4275f4ecdd6beb684d15456bdd4442c1b06026aed3073e082e9cf18278253c06_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4275f4ecdd6beb684d15456bdd4442c1b06026aed3073e082e9cf18278253c06_NeikiAnalytics.exe
Size

437KB
MD5

7e4f2b4e1eb706fd681f08cb0ca6c000
SHA1

4dc540740dc4af95760836c8cad87ec1114a2b0b
SHA256

4275f4ecdd6beb684d15456bdd4442c1b06026aed3073e082e9cf18278253c06
SHA512

27eecdb5c474c485a7ba2c8c3de71ded286db3cb9f6883b4f973eee8611d9b4ed50257a058fbd3f13f1ede0eac991930499f490738422c1b52a7c1c36299c12b
SSDEEP

6144:0xrRoMGAFhZIlvOMaDOZmbvTbiKJlmQmXC2SFZiB9Gc1kCOwNKztVCSR+YQT:0xrRN37ZIlvOKQmXC2htMwAtVhR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4275f4ecdd6beb684d15456bdd4442c1b06026aed3073e082e9cf18278253c06_NeikiAnalytics.exe

Files

4275f4ecdd6beb684d15456bdd4442c1b06026aed3073e082e9cf18278253c06_NeikiAnalytics.exe
.dll regsvr32 windows:5 windows x86 arch:x86

8960afc5f33e456d2b946715d7784f93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\ade\jenkins\workspace\8-2-build-windows-i586-cygwin\jdk8u241\331\build\windows-i586\deploy\tmp\jp2iexp\obj\jp2iexp.pdb

Imports

msvcr100

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_except_handler4_common
fsetpos
_fseeki64
fgetpos
memmove_s
strcspn
fwrite
setvbuf
_unlock_file
_lock_file
ungetc
fputc
fgetc
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
memchr
localeconv
_strdup
_mbsnbcmp
_ftime64_s
strftime
_localtime64
memmove
__RTDynamicCast
_errno
_putenv
fprintf_s
fopen_s
_wstat64i32
_splitpath_s
atoi
_mbslwr_s
printf
_dupenv_s
wcstombs_s
_vsnprintf_s
strcpy_s
_stat64i32
_mbsicmp
_mbsrchr
strcat_s
_local_unwind4
_mbsstr
sscanf
strncpy
_beginthreadex
_itow
_wcsicmp
_recalloc
ldiv
memcpy_s
_resetstkoflw
??0exception@std@@QAE@ABV01@@Z
??_U@YAPAXI@Z
calloc
__CxxFrameHandler3
_time64
_mktime64
_purecall
memcpy
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
abort
_free_locale
__uncaught_exception
fseek
_fsopen
islower
strerror
setlocale
_calloc_crt
___lc_handle_func
___lc_codepage_func
isupper
__pctype_func
__crtLCMapStringA
sprintf_s
??_V@YAXPAX@Z
??2@YAPAXI@Z
_CxxThrowException
_mbscmp
_mbsnbcpy_s
??3@YAXPAX@Z
vfprintf
fflush
fclose
memset
getenv
free
malloc
_snprintf_s
__clean_type_info_names_internal

kernel32

InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetTempFileNameA
AllocConsole
GetStdHandle
WriteConsoleA
OutputDebugStringA
GetExitCodeProcess
GetModuleHandleExA
GetSystemWindowsDirectoryA
GetFileAttributesA
OpenProcess
GetLocalTime
GetTempPathA
GetShortPathNameA
WTSGetActiveConsoleSessionId
GetWindowsDirectoryA
GetEnvironmentVariableA
CreateProcessA
CreateFileA
GlobalAlloc
GlobalFree
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoA
GetVersionExA
GlobalMemoryStatusEx
GetLongPathNameA
CreateEventA
GetModuleFileNameA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
MulDiv
IsDBCSLeadByte
lstrcmpiA
lstrlenW
WideCharToMultiByte
LoadLibraryA
InitializeCriticalSection
GetModuleHandleA
GetProcAddress
TlsGetValue
SetEvent
FormatMessageW
LocalFree
InterlockedCompareExchange
SetLastError
GetCurrentThreadId
ResetEvent
FormatMessageA
lstrlenA
LocalAlloc
TlsFree
TlsAlloc
TlsSetValue
GetTickCount
WaitForMultipleObjects
InterlockedDecrement
ReleaseMutex
GetCurrentProcessId
MultiByteToWideChar
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
InterlockedIncrement
CreateMutexA
CloseHandle
WaitForSingleObject
GetSystemDirectoryA

user32

GetWindowLongA
GetKeyState
TranslateMessage
SetWindowLongA
GetClientRect
GetDC
ReleaseDC
IsChild
GetClassInfoExA
LoadCursorA
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
UnregisterClassA
GetShellWindow
GetWindowThreadProcessId
OpenInputDesktop
CloseDesktop
UnhookWindowsHookEx
SetWindowsHookExA
RemovePropA
SetPropA
GetPropA
CallNextHookEx
UnionRect
PtInRect
CallWindowProcA
FillRect
BeginPaint
EndPaint
InvalidateRect
DefWindowProcA
CharNextA
wsprintfA
PostMessageA
CreateWindowExA
RegisterClassExA
IsWindow
DestroyWindow
ShowWindow
GetParent
GetFocus
SetFocus
ValidateRgn
MsgWaitForMultipleObjects
DispatchMessageA
PeekMessageA
IntersectRect

ole32

OleRegGetMiscStatus
CoWaitForMultipleHandles
StringFromCLSID
ReadClassStm
OleSaveToStream
WriteClassStm
OleRegGetUserType
OleRegEnumVerbs
CreateOleAdviseHolder
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VarUI4FromStr
OleCreatePropertyFrame
SysAllocStringLen
VarDecInt
VariantCopy
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
SysFreeString

gdi32

CreateRectRgnIndirect
ExtTextOutA
SetBkColor
GetDeviceCaps
GetStockObject
CreateDCA
RestoreDC
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetObjectType
StretchDIBits

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
_Java_sun_plugin2_main_server_IExplorerPlugin_allocateIDispatch@24
_Java_sun_plugin2_main_server_IExplorerPlugin_allocateVariantArray@12
_Java_sun_plugin2_main_server_IExplorerPlugin_axcontrolManageRef@20
_Java_sun_plugin2_main_server_IExplorerPlugin_fillInExceptionInfo0@28
_Java_sun_plugin2_main_server_IExplorerPlugin_freeVariantArray@20
_Java_sun_plugin2_main_server_IExplorerPlugin_getDocumentBase0@16
_Java_sun_plugin2_main_server_IExplorerPlugin_iDispatchExDeleteMember0@20
_Java_sun_plugin2_main_server_IExplorerPlugin_iDispatchInvoke0@52
_Java_sun_plugin2_main_server_IExplorerPlugin_iDispatchIsIHTMLWindow2@16
_Java_sun_plugin2_main_server_IExplorerPlugin_iUnknownAddRef@24
_Java_sun_plugin2_main_server_IExplorerPlugin_iUnknownRelease@24
_Java_sun_plugin2_main_server_IExplorerPlugin_iWebBrowser2GetScriptEngine@16
_Java_sun_plugin2_main_server_IExplorerPlugin_iWebBrowser2PutStatusText@20
_Java_sun_plugin2_main_server_IExplorerPlugin_iWebBrowser2SetSyncroMode@20
_Java_sun_plugin2_main_server_IExplorerPlugin_iWebBrowser2invokeLater0@20
_Java_sun_plugin2_main_server_IExplorerPlugin_setStartupStatus@20
_Java_sun_plugin2_main_server_IExplorerPlugin_setVariantArrayElementToScriptingObject@28
_Java_sun_plugin2_main_server_IExplorerPlugin_setVariantArrayElementToVoid@20
_Java_sun_plugin2_main_server_IExplorerPlugin_setVariantArrayElement__JIB@24
_Java_sun_plugin2_main_server_IExplorerPlugin_setVariantArrayElement__JIC@24
_Java_sun_plugin2_main_server_IExplorerPlugin_setVariantArrayElement__JID@28
_Java_sun_plugin2_main_server_IExplorerPlugin_setVariantArrayElement__JIF@24
_Java_sun_plugin2_main_server_IExplorerPlugin_setVariantArrayElement__JII@24
_Java_sun_plugin2_main_server_IExplorerPlugin_setVariantArrayElement__JIJ@28
_Java_sun_plugin2_main_server_IExplorerPlugin_setVariantArrayElement__JILjava_lang_String_2@24
_Java_sun_plugin2_main_server_IExplorerPlugin_setVariantArrayElement__JIS@24
_Java_sun_plugin2_main_server_IExplorerPlugin_setVariantArrayElement__JIZ@24
_Java_sun_plugin2_main_server_IExplorerPlugin_variantArrayElementToObject0@28
_Java_sun_plugin2_main_server_ServerPrintHelper_isPrinterDC0@16
_Java_sun_plugin2_main_server_ServerPrintHelper_printBand0@56
_Java_sun_plugin2_main_server_WindowsHelper_installModalFilterHook@20
_Java_sun_plugin2_main_server_WindowsHelper_installMouseHook@20
_Java_sun_plugin2_main_server_WindowsHelper_isOutOfProcessPlugin@8
_Java_sun_plugin2_main_server_WindowsHelper_runMessagePump0@28
_Java_sun_plugin2_main_server_WindowsHelper_uninstallHook@24
_Java_sun_plugin2_util_PluginTrace_broadcast@12

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 247KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8960afc5f33e456d2b946715d7784f93

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr100

kernel32

user32

ole32

oleaut32

gdi32

Exports

Exports

Sections

.text Size: 122KB - Virtual size: 121KB

.rdata Size: 55KB - Virtual size: 54KB

.data Size: 11KB - Virtual size: 12KB

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 247KB - Virtual size: 248KB

.text
Size: 122KB - Virtual size: 121KB

.rdata
Size: 55KB - Virtual size: 54KB

.data
Size: 11KB - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 247KB - Virtual size: 248KB