24a60a2bf56fcf39c408738af72d5a80_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

24a60a2bf56fcf39c408738af72d5a80_NeikiAnalytics.exe
Size

1.7MB
MD5

24a60a2bf56fcf39c408738af72d5a80
SHA1

98bc47631806748ab9d5ba2216dfc3e433c0b5c7
SHA256

cd435b82261998cde749224e07a67a7b6a359dfc21f6c096c39bb921b1a7aaf9
SHA512

1115f3b6f59865a4a2452fa0c934099b364842d13086b83bd519695518d137d6ed8a426f4ad8d87635d8a668a48b48f172064a99c0b3eeaa676e433c9ce1d4cd
SSDEEP

49152:dgMStqAe+TSOaS7Jo8MpsT0HkGH3jd5Tm:upJoaMxLK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24a60a2bf56fcf39c408738af72d5a80_NeikiAnalytics.exe

Files

24a60a2bf56fcf39c408738af72d5a80_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

38a215e444fc05087c18bcd0ea0d8885

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

SystemFunction036

comdlg32

GetOpenFileNameA
GetSaveFileNameA

dnsapi

DnsQuery_A

gdi32

BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateFontIndirectA
CreateRectRgn
DeleteDC
DeleteObject
GetDIBits
GetObjectA
GetStockObject
GetTextExtentExPointW
GetTextExtentPoint32W
GetTextMetricsA
SelectClipRgn
SelectObject
SetBkMode
SetDCBrushColor
SetDIBitsToDevice
SetTextColor
StretchBlt
StretchDIBits
TextOutW

iphlpapi

GetAdaptersInfo

kernel32

CloseHandle
CreateDirectoryA
CreateEventA
CreateMutexA
CreateSemaphoreA
CreateThread
DebugBreak
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitThread
FreeLibrary
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
GetHandleInformation
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetProcessAffinityMask
GetStartupInfoA
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
GetUserDefaultUILanguage
GlobalAlloc
GlobalLock
GlobalUnlock
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
ResetEvent
ResumeThread
SetCriticalSectionSpinCount
SetCurrentDirectoryA
SetCurrentDirectoryW
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
lstrlenW

msimg32

AlphaBlend

msvcrt

__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_aligned_free
_aligned_malloc
_amsg_exit
_beginthread
_beginthreadex
_cexit
_commit
_endthreadex
_errno
_exit
_filelengthi64
_fileno
_fmode
_fpreset
_ftime
_initterm
_iob
_lock
_lseeki64
_onexit
_setjmp3
_snwprintf
time
localtime
_stricmp
_strnicmp
calloc
clearerr
clock
exit
fclose
feof
ferror
fflush
fgetc
fgetpos
fopen
fprintf
fputc
fread
free
fseek
fsetpos
ftell
fwprintf
fwrite
getenv
isalnum
isspace
localeconv
log10
malloc
memcmp
memcpy
memmove
memset
printf
puts
qsort
raise
rand
realloc
remove
rename
signal
sinh
srand
sscanf
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strpbrk
strstr
strtol
strtoul
_unlock
_wfopen
_wgetenv
_write
abort
atan2
atoi
tolower
vfprintf
wcscpy
wcslen
_vsnprintf
longjmp
_strdup

ole32

CoCreateInstance
CoInitialize
CoLockObjectExternal
CoTaskMemFree
CoUninitialize
OleInitialize
PropVariantClear
RegisterDragDrop
ReleaseStgMedium

oleaut32

VariantClear
VariantInit

shell32

DragQueryFileA
SHGetFolderPathA
SHGetSpecialFolderPathW
ShellExecuteA
Shell_NotifyIconA
Shell_NotifyIconW

user32

AdjustWindowRect
BeginPaint
ClientToScreen
CloseClipboard
CreatePopupMenu
CreateWindowExW
DefWindowProcW
DestroyMenu
DestroyWindow
DispatchMessageA
DrawTextW
EmptyClipboard
EndPaint
FillRect
FindWindowA
FlashWindow
FrameRect
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetDesktopWindow
GetKeyState
GetMessageA
GetSystemMetrics
GetWindowRect
InsertMenuA
LoadCursorA
LoadIconA
MessageBoxW
OpenClipboard
PeekMessageA
PostMessageA
PostQuitMessage
PostThreadMessageA
RegisterClassW
ReleaseCapture
ReleaseDC
SendMessageA
SetCapture
SetClipboardData
SetCursor
SetForegroundWindow
SetLayeredWindowAttributes
SetWindowPos
ShowWindow
TrackMouseEvent
TrackPopupMenu
TranslateMessage

winmm

waveInAddBuffer
waveInClose
waveInGetDevCapsW
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsW
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite

ws2_32

WSAAddressToStringA
WSAStartup
WSAStringToAddressA
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
send
sendto
setsockopt
socket

Exports

Exports

alAuxiliaryEffectSlotf
alAuxiliaryEffectSlotfv
alAuxiliaryEffectSloti
alAuxiliaryEffectSlotiv
alBuffer3f
alBuffer3i
alBufferData
alBufferSamplesSOFT
alBufferSubDataSOFT
alBufferSubSamplesSOFT
alBufferf
alBufferfv
alBufferi
alBufferiv
alDeferUpdatesSOFT
alDeleteAuxiliaryEffectSlots
alDeleteBuffers
alDeleteEffects
alDeleteFilters
alDeleteFontsoundsSOFT
alDeletePresetsSOFT
alDeleteSoundfontsSOFT
alDeleteSources
alDisable
alDistanceModel
alDopplerFactor
alDopplerVelocity
alEffectf
alEffectfv
alEffecti
alEffectiv
alEnable
alFilterf
alFilterfv
alFilteri
alFilteriv
alFontsound2iSOFT
alFontsoundModulatoriSOFT
alFontsoundiSOFT
alFontsoundivSOFT
alGenAuxiliaryEffectSlots
alGenBuffers
alGenEffects
alGenFilters
alGenFontsoundsSOFT
alGenPresetsSOFT
alGenSoundfontsSOFT
alGenSources
alGetAuxiliaryEffectSlotf
alGetAuxiliaryEffectSlotfv
alGetAuxiliaryEffectSloti
alGetAuxiliaryEffectSlotiv
alGetBoolean
alGetBooleanv
alGetBuffer3f
alGetBuffer3i
alGetBufferSamplesSOFT
alGetBufferf
alGetBufferfv
alGetBufferi
alGetBufferiv
alGetDouble
alGetDoublev
alGetEffectf
alGetEffectfv
alGetEffecti
alGetEffectiv
alGetEnumValue
alGetError
alGetFilterf
alGetFilterfv
alGetFilteri
alGetFilteriv
alGetFloat
alGetFloatv
alGetFontsoundModulatorivSOFT
alGetFontsoundivSOFT
alGetInteger
alGetInteger64SOFT
alGetInteger64vSOFT
alGetIntegerv
alGetListener3f
alGetListener3i
alGetListenerf
alGetListenerfv
alGetListeneri
alGetListeneriv
alGetPresetivSOFT
alGetProcAddress
alGetSoundfontSamplesSOFT
alGetSoundfontivSOFT
alGetSource3dSOFT
alGetSource3f
alGetSource3i
alGetSource3i64SOFT
alGetSourcedSOFT
alGetSourcedvSOFT
alGetSourcef
alGetSourcefv
alGetSourcei
alGetSourcei64SOFT
alGetSourcei64vSOFT
alGetSourceiv
alGetString
alIsAuxiliaryEffectSlot
alIsBuffer
alIsBufferFormatSupportedSOFT
alIsEffect
alIsEnabled
alIsExtensionPresent
alIsFilter
alIsFontsoundSOFT
alIsPresetSOFT
alIsSoundfontSOFT
alIsSource
alListener3f
alListener3i
alListenerf
alListenerfv
alListeneri
alListeneriv
alLoadSoundfontSOFT
alMidiEventSOFT
alMidiGainSOFT
alMidiPauseSOFT
alMidiPlaySOFT
alMidiResetSOFT
alMidiSoundfontSOFT
alMidiSoundfontvSOFT
alMidiStopSOFT
alMidiSysExSOFT
alPresetFontsoundsSOFT
alPresetiSOFT
alPresetivSOFT
alProcessUpdatesSOFT
alSoundfontMapSamplesSOFT
alSoundfontPresetsSOFT
alSoundfontSamplesSOFT
alSoundfontUnmapSamplesSOFT
alSource3dSOFT
alSource3f
alSource3i
alSource3i64SOFT
alSourcePause
alSourcePausev
alSourcePlay
alSourcePlayv
alSourceQueueBuffers
alSourceRewind
alSourceRewindv
alSourceStop
alSourceStopv
alSourceUnqueueBuffers
alSourcedSOFT
alSourcedvSOFT
alSourcef
alSourcefv
alSourcei
alSourcei64SOFT
alSourcei64vSOFT
alSourceiv
alSpeedOfSound
alcCaptureCloseDevice
alcCaptureOpenDevice
alcCaptureSamples
alcCaptureStart
alcCaptureStop
alcCloseDevice
alcCreateContext
alcDestroyContext
alcDevicePauseSOFT
alcDeviceResumeSOFT
alcGetContextsDevice
alcGetCurrentContext
alcGetEnumValue
alcGetError
alcGetInteger64vSOFT
alcGetIntegerv
alcGetProcAddress
alcGetString
alcGetThreadContext
alcIsExtensionPresent
alcIsRenderFormatSupportedSOFT
alcLoopbackOpenDeviceSOFT
alcMakeContextCurrent
alcOpenDevice
alcProcessContext
alcRenderSamplesSOFT
alcSetThreadContext
alcSuspendContext
opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_multistream_packet_pad
opus_multistream_packet_unpad
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_pad
opus_packet_parse
opus_packet_unpad
opus_pcm_soft_clip
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 229KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 5.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

38a215e444fc05087c18bcd0ea0d8885

Headers

File Characteristics

Imports

advapi32

comdlg32

dnsapi

gdi32

iphlpapi

kernel32

msimg32

msvcrt

ole32

oleaut32

shell32

user32

winmm

ws2_32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.data Size: 6KB - Virtual size: 6KB

.rdata Size: 229KB - Virtual size: 228KB

.rodata Size: 3KB - Virtual size: 2KB

.bss Size: - Virtual size: 5.4MB

.edata Size: 6KB - Virtual size: 6KB

.idata Size: 9KB - Virtual size: 8KB

.CRT Size: 512B - Virtual size: 64B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 42KB - Virtual size: 42KB

.reloc Size: 41KB - Virtual size: 40KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 6KB - Virtual size: 6KB

.rdata
Size: 229KB - Virtual size: 228KB

.rodata
Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 5.4MB

.edata
Size: 6KB - Virtual size: 6KB

.idata
Size: 9KB - Virtual size: 8KB

.CRT
Size: 512B - Virtual size: 64B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 42KB - Virtual size: 42KB

.reloc
Size: 41KB - Virtual size: 40KB