70e183db07ac438542d685820d23913e40655e74712a80f27edd30ccbd741223_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

70e183db07ac438542d685820d23913e40655e74712a80f27edd30ccbd741223_NeikiAnalytics.exe
Size

101KB
MD5

c775b97edf3f8ab3edc21c3e9df87e10
SHA1

b04fd3be352db036622870f4d7b01ce23d4d3fe9
SHA256

70e183db07ac438542d685820d23913e40655e74712a80f27edd30ccbd741223
SHA512

23ff881f19d3c39af702578b060f4a948d5a51877b7ba73008789ec4dcc7532d0b3777c10f78cfa73428b8ec291c9362605c61d7e4b77f00c46252039b6235fe
SSDEEP

3072:F1K62JAElNUCmOmVp7MI2QOBFGKQAnZ+Q:LtRElNU/lV9MoOBFGKt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70e183db07ac438542d685820d23913e40655e74712a80f27edd30ccbd741223_NeikiAnalytics.exe

Files

70e183db07ac438542d685820d23913e40655e74712a80f27edd30ccbd741223_NeikiAnalytics.exe
.dll regsvr32 windows:5 windows x86 arch:x86

19f199a8c45ef3dbe276d562bfef7c94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shfolder

SHGetFolderPathA

mfc100

ord8305
ord9286
ord5123
ord11103
ord2846
ord2944
ord2945
ord3484
ord11060
ord2338
ord5253
ord12482
ord10672
ord6128
ord13300
ord7074
ord13302
ord2661
ord3984
ord13980
ord3991
ord4401
ord4368
ord4364
ord4398
ord4419
ord4377
ord4406
ord4415
ord4385
ord4389
ord4393
ord4381
ord4410
ord4373
ord1514
ord1507
ord1509
ord1503
ord1496
ord11188
ord11190
ord12644
ord2847
ord8351
ord9994
ord6217
ord11107
ord8070
ord13294
ord10883
ord3395
ord11025
ord8235
ord13973
ord13972
ord14045
ord14062
ord14058
ord14060
ord14061
ord14059
ord2416
ord7349
ord2878
ord2881
ord12531
ord5532
ord2973
ord2974
ord3620
ord9475
ord13146
ord10007
ord8137
ord11067
ord3252
ord3254
ord7875
ord978
ord5627
ord3621
ord5539
ord422
ord6678
ord919
ord5784
ord11154
ord8224
ord2417
ord12535
ord5534
ord2744
ord3741
ord7861
ord2613
ord3429
ord8554
ord895
ord5204
ord1483
ord7876
ord4143
ord13125
ord6970
ord6836
ord14119
ord1331
ord5803
ord3162
ord300
ord782
ord781
ord2200
ord2891
ord13219
ord13131
ord7322
ord1479
ord2617
ord4282
ord4345
ord12868
ord7581
ord12865
ord12962
ord306
ord7487
ord1313
ord2119
ord744
ord1330
ord7933
ord2611
ord13045
ord5242
ord305
ord5207
ord2626
ord1322
ord4498
ord11439
ord1316
ord310
ord11781
ord1448
ord4283
ord1294
ord265
ord3406
ord316
ord868
ord901
ord1266
ord4078
ord322
ord1885
ord13518
ord12672
ord7141
ord745
ord266
ord2035
ord2084
ord11447
ord2067
ord2061
ord2063
ord1288
ord7584
ord7510
ord11726
ord13767
ord4724
ord2163
ord11420
ord11421
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord7091
ord1732
ord14075
ord10922
ord13181
ord11413
ord7144
ord13483
ord13480
ord13485
ord13482
ord13484
ord13481
ord3409
ord381
ord946
ord2752
ord14116
ord421
ord10906
ord977
ord1929
ord7265
ord5238
ord11172
ord11180
ord7355
ord9449
ord11184
ord11153
ord11787
ord4622
ord4903
ord5095
ord1329
ord1323
ord1500
ord1296
ord6835
ord9399
ord888
ord6112
ord1297
ord323
ord8439
ord4881
ord5098
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9281
ord8304
ord1867
ord1940
ord2087
ord1315
ord780
ord906
ord2090
ord2052
ord2050
ord2079
ord1979
ord2040
ord408
ord1948
ord2089
ord10360

msvcr100

_unlink
sscanf
_recalloc
__CxxFrameHandler3
_purecall
_resetstkoflw
_strdup
memset
strcat_s
wcsncpy_s
strcpy_s
memcpy_s
_CxxThrowException
free
malloc
_mbsstr
_mbsnbcpy_s
memcmp
__clean_type_info_names_internal
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
_makepath
_splitpath
_fullpath
_mbsnicmp

kernel32

InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrcmpiA
GetModuleHandleA
GetModuleHandleW
IsDBCSLeadByte
FreeLibrary
SizeofResource
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
GetModuleFileNameA
LoadResource
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
LocalAlloc
LocalFree
GetTempPathA
GetTempFileNameA
GetCurrentDirectoryA
LoadLibraryA
SetCurrentDirectoryA
DeleteFileA
Sleep
GetFullPathNameA
GetLocaleInfoA
LoadLibraryExA
FindResourceA
MultiByteToWideChar

user32

PeekMessageA
PostMessageA
CharNextA
DispatchMessageA
EnableWindow
SendMessageA
GetCursorPos
CharNextW

advapi32

RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryInfoKeyW
RegEnumKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegCreateKeyExA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CLSIDFromProgID
StringFromGUID2
CoCreateInstance
CoTaskMemFree

oleaut32

SysStringLen
SysFreeString
VariantClear
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringByteLen
SysStringByteLen
GetActiveObject
VariantChangeType

urlmon

UrlMkSetSessionOption
URLDownloadToFileA

wininet

DeleteUrlCacheEntry

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19f199a8c45ef3dbe276d562bfef7c94

Headers

DLL Characteristics

File Characteristics

Imports

shfolder

mfc100

msvcr100

kernel32

user32

advapi32

ole32

oleaut32

urlmon

wininet

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 49KB

.rdata Size: 17KB - Virtual size: 16KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 22KB - Virtual size: 21KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 50KB - Virtual size: 49KB

.rdata
Size: 17KB - Virtual size: 16KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 22KB - Virtual size: 21KB

.reloc
Size: 9KB - Virtual size: 8KB