4c1d948a8723cfd247819dc3983e0e51637103d2a273e19bcdacdaa9032d5c3d_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4c1d948a8723cfd247819dc3983e0e51637103d2a273e19bcdacdaa9032d5c3d_NeikiAnalytics.exe
Size

440KB
MD5

2604840098a30c928c376183c3282280
SHA1

bc25d872fef3676be5fafebff18a48d058b9b4a6
SHA256

4c1d948a8723cfd247819dc3983e0e51637103d2a273e19bcdacdaa9032d5c3d
SHA512

435a89b9b07b51f2cf2e420987490929ed00c8d49501099bd069d6c01b7b9db37f757cd5a078010ad1a4e52940ea2256b22821e71368f5ee47036634ed2bb776
SSDEEP

6144:NLZD3e6eeTpm2sPvYcedCmTl4PDhLMCltOkt/zkHW35i3ADSoVbkGGJfDo6K:NZ3yeTSYcedCmTahLLlHpk+WaSLJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c1d948a8723cfd247819dc3983e0e51637103d2a273e19bcdacdaa9032d5c3d_NeikiAnalytics.exe

Files

4c1d948a8723cfd247819dc3983e0e51637103d2a273e19bcdacdaa9032d5c3d_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

b4f1ff158f1248b779bd0c4e57f2a2ca

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\res\Version_4.0\Printadapter\release\PrintAdapter.pdb

Imports

xmlparse

XML_ParserCreate
XML_SetUserData
XML_SetCharacterDataHandler
XML_SetElementHandler
XML_Parse
XML_GetErrorCode
XML_ParserFree

kernel32

GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetCurrentDirectoryA
SetErrorMode
MoveFileA
DeleteFileA
ReadFile
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
GetShortPathNameA
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
GetFileAttributesA
GetFileTime
ExitProcess
HeapFree
RtlUnwind
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
GetOEMCP
ExitThread
GetSystemTimeAsFileTime
GetTimeZoneInformation
HeapReAlloc
GetStartupInfoA
HeapSize
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
HeapDestroy
HeapCreate
VirtualFree
FatalAppExitA
IsBadWritePtr
UnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetConsoleCtrlHandler
SetStdHandle
GetLocaleInfoW
SetEnvironmentVariableA
GetCPInfo
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
FreeResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
lstrcmpW
GetProcAddress
SuspendThread
ResumeThread
SetThreadPriority
GlobalFlags
lstrcmpA
SystemTimeToFileTime
FileTimeToSystemTime
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
LocalAlloc
SetLastError
GlobalFree
CopyFileA
MulDiv
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
InterlockedIncrement
lstrcatA
lstrcpyA
GetCommandLineA
CreateThread
InterlockedDecrement
IsDBCSLeadByte
lstrcpynA
LoadLibraryExA
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
CreateFileA
SetFilePointer
WriteFile
Beep
Sleep
SetEvent
GetCurrentThreadId
CreateEventA
ResetEvent
WaitForSingleObject
RaiseException
LoadResource
LockResource
SizeofResource
FindResourceA
GetTickCount
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
CreateMutexA
GetLastError
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
lstrlenA
lstrcmpiA
lstrcmpiW
GetStringTypeExA
GetStringTypeExW
lstrlenW
WideCharToMultiByte
CompareStringA
CompareStringW
GetEnvironmentVariableA
MultiByteToWideChar
GetEnvironmentVariableW
GetVersion
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
InterlockedExchange
VirtualQuery

user32

PostQuitMessage
DestroyMenu
GetMenuItemInfoA
InflateRect
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
RegisterWindowMessageA
WinHelpA
GetCapture
CreateWindowExA
GetClassLongA
GetClassInfoExA
SetPropA
GetPropA
RemovePropA
IsWindow
IsChild
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
LoadIconA
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
UpdateWindow
GetClientRect
GetMenu
PostMessageA
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
GetClassInfoA
RegisterClassA
SetWindowPlacement
SetCursor
CallWindowProcA
OffsetRect
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
CopyRect
SetMenuItemBitmaps
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
SetWindowPos
ScrollWindowEx
ShowWindow
MoveWindow
SetWindowLongA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
SendDlgItemMessageA
GetDlgItemInt
GetDlgItem
CheckRadioButton
CheckDlgButton
wsprintfA
GetScrollPos
SetScrollPos
SetFocus
SetWindowsHookExA
CallNextHookEx
TranslateMessage
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
PtInRect
GetFocus
GetDesktopWindow
SetWindowTextA
GetClassNameA
GetWindowTextLengthA
GetWindowTextA
GetDialogBaseUnits
CreateDialogIndirectParamA
SendMessageA
MessageBoxA
GetNextDlgTabItem
EndDialog
DestroyIcon
DeleteMenu
DefWindowProcA
ShowOwnedPopups
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
UnhookWindowsHookEx
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
GetMessageA
DispatchMessageA
PostThreadMessageA
CharNextA
UnregisterClassA
CharUpperA
CharUpperW
CharLowerA
CharLowerW
GetDlgItemTextA

gdi32

CreateDIBPatternBrushPt
CreatePatternBrush
CreateCompatibleDC
GetStockObject
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreateFontIndirectA
GetTextExtentPoint32A
DeleteDC
SetRectRgn
CombineRgn
GetMapMode
PatBlt
SetViewportExtEx
DPtoLP
GetTextMetricsA
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
ExtSelectClipRgn
PolyBezierTo
PolylineTo
PolyDraw
ArcTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
SetTextColor
GetClipBox
GetDCOrgEx
CreateBitmap
DeleteObject
CreateDCA
CopyMetaFileA
CreateRectRgnIndirect
GetDeviceCaps
StartDocA
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
ScaleViewportExtEx

comdlg32

GetOpenFileNameA
GetFileTitleA
GetSaveFileNameA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryInfoKeyA
RegCreateKeyA
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegSetValueA
RegDeleteValueA
RegDeleteKeyA
RegCloseKey
RegEnumKeyExA
RegSetValueExW
RegQueryValueExW
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA

shell32

ExtractIconA
SHGetFileInfoA

comctl32

ord17

shlwapi

PathFindExtensionA
PathRemoveExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA

ole32

ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
StringFromGUID2
CoRevokeClassObject
StringFromCLSID
CoResumeClassObjects
CoSuspendClassObjects
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx
CoUninitialize
CLSIDFromProgID
CoCreateInstance
CoTreatAsClass
CreateBindCtx
ReleaseStgMedium
OleDuplicateData
CoDisconnectObject
CLSIDFromString
CoRegisterClassObject

oleaut32

VarDateFromStr
SysReAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
VariantChangeType
SafeArrayRedim
VariantClear
SafeArrayCreate
VarBstrFromDec
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
RegisterTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
VarDecFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VariantInit
SafeArrayGetDim
SysAllocStringLen

mdssysutilsproxy

SU_Log

Sections

.text
Size: 340KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4f1ff158f1248b779bd0c4e57f2a2ca

Headers

File Characteristics

PDB Paths

Imports

xmlparse

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

mdssysutilsproxy

Sections

.text Size: 340KB - Virtual size: 336KB

.rdata Size: 80KB - Virtual size: 79KB

.data Size: 8KB - Virtual size: 22KB

.rsrc Size: 8KB - Virtual size: 5KB

.text
Size: 340KB - Virtual size: 336KB

.rdata
Size: 80KB - Virtual size: 79KB

.data
Size: 8KB - Virtual size: 22KB

.rsrc
Size: 8KB - Virtual size: 5KB