2a1dd08b9e2eb3dbc4f58287403a1957098d73d5f61bf84a0411e5745c77a145_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2a1dd08b9e2eb3dbc4f58287403a1957098d73d5f61bf84a0411e5745c77a145_NeikiAnalytics.exe
Size

3.0MB
MD5

7480a418e96ca913e98b11a707eba140
SHA1

1ab4125654a6e21efd4dfaf47497242322e1cecf
SHA256

2a1dd08b9e2eb3dbc4f58287403a1957098d73d5f61bf84a0411e5745c77a145
SHA512

293764e8b201246270ed1457837a4c17d5cbfa32cba4f34effe09746a3a2e8c5d504636d53f1b5463ed9659879f2d2d2075c5466eaf57ad43fd5de144ff9c24e
SSDEEP

49152:thSGsQOdSj0xBCGvYYYYYYYYYYYRYYYYYYYYYYE3iA7/eFUJN9ojoso2xno1JvO:rSwySjTGvYYYYYYYYYYYRYYYYYYYYYYC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a1dd08b9e2eb3dbc4f58287403a1957098d73d5f61bf84a0411e5745c77a145_NeikiAnalytics.exe

Files

2a1dd08b9e2eb3dbc4f58287403a1957098d73d5f61bf84a0411e5745c77a145_NeikiAnalytics.exe
.exe windows:6 windows x86 arch:x86

f0ee25fd4d9035dad1913faffd4a4b87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

explorer.pdb

Imports

advapi32

RegCloseKey
RegCreateKeyW
RegGetValueW
RegOpenKeyExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegCreateKeyExW
RegQueryValueExW
EventRegister
EventUnregister
EventWrite
EventEnabled
GetLengthSid
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegDeleteKeyExW
TraceMessage
RegOpenKeyW
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
ConvertStringSidToSidW
CloseServiceHandle
OpenServiceW
RegEnumKeyExW
CreateWellKnownSid
StartServiceW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
StartTraceW
EnableTraceEx
StopTraceW
LsaLookupSids
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
LsaOpenPolicy
LsaFreeMemory
LsaClose
OpenThreadToken
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership
QueryServiceStatus
OpenSCManagerW

kernel32

LoadLibraryExA
DelayLoadFailureHook
CreateFileW
GetFileSize
ReadFile
RaiseException
FlushInstructionCache
SetLastError
OpenThread
GetSystemTimeAsFileTime
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetLocalTime
InterlockedCompareExchange
GetWindowsDirectoryW
FindFirstFileW
lstrcmpiW
FindNextFileW
FindClose
GetFileAttributesW
GetSystemTime
SystemTimeToFileTime
ExpandEnvironmentStringsW
InterlockedIncrement
InterlockedDecrement
GetLastError
SetInformationJobObject
CreateJobObjectW
GetPriorityClass
SearchPathW
GetSystemDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
GetTimeZoneInformation
GetDynamicTimeZoneInformation
GetBinaryTypeW
QueryPerformanceFrequency
QueueUserWorkItem
LoadLibraryExW
GetTickCount64
MulDiv
GetLongPathNameW
GetThreadPriority
MultiByteToWideChar
GlobalGetAtomNameW
GetCurrentThread
SetThreadPriority
GetProductInfo
TerminateThread
CreateIoCompletionPort
GetQueuedCompletionStatus
DeleteFileW
GetProcessId
CompareStringW
QueryFullProcessImageNameW
CompareFileTime
CreateFileMappingW
ResetEvent
WideCharToMultiByte
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
DuplicateHandle
GetCurrentDirectoryW
WaitForMultipleObjects
GetComputerNameW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
FindResourceExW
LoadResource
LockResource
SetPriorityClass
OpenProcess
CloseHandle
LocalFree
LocalAlloc
QueryInformationJobObject
Sleep
ResumeThread
AssignProcessToJobObject
CreateThread
CreateProcessW
WaitForSingleObject
FreeLibrary
GetProcAddress
LoadLibraryW
GetUserDefaultUILanguage
CreateEventW
lstrlenW
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
HeapSetInformation
GetVersionExW
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
GetPrivateProfileStringW
GetModuleFileNameW
GetCommandLineW
GetSystemDirectoryW
ExitProcess
RegisterApplicationRestart
SetProcessShutdownParameters
GetStartupInfoW
ReleaseMutex
CreateMutexW
SetErrorMode
SetProcessDEPPolicy
GetUserDefaultLangID
SetEvent
LeaveCriticalSection
EnterCriticalSection
GetTickCount
OpenEventW
SetTermsrvAppInstallMode
GetCurrentProcessId
GetModuleHandleW
GetCurrentThreadId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetModuleHandleA
CompareStringOrdinal
InterlockedExchange
VirtualAlloc
VirtualFree
LoadLibraryA

gdi32

GetStockObject
SetWindowOrgEx
StretchBlt
GetTextMetricsW
CombineRgn
Polyline
CreatePen
GetTextColor
ExtCreateRegion
GetRegionData
OffsetRgn
GetLayout
GetTextExtentPoint32W
GdiFlush
SetLayout
LPtoDP
GetRgnBox
OffsetViewportOrgEx
ExtTextOutW
SetDIBits
CreateRectRgn
GetClipRgn
IntersectClipRect
GetViewportOrgEx
SetViewportOrgEx
SelectClipRgn
GetBkColor
SetBkMode
CreateBitmap
PatBlt
CreateCompatibleBitmap
OffsetWindowOrgEx
SetBkColor
SetTextColor
GetTextExtentPointW
GetClipBox
CreateDIBSection
GetObjectW
CreateRectRgnIndirect
DeleteObject
CreateCompatibleDC
SelectObject
BitBlt
GdiAlphaBlend
GetDeviceCaps
CreateFontIndirectW
DeleteDC

user32

PtInRect
GetWindowRect
GetWindow
SendMessageW
EnumChildWindows
GetWindowLongW
CharPrevW
CharNextW
GetSystemMetrics
SystemParametersInfoW
CreateWindowExW
DialogBoxParamW
GetClassInfoW
GetClassInfoExW
GetMenuItemInfoW
GetMenuItemCount
GetClassNameW
GetKeyboardLayout
ActivateKeyboardLayout
IsChild
InsertMenuW
GetMenuStringW
SetMenuItemInfoW
InsertMenuItemW
IsWinEventHookInstalled
IsProcessDPIAware
GetNextDlgGroupItem
GetNextDlgTabItem
GetDlgCtrlID
MoveWindow
IsRectEmpty
UnionRect
ChildWindowFromPointEx
GetGUIThreadInfo
SetClassLongW
GetClassLongW
WindowFromDC
CharUpperW
UnregisterClassW
FrameRect
GetWindowDC
SendMessageCallbackW
UpdateLayeredWindow
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
GetIconInfo
ShowWindowAsync
FlashWindowEx
EndTask
SetThreadDesktop
GetMenuState
SetScrollInfo
GetScrollInfo
SetScrollPos
BringWindowToTop
DeregisterShellHookWindow
IsZoomed
CloseDesktop
OpenInputDesktop
RegisterShellHookWindow
InternalGetWindowText
GetWindowInfo
GetLayeredWindowAttributes
SetLayeredWindowAttributes
GetCaretBlinkTime
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExW
GetUpdateRect
FindWindowW
ReleaseDC
GetDC
DispatchMessageW
TranslateMessage
GetMessageW
DestroyMenu
GetMenuDefaultItem
CreatePopupMenu
PostMessageW
MsgWaitForMultipleObjectsEx
PeekMessageW
SetWindowLongW
ShutdownBlockReasonCreate
LoadStringW
DestroyWindow
PostQuitMessage
SetWindowPos
KillTimer
SetTimer
SetPropW
ShowWindow
MapWindowPoints
RegisterClassW
LoadCursorW
UpdateLayeredWindowIndirect
GetLastInputInfo
SendDlgItemMessageW
EndDialog
GetDesktopWindow
GetShellWindow
DestroyIcon
ModifyMenuW
GetMonitorInfoW
CopyRect
CheckMenuItem
EnableMenuItem
DeleteMenu
ReleaseCapture
GhostWindowFromHungWindow
GetCursorPos
DefWindowProcW
TrackMouseEvent
GetDoubleClickTime
InvalidateRect
GetWindowTextW
TrackPopupMenu
AppendMenuW
SetActiveWindow
LockWorkStation
TileWindows
CascadeWindows
ClientToScreen
WindowFromPoint
EndPaint
DrawEdge
FillRect
BeginPaint
LockSetForegroundWindow
InflateRect
IsWindowVisible
GetForegroundWindow
GetParent
WaitMessage
RegisterWindowMessageW
TrackPopupMenuEx
GetClientRect
MonitorFromRect
EqualRect
SubtractRect
RedrawWindow
EnumDisplayMonitors
SetWindowTextW
IntersectRect
GetWindowPlacement
SendNotifyMessageW
RemovePropW
SetWindowCompositionAttribute
HungWindowFromGhostWindow
SetFocus
SendMessageTimeoutW
EnumWindows
UnregisterHotKey
RegisterHotKey
MonitorFromWindow
IsWindow
SetCursor
GetAsyncKeyState
SetForegroundWindow
ChildWindowFromPoint
SetCursorPos
GetMessagePos
IsIconic
LoadIconW
DeferWindowPos
OffsetRect
GetWindowThreadProcessId
ScreenToClient
GetAncestor
MonitorFromPoint
SetRectEmpty
ChangeWindowMessageFilterEx
LoadAcceleratorsW
TranslateAcceleratorW
GetKeyState
SetWindowRgn
GetWindowRgnBox
LoadImageW
GetFocus
GetActiveWindow
MessageBeep
GetSystemMenu
SwitchToThisWindow
GetLastActivePopup
EndDeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
IsHungAppWindow
RegisterClipboardFormatW
SetRect
UpdateWindow
GetSysColorBrush
GetPropW
AllowSetForegroundWindow
LoadMenuW
GetSubMenu
RemoveMenu
SetMenuDefaultItem
GetCapture
DrawIconEx
GetMessageExtraInfo
SetGestureConfig
AdjustWindowRect
CalculatePopupWindowPosition
DrawTextW
SetCapture
CallWindowProcW
CheckDlgButton
IsDlgButtonChecked
IsWindowEnabled
GetDlgItemInt
SetDlgItemInt
GetDlgItem
EnableWindow
SetWinEventHook
MsgWaitForMultipleObjects
RegisterClassExW
CopyIcon
AdjustWindowRectEx
GetSysColor
DrawFocusRect
NotifyWinEvent
ExitWindowsEx

msvcrt

_controlfp
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr
memcpy
memmove
_CIsin
_ftol2
_CIcos
_wtoi
wcsncmp
_wcsnicmp
_wcsicmp
bsearch
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
malloc
_ftol2_sse
_CIsqrt
ceil
realloc
wcschr
iswalpha
wcsstr
swprintf_s
free
_vsnwprintf
memset

ntdll

WinSqmSetString
NtQueryInformationProcess
NtSetInformationProcess
NtOpenThreadToken
NtOpenProcessToken
NtClose
NtQueryInformationToken
WinSqmIsOptedIn
WinSqmAddToStreamEx
NtSetSystemInformation
WinSqmAddToStream
WinSqmEventEnabled
WinSqmSetDWORD
EtwEventWrite
RtlGetProductInfo
EtwEventEnabled

shlwapi

SHStrDupA
StrCmpW
ord236
ord439
PathCommonPrefixW
PathRemoveExtensionW
ord487
PathIsFileSpecW
ord154
ord476
ord217
StrRetToStrW
ord215
AssocCreate
ord632
AssocQueryStringW
ord467
PathQuoteSpacesW
ord24
ord560
SHDeleteKeyW
ord433
SHRegGetUSValueW
ord631
ord213
PathIsNetworkPathW
ord559
ord548
ord184
ord630
SHOpenRegStream2W
ord212
ord197
ord165
ord478
ord413
ord157
PathRemoveFileSpecW
ord292
ord629
ord279
ord388
ord193
ord204
ord460
PathGetDriveNumberW
PathFileExistsW
PathIsDirectoryW
ord479
ord163
PathFindExtensionW
StrChrIW
ord278
ord240
PathAppendW
SHDeleteValueW
ord16
SHSetValueW
ord635
ord618
PathRemoveArgsW
PathRemoveBlanksW
StrCmpNIW
ord174
PathGetArgsW
PathFindFileNameW
SHGetValueW
SHCreateThreadRef
SHSetThreadRef
PathCombineW
SHRegGetValueW
ord158
ord10
ord8
ord9
StrToIntW
ord270
StrChrW
ord176
ord199
ord175
ord172
ord164
ord219
SHStrDupW
StrRetToBufW
PathStripToRootW
ord256
ord168
ord12
StrTrimW
StrCmpNW
SHQueryInfoKeyW
SHCreateStreamOnFileW
ord178
ord484
ord177
ord571
ord225
ord237
PathIsPrefixW
ord437
StrCmpIW
PathParseIconLocationW
PathIsRootW
ord156
ord509
ord510
AssocQueryKeyW
PathStripPathW
ChrCmpIW
StrStrIW
SHRegGetBoolUSValueW

shell32

ord727
SHCreateItemWithParent
ord162
SHGetPropertyStoreForWindow
ord894
ord181
SHGetStockIconInfo
ord265
ord241
ord6
ord895
ord88
ord193
ord787
ord790
ord840
Shell_GetCachedImageIndexW
ord154
ord902
ord74
SHGetLocalizedName
SHGetFileInfoW
ord165
ord885
ord814
ord849
ord818
SHCreateItemFromParsingName
SHCreateShellItemArrayFromShellItem
SHGetKnownFolderPath
SHCreateShellItemArrayFromIDLists
ord152
SHBindToFolderIDListParentEx
ord28
ord747
SHChangeNotify
ord22
ord134
SHCreateDataObject
ord85
ord100
ord18
ord190
SHGetFolderLocation
ord155
SHParseDisplayName
SHGetSpecialFolderPathW
ord723
ShellExecuteExW
SHGetKnownFolderIDList
SHBindToObject
ord89
ord200
ord68
ord245
ord176
ord680
ord201
ord660
ord188
ord899
ord892
SHGetNameFromIDList
SHCreateShellItem
ord67
ord19
ord17
ord16
ord753
ord4
ord2
ord896
ord61
ord64
SHGetPathFromIDListW
ShellExecuteW
SHEnableServiceObject
ord132
SHGetIDListFromObject
ord886
SHChangeNotifyRegisterThread
ord21
ord25
ord645
ord644
SHUpdateRecycleBinIcon
ord60
ord137
SHCreateItemFromIDList
ord711
ord731
SHFileOperationW
SHGetFolderPathEx
ord733
SHGetPathFromIDListA
SHGetFolderPathW
SHBindToParent
ord254
ord91
ord54
ord244
ord893
SHAddToRecentDocs
Shell_NotifyIconW
Shell_NotifyIconGetRect
ExtractIconExW
SHEvaluateSystemCommandTemplate
ord95
ord850
ord102
DragQueryFileW
ord23
SHGetSpecialFolderLocation
SHBindToFolderIDListParent

ole32

StringFromGUID2
CoRegisterMessageFilter
RegisterDragDrop
RevokeDragDrop
OleInitialize
OleUninitialize
CoRevokeClassObject
CoCreateFreeThreadedMarshaler
CreateBindCtx
PropVariantClear
ReleaseStgMedium
CoInitializeEx
CreateStreamOnHGlobal
CoRegisterClassObject
CoCreateInstance
CoTaskMemFree
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoInitialize
CoGetMalloc
CoTaskMemAlloc
CLSIDFromString
CoFreeUnusedLibraries

oleaut32

SysAllocStringByteLen
SysAllocStringLen
SysAllocString
VariantInit
VariantClear
SysFreeString

explorerframe

ord110
ord111

uxtheme

GetThemeMargins
IsCompositionActive
IsAppThemed
GetThemeMetric
CloseThemeData
OpenThemeData
SetWindowTheme
DrawThemeBackground
GetThemeTextExtent
DrawThemeText
DrawThemeParentBackground
GetWindowTheme
GetThemePartSize
GetThemeBackgroundContentRect
EndBufferedPaint
BeginBufferedPaint
DrawThemeTextEx
BufferedPaintInit
BufferedPaintUnInit
IsThemeActive
ord86
GetThemeRect
IsThemePartDefined
GetThemeBackgroundRegion
GetThemeColor
GetThemeBool
DrawThemeIcon
GetBufferedPaintBits
BufferedPaintClear
GetThemeBackgroundExtent

powrprof

CallNtPowerInformation
GetPwrCapabilities
PowerDeterminePlatformRole

dwmapi

DwmSetWindowAttribute
ord105
DwmEnableBlurBehindWindow
DwmIsCompositionEnabled
ord113
DwmQueryThumbnailSourceSize
DwmUnregisterThumbnail
DwmUpdateThumbnailProperties
ord114
ord124
ord127

slc

SLGetWindowsInformationDWORD

gdiplus

GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetCompositingMode
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage

secur32

GetUserNameExW

rpcrt4

I_RpcExceptionFilter
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFree
NdrClientCall2

propsys

PropVariantToStringAlloc
PropVariantToUInt32
PropVariantToUInt64
VariantToStringAlloc
VariantToStringWithDefault
PropVariantToString
VariantToBooleanWithDefault
PropVariantToInt64
PropVariantToBoolean
VariantToInt32WithDefault
PSCreateMemoryPropertyStore

Sections

.text
Size: 704KB - Virtual size: 703KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f0ee25fd4d9035dad1913faffd4a4b87

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

shlwapi

shell32

ole32

oleaut32

explorerframe

uxtheme

powrprof

dwmapi

slc

gdiplus

secur32

rpcrt4

propsys

Sections

.text Size: 704KB - Virtual size: 703KB

.data Size: 11KB - Virtual size: 12KB

.rsrc Size: 2.1MB - Virtual size: 2.1MB

.reloc Size: 177KB - Virtual size: 176KB

.text
Size: 704KB - Virtual size: 703KB

.data
Size: 11KB - Virtual size: 12KB

.rsrc
Size: 2.1MB - Virtual size: 2.1MB

.reloc
Size: 177KB - Virtual size: 176KB