3912974b9205c28545fa8a6a4e7df5c0_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

3912974b9205c28545fa8a6a4e7df5c0_NeikiAnalytics.exe
Size

280KB
MD5

3912974b9205c28545fa8a6a4e7df5c0
SHA1

3a877caebdd78b7fd8ced3f945e6fc411125eeb9
SHA256

c340412be2a883cf092fd471cf09cd824ceca353e08f4b1770fff771490a4410
SHA512

1b06db56e50cb88e777f518295ea33789d985049ae9438ebdd6c9d51b4960a564620b4952cdedb945479ddd088119c79592bcd1d74372fdac30bec3454346cd2
SSDEEP

3072:744G0VToobdqD1m2izBs3jINQJoNhetzZ4fvHIwZ+Gjtb74D3yItHMOyFI2d6KHM:HredvJ2I4fpYG6MOy6Jf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3912974b9205c28545fa8a6a4e7df5c0_NeikiAnalytics.exe

Files

3912974b9205c28545fa8a6a4e7df5c0_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

527e240592df69106e4039e9227b2e36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\gaob-senyint\Desktop\TstCon\Release\TstCon.pdb

Imports

shlwapi

PathCompactPathA

mfc100

ord11188
ord1496
ord1503
ord1509
ord1507
ord1514
ord4373
ord4410
ord4381
ord4393
ord4389
ord4385
ord4415
ord4406
ord4377
ord4419
ord4398
ord4364
ord4368
ord4401
ord3991
ord5123
ord13980
ord3984
ord2661
ord13302
ord7074
ord13300
ord6128
ord12344
ord3970
ord10672
ord12962
ord12482
ord5253
ord6970
ord12868
ord2338
ord11060
ord3484
ord2945
ord2944
ord2846
ord11103
ord895
ord7581
ord1483
ord265
ord5278
ord1495
ord4371
ord4413
ord4404
ord8223
ord7859
ord3739
ord9318
ord4553
ord12168
ord2743
ord5780
ord266
ord6010
ord4317
ord2818
ord8227
ord1011
ord2409
ord13280
ord3431
ord2614
ord7862
ord3743
ord2776
ord5857
ord13219
ord2061
ord13329
ord11297
ord1315
ord5302
ord8228
ord1012
ord3744
ord7206
ord7211
ord12440
ord5858
ord3839
ord1267
ord869
ord1281
ord880
ord6809
ord11150
ord9992
ord1227
ord10881
ord10880
ord10882
ord10879
ord10148
ord9571
ord10300
ord8139
ord10013
ord10213
ord8076
ord5688
ord812
ord6572
ord3386
ord3379
ord1516
ord2119
ord1316
ord3253
ord943
ord11941
ord374
ord2183
ord4340
ord3977
ord4341
ord7889
ord5242
ord305
ord2626
ord306
ord11439
ord4498
ord1266
ord868
ord6971
ord12984
ord7875
ord3354
ord5627
ord3621
ord978
ord422
ord3373
ord6836
ord4345
ord8388
ord6679
ord2289
ord6315
ord4786
ord13048
ord4942
ord3332
ord1903
ord2025
ord12736
ord13284
ord11014
ord11034
ord11106
ord8089
ord3482
ord7312
ord11345
ord7469
ord3399
ord925
ord3771
ord3797
ord3768
ord3729
ord3702
ord3640
ord2307
ord3890
ord2280
ord1264
ord12577
ord5580
ord12415
ord865
ord1276
ord7590
ord877
ord6690
ord9397
ord8511
ord8392
ord9422
ord10459
ord11017
ord8332
ord11038
ord4076
ord3400
ord11112
ord4736
ord10746
ord10751
ord8308
ord7348
ord985
ord8361
ord7945
ord5273
ord10395
ord12910
ord3985
ord2215
ord4643
ord3548
ord3892
ord5256
ord12486
ord5257
ord12488
ord12479
ord5252
ord1524
ord11348
ord5445
ord4430
ord4435
ord4429
ord7520
ord2762
ord433
ord6344
ord5575
ord12532
ord10705
ord947
ord2753
ord384
ord1544
ord828
ord9403
ord6213
ord1231
ord12719
ord826
ord6063
ord12438
ord1338
ord1939
ord7474
ord4785
ord8441
ord5833
ord1028
ord12100
ord484
ord1210
ord788
ord10996
ord7039
ord12861
ord12847
ord12850
ord12473
ord3486
ord3361
ord11024
ord8321
ord6127
ord9094
ord10697
ord8021
ord8031
ord9512
ord8612
ord9034
ord9030
ord8600
ord8610
ord8595
ord10256
ord10253
ord7437
ord3167
ord7863
ord3746
ord13095
ord2187
ord4344
ord3475
ord5875
ord6688
ord8390
ord2334
ord9091
ord10130
ord8107
ord10110
ord11037
ord10105
ord3415
ord11980
ord969
ord10611
ord10202
ord10204
ord9288
ord410
ord6333
ord1900
ord1341
ord12003
ord1174
ord1709
ord11544
ord723
ord6011
ord2611
ord3988
ord2219
ord5511
ord5540
ord5175
ord1981
ord4870
ord5827
ord4095
ord4092
ord4094
ord6641
ord6671
ord918
ord9281
ord342
ord6293
ord259
ord11646
ord4868
ord417
ord977
ord2524
ord11277
ord3488
ord10906
ord421
ord13518
ord322
ord262
ord1902
ord7265
ord11447
ord2200
ord745
ord4143
ord6896
ord5054
ord1017
ord5493
ord1441
ord7621
ord468
ord5864
ord11510
ord1604
ord8225
ord964
ord11090
ord3808
ord3681
ord2365
ord2213
ord3736
ord5818
ord11484
ord5098
ord6632
ord6634
ord5279
ord3879
ord3871
ord5782
ord11190
ord1889
ord783
ord923
ord11263
ord5246
ord8040
ord4629
ord4628
ord347
ord4148
ord5204
ord1230
ord1639
ord3636
ord820
ord1987
ord7363
ord982
ord4975
ord7132
ord429
ord1941
ord12002
ord1173
ord12093
ord12718
ord722
ord6009
ord10774
ord9061
ord10735
ord10783
ord10784
ord8317
ord14044
ord11869
ord7538
ord4631
ord5463
ord8293
ord10246
ord10018
ord9970
ord9448
ord3663
ord11030
ord12006
ord3417
ord1192
ord12609
ord10490
ord5649
ord13238
ord11554
ord1620
ord5506
ord6193
ord5084
ord750
ord6537
ord2003
ord13753
ord6686
ord13784
ord13814
ord13783
ord13804
ord13803
ord9282
ord4735
ord4744
ord13223
ord3616
ord2374
ord8570
ord13717
ord13863
ord13852
ord13651
ord13875
ord13656
ord14129
ord14042
ord14124
ord11453
ord4930
ord11648
ord8178
ord13203
ord5514
ord4961
ord2502
ord12805
ord7487
ord7278
ord12583
ord6650
ord5172
ord8474
ord2425
ord4245
ord4572
ord5159
ord5487
ord4339
ord11647
ord12004
ord1178
ord10450
ord10756
ord10181
ord10382
ord9525
ord8185
ord9386
ord8491
ord8026
ord8008
ord2346
ord10456
ord8494
ord8493
ord8560

msvcr100

?terminate@@YAXXZ
memset
_CxxThrowException
__CxxFrameHandler3
free
strncmp
memmove_s
vsprintf_s
wcscpy_s
_mbsicmp
_resetstkoflw
sprintf_s
_purecall
memcpy_s
_recalloc
calloc
malloc
_setmbcp
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock

kernel32

ExpandEnvironmentStringsA
Sleep
InterlockedIncrement
LoadLibraryA
FreeLibrary
lstrlenW
WideCharToMultiByte
LocalFree
LocalAlloc
FormatMessageA
OutputDebugStringA
GetModuleFileNameA
InterlockedDecrement
GetUserDefaultLCID
GetLastError
MultiByteToWideChar
EncodePointer
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
DecodePointer
lstrlenA

user32

SetCapture
GetKeyState
IsClipboardFormatAvailable
SetRectEmpty
OffsetRect
UnionRect
GetCursorPos
ReleaseCapture
GetSysColorBrush
InvalidateRgn
PtInRect
GetUpdateRect
InflateRect
RegisterClipboardFormatA
IntersectRect
ReleaseDC
EqualRect
UpdateWindow
IsRectEmpty
GetSysColor
PostMessageA
GetSubMenu
LoadMenuW
EnableMenuItem
InvalidateRect
GetClientRect
GetClassInfoA
GetParent
GetWindowRect
GetDC
SendMessageA
EnableWindow
ScreenToClient

gdi32

CreateDCA
CreateMetaFileA
DeleteMetaFile
CreateRectRgnIndirect
GetRgnBox
CloseMetaFile
GetTextExtentPoint32A
CreateCompatibleDC
DeleteDC
GetObjectA
GetTextMetricsA

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExA

ole32

StgOpenStorage
ReleaseStgMedium
StgCreateDocfile
CoFreeUnusedLibraries
ReadClassStm
WriteClassStg
WriteClassStm
ReadClassStg
CreateStreamOnHGlobal
CLSIDFromProgID
CoTaskMemFree
OleRegGetUserType
StringFromGUID2
CoCreateInstance
CreateBindCtx

oleaut32

GetErrorInfo
OleCreatePropertyFrame
LoadRegTypeLi
VariantCopy
SysStringByteLen
SysAllocStringByteLen
LoadTypeLi
SysAllocString
SysFreeString
OleCreateFontIndirect
VariantChangeType
VariantClear

urlmon

CreateAsyncBindCtx
CreateURLMoniker
RegisterBindStatusCallback

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

527e240592df69106e4039e9227b2e36

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

mfc100

msvcr100

kernel32

user32

gdi32

advapi32

ole32

oleaut32

urlmon

Sections

.text Size: 150KB - Virtual size: 149KB

.rdata Size: 63KB - Virtual size: 62KB

.data Size: 5KB - Virtual size: 6KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 27KB - Virtual size: 26KB

.text
Size: 150KB - Virtual size: 149KB

.rdata
Size: 63KB - Virtual size: 62KB

.data
Size: 5KB - Virtual size: 6KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 27KB - Virtual size: 26KB