CreateRectRgn OffsetRgn CreateRectRgnIndirect CombineRgn SetViewportOrgEx GetTextMetricsA GetDeviceCaps SelectObject CreateFontIndirectA GetObjectA DeleteObject EnumFontFamiliesExW GetOutlineTextMetricsW GetTextMetricsW GetTextFaceW GetTextCharsetInfo SaveDC

advapi32

RegCloseKey RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegSetValueExW CryptGenRandom RegQueryValueExW

ole32

CoCreateInstance OleLockRunning StgOpenStorageOnILockBytes GetHGlobalFromStream CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes GetHGlobalFromILockBytes CreateStreamOnHGlobal StgOpenStorage CoInitialize CoUninitialize StringFromGUID2

oleaut32

SysFreeString VariantInit SysAllocString SysStringLen VariantCopy SysAllocStringLen GetErrorInfo VarR8FromStr VariantChangeTypeEx VariantClear

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

mpr

WNetGetConnectionW