95ee9d0d7281dc117bf18f39a7aaa270_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
95ee9d0d7281dc117bf18f39a7aaa270_NeikiAnalytics.exe
Size 5.8MB
Sample240614-bh19easgml
SHA256 11bd63bdf18f049cf78b5c351390eff919f1b4f20314c8cf2e1ea8adfcd3c237
MD5 95ee9d0d7281dc117bf18f39a7aaa270
SHA1 80248c1bacdb9477ce805555e9a89c7648caa5b0
SHA512 7343b196ba47b5a14a92d3cb5d6a880da02b795c83a2f64a5095eb35f76d4ff1f15d85855090ef80d1080bcb3e99491212ff615db3b821e5edd78a6a9e9fb37a
SSDEEP 98304:OBv78HEFfNHX5rpiD0CTa3aLkBo6DjD7d/TLCQlHEnW6at:REFfHp7C2NDjD7d3CQanW9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95ee9d0d7281dc117bf18f39a7aaa270_NeikiAnalytics.exe

File Explorer

95ee9d0d7281dc117bf18f39a7aaa270_NeikiAnalytics.exe

.exe 5.8MB

95ee9d0d7281dc117bf18f39a7aaa270_NeikiAnalytics.exe

IMPHASH fef7b9a15dba0677216fced9bcd394bf
SHA256 11bd63bdf18f049cf78b5c351390eff919f1b4f20314c8cf2e1ea8adfcd3c237
MD5 95ee9d0d7281dc117bf18f39a7aaa270
SHA1 80248c1bacdb9477ce805555e9a89c7648caa5b0
SHA512 7343b196ba47b5a14a92d3cb5d6a880da02b795c83a2f64a5095eb35f76d4ff1f15d85855090ef80d1080bcb3e99491212ff615db3b821e5edd78a6a9e9fb37a
SSDEEP 98304:OBv78HEFfNHX5rpiD0CTa3aLkBo6DjD7d/TLCQlHEnW6at:REFfHp7C2NDjD7d3CQanW9
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2496256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\B\T\BuildResults\bin\Release\AdobeCollabSync.pdb

shlwapi

StrCmpNA PathRemoveFileSpecW PathCreateFromUrlW UrlIsW StrCmpNW UrlCanonicalizeA PathStripPathW

kernel32

FreeEnvironmentStringsW CreateDirectoryW ProcessIdToSessionId IsProcessInJob CreateJobObjectW AssignProcessToJobObject SetInformationJobObject QueryInformationJobObject VerifyVersionInfoA GetFileType GetCurrentProcess ResetEvent SystemTimeToTzSpecificLocalTime WakeConditionVariable GetProcessTimes K32GetProcessMemoryInfo CreateThreadpoolWork SubmitThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer CloseThreadpoolTimer SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum WaitForThreadpoolWorkCallbacks WaitForThreadpoolTimerCallbacks CreateThreadpool DuplicateHandle GetCurrentThreadId GetCommandLineW GetTempPathW OpenProcess GetExitCodeProcess WaitNamedPipeW WaitForMultipleObjects GetOverlappedResult CreateNamedPipeW GetEnvironmentStringsW ConnectNamedPipe ResumeThread TerminateProcess GetCurrentProcessId VerifyVersionInfoW HeapSetInformation GetProcessHeap VerSetConditionMask FindResourceA SizeofResource LockResource LoadResource GetModuleHandleExA WideCharToMultiByte FormatMessageW FormatMessageA LocalFree GetThreadId LoadLibraryW CloseThreadpool CloseThreadpoolWork InitializeConditionVariable WakeAllConditionVariable SleepConditionVariableCS AreFileApisANSI GetWindowsDirectoryW GetCurrentDirectoryW GetEnvironmentVariableW GetProcAddress QueueUserWorkItem SetThreadErrorMode GetThreadErrorMode CreateProcessW DisconnectNamedPipe CreateThread GetSystemInfo VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA ReleaseSemaphore WaitForSingleObject GetModuleHandleW SwitchToThread DeleteFileW FindClose FindFirstFileW FlushFileBuffers GetDriveTypeW GetFileInformationByHandle GetFullPathNameW SetEndOfFile SetFilePointer MoveFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree LocalAlloc CreateSemaphoreA GetSystemTimeAsFileTime GetLocalTime FileTimeToSystemTime FindNextFileW RemoveDirectoryW MultiByteToWideChar GetFileAttributesW GetSystemDirectoryA LoadLibraryA lstrlenA InitializeCriticalSectionAndSpinCount FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification GetDriveTypeA HeapAlloc HeapFree WaitForSingleObjectEx PeekNamedPipe CancelIoEx WaitForMultipleObjectsEx CreateNamedPipeA LoadLibraryExW GetUserDefaultLCID QueryPerformanceCounter QueryPerformanceFrequency EncodePointer CreateEventW CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait QueryDosDeviceW GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualAlloc VirtualFree InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitThread GetModuleHandleExW GetStdHandle WriteConsoleW ExitProcess GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetConsoleCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA SetEnvironmentVariableW SetStdHandle HeapSize CreateWaitableTimerA GetModuleHandleA GetModuleFileNameW CreateEventA SetEvent DeleteCriticalSection InitializeCriticalSectionEx SetLastError RaiseException DecodePointer OutputDebugStringA lstrlenW GetTickCount Sleep DeviceIoControl OpenMutexW SetNamedPipeHandleState GetLastError CloseHandle WriteFile ReadFile GetVolumeInformationW CreateFileW GetCurrentThread SetWaitableTimer OpenEventA GlobalAlloc GlobalFree SetFileAttributesW TerminateThread GetFileSize GetFileAttributesExW QueueUserAPC GetQueuedCompletionStatus PostQueuedCompletionStatus SleepEx CreateIoCompletionPort CreateWaitableTimerW

user32

MsgWaitForMultipleObjects PeekMessageA DispatchMessageA GetForegroundWindow FindWindowW PostMessageW GetClassNameA FindWindowA IsHungAppWindow LoadImageW GetCursorPos GetPropW SetPropW SetForegroundWindow TrackPopupMenu InsertMenuW DestroyMenu CreatePopupMenu GetSystemMetrics DestroyWindow CreateWindowExW RegisterClassW CallWindowProcA PostQuitMessage DefWindowProcA PostMessageA GetMessageA LoadStringW GetWindowThreadProcessId TranslateMessage InsertMenuItemW

advapi32

RegOpenKeyA CryptSetHashParam RegSetValueExW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegOpenKeyW OpenThreadToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW SetTokenInformation GetLengthSid DuplicateTokenEx OpenProcessToken RegDeleteTreeW RegCreateKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorA TreeSetNamedSecurityInfoW GetNamedSecurityInfoW RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCreateKeyExA GetSidSubAuthorityCount GetSidSubAuthority GetSecurityDescriptorSacl GetAclInformation GetAce CreateProcessAsUserW RegQueryValueExW RegOpenKeyExW RegCloseKey CryptImportKey ConvertSidToStringSidA

shell32

SHFileOperationA SHGetPathFromIDListW SHCreateDirectoryExW SHGetSpecialFolderLocation ShellExecuteA SHGetKnownFolderPath SHQueryUserNotificationState Shell_NotifyIconW

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoTaskMemFree

sensapi

IsNetworkAlive

ws2_32

WSAStartup WSACleanup WSAGetLastError WSACreateEvent WSAEventSelect WSAIoctl WSASocketA

wininet

InternetSetCookieExA InternetReadFile InternetWriteFile InternetSetOptionA HttpSendRequestExA InternetCloseHandle HttpAddRequestHeadersA HttpSendRequestA InternetCrackUrlA InternetOpenA InternetConnectA HttpOpenRequestA HttpEndRequestA DetectAutoProxyUrl HttpQueryInfoA

mpr

WNetAddConnection2W WNetGetConnectionW WNetGetResourceInformationW WNetCancelConnection2W

crypt32

CryptProtectData CryptUnprotectData

oleaut32

SafeArrayCreateVector SysAllocString SysFreeString SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData

netapi32

NetShareGetInfo

winhttp

WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpSetStatusCallback WinHttpSetCredentials WinHttpSendRequest WinHttpSetOption WinHttpGetProxyForUrl WinHttpQueryAuthSchemes WinHttpGetIEProxyConfigForCurrentUser WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpWriteData WinHttpCrackUrl WinHttpCloseHandle

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

898KB

Virtual Size

898KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

272KB

Virtual Size

291KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

872KB

Virtual Size

876KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=25, id=259, version=26715,

count=211, id=261, version=26715,

count=18, id=260, version=28117,

count=28, id=259, version=28117,

count=171, id=265, version=28316,

count=51, id=109, productName=VS2005 build 50727, version=50727,

count=8, id=125, productName=VS2005 build 50727, version=50727,

count=11, id=260, productName=VS2019 v16.4.4 build 28316, version=28316,

count=160, id=261, version=28117,

count=25, id=260, version=26715,

count=1, id=262, version=26715,

count=29, id=257, version=26715,

count=492, id=1, productName=Unmarked objects,

count=206, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=256, productName=VS2019 v16.4.4 build 28316, version=28316,

count=1, id=255, productName=VS2019 v16.4.4 build 28316, version=28316,

count=2, id=151,

count=1, id=258, productName=VS2019 v16.4.4 build 28316, version=28316,