38c6702bdb9605d79fb7bc67e0314465db1f95cdcd1c01f68ed0b32d78d5529e_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

38c6702bdb9605d79fb7bc67e0314465db1f95cdcd1c01f68ed0b32d78d5529e_NeikiAnalytics.exe
Size

4.7MB
MD5

658eeb241a9ad1f43e9e10644ef69140
SHA1

599779ceec59bc33b1a39678ae46f4d80fba0b80
SHA256

38c6702bdb9605d79fb7bc67e0314465db1f95cdcd1c01f68ed0b32d78d5529e
SHA512

4a80a01c8b44230aec5052f02dde6178b7f532c9f0067c99fc25dae9674715f0223e7b35d08b4d4086a9ce17fabf6342ced465cee9fed8c7ecb65f1ab311ad39
SSDEEP

98304:WP/2ewmGlh93Ct8XaP1RFfy4u10uEWsHl0Q2Crj5:WX2VmGT93Ct8XaP1RFfy4u1MWsHa1C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38c6702bdb9605d79fb7bc67e0314465db1f95cdcd1c01f68ed0b32d78d5529e_NeikiAnalytics.exe

Files

38c6702bdb9605d79fb7bc67e0314465db1f95cdcd1c01f68ed0b32d78d5529e_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

0c432b83558fc83500003bbdebc544ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\repos\OpenMBG\game\MBGold64_OPTIMIZEDDEBUG.pdb

Imports

user32

PostMessageW
EnumDisplaySettingsW
ChangeDisplaySettingsW
GetWindowLongW
AdjustWindowRect
ReleaseDC
GetDC
SetForegroundWindow
SetFocus
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExA
UnregisterClassA
DefWindowProcA
CloseClipboard
RegisterClassA
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
ToAscii
MapVirtualKeyW
SetWindowLongW
PostQuitMessage
TranslateMessage
DispatchMessageW
PeekMessageW
GetKeyState
SetCapture
ReleaseCapture
GetSystemMetrics
GetForegroundWindow
GetWindowRect
MessageBoxA
ShowCursor
SetCursorPos
GetCursorPos
ClipCursor
LoadIconW
LoadCursorW
GetDesktopWindow
OpenClipboard

advapi32

RegCloseKey
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA

gdi32

SelectObject
GetTextExtentPoint32A
GetPixel
GetGlyphOutlineW
DeleteObject
SetTextColor
CreateCompatibleDC
CreateCompatibleBitmap
SetDeviceGammaRamp
GetDeviceGammaRamp
SetPixelFormat
SetBkColor
GetTextMetricsW
GetDeviceCaps
CreateFontA
GetStockObject

winmm

auxGetDevCapsW
mciGetErrorStringA
auxGetNumDevs
mciSendCommandW
auxSetVolume
auxGetVolume
mciSendCommandA
mixerGetNumDevs
mixerSetControlDetails
mixerGetControlDetailsW
mixerGetLineControlsW
mixerGetLineInfoW
mixerClose
mixerOpen

ws2_32

accept
bind
closesocket
connect
ioctlsocket
htonl
WSACancelAsyncRequest
WSAAsyncGetHostByName
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
socket
setsockopt
sendto
send
recvfrom
htons
recv
ntohs
listen
inet_addr
WSAAsyncSelect

kernel32

CreateMutexA
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeSListHead
CreateThread
CreateSemaphoreW
WaitForSingleObject
ReleaseSemaphore
GetDriveTypeA
ExitProcess
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GlobalLock
GlobalUnlock
GlobalAlloc
GetLogicalDriveStringsA
GetLastError
CloseHandle
GetVolumeInformationA
GetCurrentProcessId
CreateProcessA
GetModuleFileNameA
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
DebugBreak
GetTickCount
SetFilePointer
ReadFile
GetFileSize
FindNextFileA
FindFirstFileA
FindClose
DeleteFileA
CreateFileA
CreateDirectoryA
GetCurrentDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExW
SetConsoleTitleA
ReadConsoleInputW
GetNumberOfConsoleInputEvents
AllocConsole
WriteFile
FlushFileBuffers
GetStdHandle

vcruntime140

memcmp
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__intrinsic_setjmp
__current_exception_context
__current_exception
__C_specific_handler
longjmp
memchr
strrchr
strchr
strstr
memmove
memset
memcpy
_purecall
__RTDynamicCast
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

fminf
sqrt
acos
asinf
fmin
tan
floor
sin
atan2
fmaxf
fmax
asin
log
fmod
floorf
__setusermatherr
cos
pow
_fdclass
ceil
ldexp
atan
exp

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
malloc
realloc
calloc
free

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_c_exit
_exit
terminate
_errno
_seh_filter_dll
_initterm_e
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_exe
_set_app_type
exit
_get_narrow_winmain_command_line
_initterm

api-ms-win-crt-convert-l1-1-0

strtod
atoi
atof

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
_set_fmode
__stdio_common_vsprintf
fread
__acrt_iob_func
putc
__p__commode
fwrite
__stdio_common_vfprintf
fflush

api-ms-win-crt-time-l1-1-0

_utime64
_gmtime64
_localtime64
_time64

api-ms-win-crt-string-l1-1-0

strncpy
toupper
isdigit
isspace
_strnicmp
strncmp
strncat
strspn
strtok
_strupr
_strlwr
isalnum
_stricmp
strcspn
isalpha

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 819KB - Virtual size: 819KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 103KB - Virtual size: 803KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c432b83558fc83500003bbdebc544ba

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

advapi32

gdi32

winmm

ws2_32

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 819KB - Virtual size: 819KB

.data Size: 103KB - Virtual size: 803KB

.pdata Size: 199KB - Virtual size: 198KB

.idata Size: 14KB - Virtual size: 13KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 373B

.rsrc Size: 61KB - Virtual size: 61KB

.reloc Size: 47KB - Virtual size: 47KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 819KB - Virtual size: 819KB

.data
Size: 103KB - Virtual size: 803KB

.pdata
Size: 199KB - Virtual size: 198KB

.idata
Size: 14KB - Virtual size: 13KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 373B

.rsrc
Size: 61KB - Virtual size: 61KB

.reloc
Size: 47KB - Virtual size: 47KB