b716e0c4a301b68c48f1533dd6fe8000_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b716e0c4a301b68c48f1533dd6fe8000_NeikiAnalytics.exe
Size

2.6MB
MD5

b716e0c4a301b68c48f1533dd6fe8000
SHA1

8b201d78ae637e55637ae18babfc80a60d808354
SHA256

2971a3b7988085713480efc4e39bae7dfbf33daf04aa64407893bf6162832942
SHA512

45e2109f1287615888fda5fe42a92bdf162abbed55d3ab8d15e8e2eec4fbfba6051db27ff90f662b55dec4179fce9875bbd088989d82296ca67f85a532481eba
SSDEEP

24576:jm6H9poWO0X+djOeKpHLDjIrvGHJj8Ud6wYuob3arTi:jmooWObKR/jw+HVrswWKrTi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b716e0c4a301b68c48f1533dd6fe8000_NeikiAnalytics.exe

Files

b716e0c4a301b68c48f1533dd6fe8000_NeikiAnalytics.exe
.dll regsvr32 windows:4 windows x86 arch:x86

f7b74d33de242b48df71b51e36723f62

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegCreateKeyW
RegGetValueW
RegOpenKeyA
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW

comctl32

CreateUpDownControl
ImageList_Create
ImageList_Destroy
ImageList_Draw
ImageList_GetIconSize
ImageList_LoadImageW
ImageList_ReplaceIcon
InitCommonControlsEx

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
CreateDCW
CreateFontIndirectW
CreateICA
CreateICW
CreatePen
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
DeleteObject
EnumFontFamiliesExW
ExtTextOutW
GdiConvertToDevmodeW
GetDeviceCaps
GetNearestColor
GetObjectW
GetStockObject
GetTextExtentPoint32W
GetTextMetricsW
LineTo
MoveToEx
Polygon
Rectangle
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetTextColor
TextOutW

kernel32

ActivateActCtx
CreateActCtxW
DeactivateActCtx
DelayLoadFailureHook
DisableThreadLibraryCalls
EnumResourceNamesW
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindResourceA
FindResourceW
FormatMessageW
GetCurrentActCtx
GetCurrentDirectoryA
GetCurrentDirectoryW
GetDriveTypeA
GetEnvironmentVariableW
GetFileAttributesW
GetFullPathNameW
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetTickCount
GetVersionExW
GlobalAlloc
GlobalFlags
GlobalFree
GlobalLock
GlobalReAlloc
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
IsBadStringPtrA
IsBadStringPtrW
LoadLibraryW
LoadResource
LocalFree
LockResource
MulDiv
MultiByteToWideChar
RaiseException
ReleaseActCtx
ResolveDelayLoadedAPI
SetCurrentDirectoryW
SizeofResource
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
lstrcmpA
lstrcmpW
lstrcmpiW

ntdll

RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString
_vsnprintf

shell32

ord17
ord18
ord21
ord25
ord152
ord153
ord155
ord162
SHCreateItemFromIDList
SHCreateShellItemArray
SHCreateShellItemArrayFromDataObject
SHGetDesktopFolder
SHGetFileInfoW
SHGetFolderPathW
SHGetIDListFromObject
SHGetItemFromObject
SHGetSpecialFolderLocation
SHParseDisplayName

shlwapi

PathAddBackslashW
PathCanonicalizeW
PathFileExistsW
PathFindExtensionA
PathFindExtensionW
PathFindFileNameA
PathFindFileNameW
PathFindNextComponentW
PathGetDriveNumberW
PathIsDirectoryW
PathIsRelativeW
PathMatchSpecW
PathRemoveExtensionW
PathSkipRootW
StrChrW
StrDupW
StrRetToBufW

ucrtbase

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_strdup
_wcsdup
_wcsicmp
atoi
calloc
free
fwrite
getenv
iswdigit
malloc
memcmp
memcpy
memmove
strcat
strchr
strcmp
strcpy
strcspn
strlen
strrchr
toupper
wcschr
wcspbrk
wcsrchr
wcstol

user32

AdjustWindowRectEx
AppendMenuW
BeginDeferWindowPos
BeginPaint
CallWindowProcA
CallWindowProcW
CharLowerW
CheckDlgButton
CheckRadioButton
ClientToScreen
CreateDialogIndirectParamA
CreateDialogIndirectParamW
CreatePopupMenu
CreateWindowExA
CreateWindowExW
DefWindowProcW
DeferWindowPos
DeleteMenu
DestroyIcon
DestroyMenu
DestroyWindow
DialogBoxIndirectParamA
DialogBoxIndirectParamW
DialogBoxParamW
DlgDirListComboBoxW
DlgDirListW
DrawEdge
DrawFocusRect
DrawIconEx
DrawTextW
EnableMenuItem
EnableWindow
EndDeferWindowPos
EndDialog
EndPaint
FillRect
GetClassInfoW
GetClassLongW
GetClientRect
GetDC
GetDialogBaseUnits
GetDlgCtrlID
GetDlgItem
GetDlgItemInt
GetDlgItemTextA
GetDlgItemTextW
GetFocus
GetMenuItemInfoW
GetParent
GetPropA
GetPropW
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetWindow
GetWindowInfo
GetWindowLongW
GetWindowRect
GetWindowTextA
GetWindowTextLengthW
GetWindowTextW
InsertMenuItemW
InvalidateRect
IsChild
IsDlgButtonChecked
IsWindow
IsWindowVisible
LoadCursorA
LoadCursorW
LoadIconA
LoadIconW
LoadImageA
LoadImageW
LoadStringA
LoadStringW
MapWindowPoints
MessageBoxW
MoveWindow
PeekMessageW
PostMessageA
RedrawWindow
RegisterClassW
RegisterClipboardFormatA
RegisterWindowMessageA
RegisterWindowMessageW
ReleaseCapture
ReleaseDC
RemovePropA
RemovePropW
ScreenToClient
SendDlgItemMessageA
SendDlgItemMessageW
SendMessageA
SendMessageW
SetCapture
SetCursor
SetDlgItemInt
SetDlgItemTextA
SetDlgItemTextW
SetFocus
SetMenuInfo
SetParent
SetPropA
SetPropW
SetWindowLongW
SetWindowPos
SetWindowTextA
SetWindowTextW
ShowWindow
SystemParametersInfoW
TrackPopupMenu
UpdateWindow
wsprintfW

winspool.drv

GetDefaultPrinterA
GetDefaultPrinterW
ClosePrinter
DeviceCapabilitiesA
DeviceCapabilitiesW
DocumentPropertiesA
DocumentPropertiesW
EnumPrintersA
EnumPrintersW
GetPrinterA
GetPrinterDriverA
GetPrinterDriverW
GetPrinterW
OpenPrinterA
OpenPrinterW

Exports

Exports

ChooseColorA
ChooseColorW
ChooseFontA
ChooseFontW
CommDlgExtendedError
DllGetClassObject
DllRegisterServer
DllUnregisterServer
FindTextA
FindTextW
GetFileTitleA
GetFileTitleW
GetOpenFileNameA
GetOpenFileNameW
GetSaveFileNameA
GetSaveFileNameW
LoadAlterBitmap
PageSetupDlgA
PageSetupDlgW
PrintDlgA
PrintDlgExA
PrintDlgExW
PrintDlgW
ReplaceTextA
ReplaceTextW
WantArrows
dwLBSubclass
dwOKSubclass

Sections

.text
Size: 220KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 4KB - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 789B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 700KB - Virtual size: 696KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/14
Size: 4KB - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 820KB - Virtual size: 817KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/80
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/91
Size: 292KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f7b74d33de242b48df71b51e36723f62

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

comctl32

gdi32

kernel32

ntdll

shell32

shlwapi

ucrtbase

user32

winspool.drv

Exports

Exports

Sections

.text Size: 220KB - Virtual size: 216KB

.data Size: 4KB - Virtual size: 288B

.rodata Size: 4KB - Virtual size: 388B

.rdata Size: 60KB - Virtual size: 58KB

/4 Size: 4KB - Virtual size: 836B

.bss Size: - Virtual size: 2KB

.edata Size: 4KB - Virtual size: 789B

.idata Size: 12KB - Virtual size: 9KB

.rsrc Size: 700KB - Virtual size: 696KB

.reloc Size: 12KB - Virtual size: 10KB

/14 Size: 4KB - Virtual size: 512B

/29 Size: 820KB - Virtual size: 817KB

/41 Size: 20KB - Virtual size: 18KB

/55 Size: 164KB - Virtual size: 163KB

/67 Size: 20KB - Virtual size: 19KB

/80 Size: 12KB - Virtual size: 10KB

/91 Size: 292KB - Virtual size: 290KB

/102 Size: 48KB - Virtual size: 47KB

.text
Size: 220KB - Virtual size: 216KB

.data
Size: 4KB - Virtual size: 288B

.rodata
Size: 4KB - Virtual size: 388B

.rdata
Size: 60KB - Virtual size: 58KB

/4
Size: 4KB - Virtual size: 836B

.bss
Size: - Virtual size: 2KB

.edata
Size: 4KB - Virtual size: 789B

.idata
Size: 12KB - Virtual size: 9KB

.rsrc
Size: 700KB - Virtual size: 696KB

.reloc
Size: 12KB - Virtual size: 10KB

/14
Size: 4KB - Virtual size: 512B

/29
Size: 820KB - Virtual size: 817KB

/41
Size: 20KB - Virtual size: 18KB

/55
Size: 164KB - Virtual size: 163KB

/67
Size: 20KB - Virtual size: 19KB

/80
Size: 12KB - Virtual size: 10KB

/91
Size: 292KB - Virtual size: 290KB

/102
Size: 48KB - Virtual size: 47KB