257fe22a98c827860b27a091b5088f9b4f065cb8cd76cbfd3eefaa2877897123_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

257fe22a98c827860b27a091b5088f9b4f065cb8cd76cbfd3eefaa2877897123_NeikiAnalytics.exe
Size

3.8MB
MD5

5beea9feaca58f3f5d5b4316ead184c0
SHA1

38f302ba6f7004b4894795b5adbc8da1ed62d1b5
SHA256

257fe22a98c827860b27a091b5088f9b4f065cb8cd76cbfd3eefaa2877897123
SHA512

481784493a399b21eb18c09f7ed36321d66901c2c8eb3f3a831ef31df900d1c1d164f30272996886c91f11636f6e9e99772acca999a82bb0e1ddf39a3cf3a1a1
SSDEEP

49152:Xq0y+gNRqUzEn/qVor9pyE1SHRy/i77wmlTXP+m+5S+SL5KMVTidVGjD3:Xq0y+gNRRYnCe2EMHRyaQJdcH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
257fe22a98c827860b27a091b5088f9b4f065cb8cd76cbfd3eefaa2877897123_NeikiAnalytics.exe

Files

257fe22a98c827860b27a091b5088f9b4f065cb8cd76cbfd3eefaa2877897123_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

c7fb61c763476a5d30c7e6ee776121f7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Beep
WideCharToMultiByte
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetOEMCP
GetACP
SetEndOfFile
SetStdHandle
GetLocaleInfoW
LoadLibraryA
InterlockedExchange
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
LocalFree
FormatMessageA
GetLastError
GetLongPathNameA
GetModuleFileNameA
Sleep
CreateDirectoryA
CreateDirectoryW
FindClose
FindNextFileA
FindFirstFileA
CreateFileA
CreateFileW
MoveFileA
DeleteFileA
GetFileSize
SetFilePointer
ReadFile
WriteFile
CloseHandle
GetSystemTimeAsFileTime
MultiByteToWideChar
RaiseException
RtlUnwind
HeapFree
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetStartupInfoW
GetVersionExA
GetLocalTime
GetCPInfo
HeapReAlloc
HeapAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
HeapSize
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetStdHandle
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
GetTimeZoneInformation

squall

SQUALL_Channel_GetLength
SQUALL_Channel_GetPlayPosition
SQUALL_Channel_SetPlayPosition
SQUALL_Channel_GetVolume
SQUALL_Channel_SetPan
SQUALL_Channel_GetPan
SQUALL_Channel_SetVolume
SQUALL_Channel_Pause
SQUALL_Channel_Start
SQUALL_Channel_Status
SQUALL_ChannelGroup_SetVolume
SQUALL_Sample_LoadFile
SQUALL_Sample_Unload
SQUALL_Sample_PlayEx
SQUALL_Sample_GetFileFrequency
SQUALL_Free
SQUALL_Stop
SQUALL_Listener_EAX_SetPreset
SQUALL_SetFileCallbacks
SQUALL_Channel_Stop
SQUALL_Pause
SQUALL_Init

jngload

?freeData@@YAXAAPAK@Z
?readMNG@@YAXPBXAAK1AAPAK@Z

shlwapi

PathFindFileNameA

d3d8

Direct3DCreate8

dinput8

DirectInput8Create

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

ws2_32

inet_ntoa
recv
WSAGetLastError
socket
accept
bind
closesocket
connect
getpeername
getsockname
getsockopt
ioctlsocket
listen
recvfrom
__WSAFDIsSet
select
send
sendto
setsockopt
shutdown
htonl
htons
ntohs
ntohl
getservbyname
inet_addr
gethostbyname

user32

GetCursorPos
GetKeyboardLayout
GetWindowLongW
ShowWindow
UpdateWindow
SetActiveWindow
SetWindowLongW
DrawTextW
DrawTextA
PostQuitMessage
MessageBoxA
DefWindowProcW
UnregisterClassW
DestroyWindow
DispatchMessageW
PeekMessageW
TranslateMessage
DestroyIcon
SetCursor
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
SetForegroundWindow
SendMessageW
IsIconic
FindWindowA
GetWindowInfo
AdjustWindowRect
SetWindowPos

gdi32

CreateSolidBrush
CreateCompatibleDC
CreateDIBSection
CreateFontW
DeleteObject
SetBkMode
SetBkColor
SetTextColor
SelectObject
DeleteDC
CreateFontIndirectA
GetObjectA

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shell32

SHGetFolderPathA

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 296KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7fb61c763476a5d30c7e6ee776121f7

Headers

File Characteristics

Imports

kernel32

squall

jngload

shlwapi

d3d8

dinput8

winmm

ws2_32

user32

gdi32

advapi32

shell32

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 16KB - Virtual size: 30KB

.rsrc Size: 296KB - Virtual size: 292KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 16KB - Virtual size: 30KB

.rsrc
Size: 296KB - Virtual size: 292KB