4754a667d720d5e1fa10b3a660108ee5177686b0496a563b5ec304e3c82644f6_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4754a667d720d5e1fa10b3a660108ee5177686b0496a563b5ec304e3c82644f6_NeikiAnalytics.exe
Size

660KB
MD5

d830db186f950ad7a780bfcf59557e80
SHA1

109994d63c0bdcdcfe83793822be04f559d67e07
SHA256

4754a667d720d5e1fa10b3a660108ee5177686b0496a563b5ec304e3c82644f6
SHA512

7a5248526c21ffa58bd3590c63990f4789568534afa15bf178cdae33ef46c85c915d89b3a91382ca36255689a2ae708e160f791f5637db947acad8fe49fea10b
SSDEEP

12288:LbPUQF/xbUVFAr8j+PJSgoiXpJt+k9Du1BwVoMAy3/8EJ+e70L:nJuLCTft+kRubwRuEJ+eQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4754a667d720d5e1fa10b3a660108ee5177686b0496a563b5ec304e3c82644f6_NeikiAnalytics.exe

Files

4754a667d720d5e1fa10b3a660108ee5177686b0496a563b5ec304e3c82644f6_NeikiAnalytics.exe
.dll windows:5 windows x86 arch:x86

2fb870b611b2a4cf0cbca235133af57d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Development\installer\Trial Reset Feature\win\build\CustomHooksTemplate\vc10\Release\citius.pdb

Imports

setupapi

SetupDiGetClassDevsW
CM_Get_DevNode_Status
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW

kernel32

LoadResource
SizeofResource
LockResource
FindFirstFileW
CreateDirectoryW
GetFileAttributesW
FindClose
FindNextFileW
QueryPerformanceCounter
GetModuleFileNameW
GetTempPathW
GetLastError
CloseHandle
LocalFree
GetCurrentProcess
SetFileAttributesW
FlushFileBuffers
CreateFileW
CopyFileW
lstrlenW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
AreFileApisANSI
MultiByteToWideChar
ReadFile
FindResourceW
WriteFile
SetEndOfFile
GetFileSize
UnlockFile
LockFile
GetFileAttributesA
DeleteFileA
DeleteFileW
LoadLibraryA
LoadLibraryW
GetProcAddress
FreeLibrary
GetTickCount
GetCurrentProcessId
GetSystemTime
GetSystemTimeAsFileTime
DeleteCriticalSection
LockFileEx
InterlockedIncrement
InitializeCriticalSection
GetTempPathA
FormatMessageA
GetFullPathNameA
GetFullPathNameW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
CreateFileA
UnlockFileEx
LocalAlloc
InterlockedDecrement
lstrlenA
GetACP
WideCharToMultiByte
SetFilePointer
GetProcessHeap
WriteConsoleW
FindResourceExW
CompareStringW
Sleep
SetEnvironmentVariableA
GetStringTypeW
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
HeapSize
SetStdHandle
LCMapStringW
IsValidCodePage
GetOEMCP
GetCPInfo
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
DecodePointer
GetCommandLineA
HeapFree
EncodePointer
RaiseException
RtlUnwind
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
ExitProcess
SetHandleCount

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetNamedSecurityInfoW
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
SetSecurityInfo

shell32

SHCreateDirectoryExW
SHGetPathFromIDListW
SHGetFolderLocation
SHGetFolderPathW

ole32

CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoTaskMemFree

oleaut32

SysStringLen
SysFreeString
VariantClear
SysAllocStringByteLen
SysAllocString

shlwapi

PathStripPathW
PathFileExistsW
PathRemoveBackslashW
PathAppendW

Exports

Exports

CSInstallerCustomHookCloseSession
CSInstallerCustomHookInitSession
CSInstallerCustomHookProcV2

Sections

.text
Size: 531KB - Virtual size: 530KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2fb870b611b2a4cf0cbca235133af57d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

setupapi

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 531KB - Virtual size: 530KB

.rdata Size: 81KB - Virtual size: 81KB

.data Size: 24KB - Virtual size: 45KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 531KB - Virtual size: 530KB

.rdata
Size: 81KB - Virtual size: 81KB

.data
Size: 24KB - Virtual size: 45KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 22KB - Virtual size: 21KB