301e9693f1897844adb88c79bf4094f92d05c3268e939b8c799ea13f9d546dad_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

301e9693f1897844adb88c79bf4094f92d05c3268e939b8c799ea13f9d546dad_NeikiAnalytics.exe
Size

388KB
MD5

68f25dc41a8d068cffb664528caea8e0
SHA1

e948c2e2f30fa4a6181629eb2a7fd13d3954e9f8
SHA256

301e9693f1897844adb88c79bf4094f92d05c3268e939b8c799ea13f9d546dad
SHA512

7821305c4c6cb3ab44d7c9b5efe23c43369e0ca05897fdcc69b1cec4260e6f228feea5881ac6ba9467f865eed0a5d74002f8ae873f1c3305ee6d950c1355ff38
SSDEEP

6144:bKiN6ECwjmD2PXESwLfwWiwLW/TJY3xtnP4ZEva/P3qvNQWNos3V3ggYVS94:bHgE9jmeQLW/TJY3rPWq/NQWq+VwjS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
301e9693f1897844adb88c79bf4094f92d05c3268e939b8c799ea13f9d546dad_NeikiAnalytics.exe

Files

301e9693f1897844adb88c79bf4094f92d05c3268e939b8c799ea13f9d546dad_NeikiAnalytics.exe
.dll regsvr32 windows:4 windows x86 arch:x86

85f312876681d3db65180a4f79c8b300

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\workarea\8.513.1.3\install\utils\cds\2.0\atiicdxx.dll\B_rel\atiicdxx.pdb

Imports

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

setupapi

SetupDiGetClassDescriptionA
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW

msi

ord115
ord91
ord31
ord159
ord160
ord117
ord8
ord166
ord158
ord116

kernel32

lstrlenA
GetModuleFileNameA
GetLastError
RaiseException
WideCharToMultiByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetUserDefaultLCID
OutputDebugStringA
MultiByteToWideChar
DeleteFileA
lstrcpyA
lstrcatA
FindClose
FindFirstFileA
OpenFile
GetShortPathNameA
GetWindowsDirectoryA
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
GetOverlappedResult
DeviceIoControl
CreateEventA
HeapFree
HeapAlloc
GetProcessHeap
GetTimeFormatA
GetStringTypeW
GetStringTypeA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
GetModuleHandleA
lstrlenW
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
InterlockedExchange
GetCurrentThread
GetThreadPriority
SetThreadPriority
GetDateFormatA
GetCPInfo
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetOEMCP
SetFilePointer
IsBadReadPtr
IsBadCodePtr
Sleep
GetTimeZoneInformation
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetStdHandle
FlushFileBuffers
ReadFile
SetConsoleCtrlHandler
SetEndOfFile
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
HeapSize
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
FatalAppExitA
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcess
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
HeapReAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileA
ExitProcess
TerminateProcess

user32

wsprintfA
LoadStringA
EnumDisplaySettingsA
UnregisterClassA
CharNextA

advapi32

SetSecurityDescriptorDacl
CreateServiceA
StartServiceA
OpenSCManagerA
OpenServiceA
ControlService
DeleteService
CloseServiceHandle
RegEnumValueA
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
InitializeAcl
AddAccessAllowedAce
FreeSid
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
RegEnumKeyA
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey

ole32

CoInitialize
StringFromGUID2
CoSetProxyBlanket
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree

oleaut32

SysAllocString
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
UnRegisterTypeLi
RegisterTypeLi
VariantInit
VariantClear
SysStringLen
LoadTypeLi
LoadRegTypeLi
SysAllocStringLen
SysFreeString

shlwapi

PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
DoDetection
DoDetectionEx
QueryValue
QueryValueString

Sections

.text
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

85f312876681d3db65180a4f79c8b300

Headers

File Characteristics

PDB Paths

Imports

version

setupapi

msi

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 288KB - Virtual size: 287KB

.rdata Size: 60KB - Virtual size: 58KB

.data Size: 8KB - Virtual size: 129KB

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 288KB - Virtual size: 287KB

.rdata
Size: 60KB - Virtual size: 58KB

.data
Size: 8KB - Virtual size: 129KB

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 20KB - Virtual size: 17KB