2b6b44646ad58938af1b875a85ce8c969ddef96e133bc3054a4548044a71a982_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2b6b44646ad58938af1b875a85ce8c969ddef96e133bc3054a4548044a71a982_NeikiAnalytics.exe
Size

244KB
MD5

3849167b63cc79ef20a72122890f8790
SHA1

c594b8bb0a4705343e8e6c10e1842991d1bb876d
SHA256

2b6b44646ad58938af1b875a85ce8c969ddef96e133bc3054a4548044a71a982
SHA512

b28339aa649206ee0d11df45170d2a56ddceea5e46b7fd98d80e33a673b42b6cc49d247f60744dc6484c5af8b0dc6e9cba419c6f8a22033214310996c0a25b24
SSDEEP

1536:PmIsUg5LDIjMtKdBkXbMZsvAg2ivcw47P8V6Y+065cnUHk6:u9B6MQvkXbPAg2iUfiw5cnU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b6b44646ad58938af1b875a85ce8c969ddef96e133bc3054a4548044a71a982_NeikiAnalytics.exe

Files

2b6b44646ad58938af1b875a85ce8c969ddef96e133bc3054a4548044a71a982_NeikiAnalytics.exe
.dll .js windows:4 windows x86 arch:x86 polyglot

d58f55184a6479953d11b4a3092d19b4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

memmove
wcscpy
_wcsicmp
NtDelayExecution
RtlAppendUnicodeStringToString
RtlUnwind
NtQueryVirtualMemory
RtlIntegerToUnicodeString
RtlInitUnicodeString
NtCreateFile
NtDeviceIoControlFile
RtlAllocateHeap
NtClose
RtlIpv4StringToAddressExW
RtlIpv4AddressToStringExW
RtlFreeHeap
wcslen

kernel32

WideCharToMultiByte
WriteFile
GetTempPathA
ReadFile
GetFileSize
CreateFileA
TerminateThread
CreateToolhelp32Snapshot
GetCurrentProcessId
SetThreadPriority
GlobalUnlock
CreateEventA
OpenEventA
CreateFileW
GetCommandLineA
GetWindowsDirectoryA
Process32Next
Process32First
lstrlenW
GlobalAlloc
lstrlenA
CreateProcessA
DeleteFileA
VirtualFree
GetSystemDirectoryA
GetCurrentThreadId
DeviceIoControl
GetCPInfoExA
GetACP
ExitThread
DisableThreadLibraryCalls
WriteProcessMemory
VirtualProtectEx
GetLastError
SetErrorMode
GlobalLock
GetModuleHandleA
LoadLibraryA
GetProcAddress
GlobalFree
GetModuleFileNameA
GetCurrentProcess
CreateThread
CloseHandle
OutputDebugStringA
ReadProcessMemory
ExitProcess
OpenProcess
Sleep
VirtualAlloc
TerminateProcess
LocalFree
IsBadReadPtr
MultiByteToWideChar
GetLocalTime
GetTickCount
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
TerminateProcess
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetTickCount

user32

wsprintfA
GetWindowThreadProcessId
PostMessageA
GetWindowTextA
EnumWindows
GetCursor
PostThreadMessageA
GetMessageA
CharLowerA
FindWindowA
FindWindowExA
RegisterWindowMessageA
SendMessageTimeoutA
GetInputState

wininet

InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
InternetOpenUrlW
InternetOpenW
InternetCloseHandle

ws2_32

getpeername
htonl
ntohs

gdi32

GetBkMode
GetPixel
GetBkColor

advapi32

ControlService
CloseServiceHandle
OpenSCManagerA
DeleteService
OpenServiceA
RegCloseKey
RegFlushKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

shell32

ShellExecuteExW
SHGetFileInfoW

ole32

CoInitialize
CoUninitialize

oleaut32

SysStringLen
VariantClear
SysAllocStringLen
SysFreeString

msvcrt

time
srand
_wcslwr
memcpy
wcscpy
strcpy
strlen
sprintf
_strlwr
memcmp
??1type_info@@UAE@XZ
_onexit
__dllonexit
_CxxThrowException
memset
strcat
strrchr
strstr
strchr
??3@YAXPAX@Z
__CxxFrameHandler
wcslen
wcscmp
wcsstr
atoi
strcmp
_stricmp

Exports

Exports

WSHAddressToString
WSHEnumProtocols
WSHGetBroadcastSockaddr
WSHGetProviderGuid
WSHGetSockaddrType
WSHGetSocketInformation
WSHGetWSAProtocolInfo
WSHGetWildcardSockaddr
WSHGetWinsockMapping
WSHIoctl
WSHJoinLeaf
WSHNotify
WSHOpenSocket
WSHOpenSocket2
WSHSetSocketInformation
WSHStringToAddress

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: 1024B - Virtual size: 747B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.zata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d58f55184a6479953d11b4a3092d19b4

Headers

File Characteristics

Imports

ntdll

kernel32

user32

wininet

ws2_32

gdi32

advapi32

shell32

ole32

oleaut32

msvcrt

Exports

Exports

Sections

.text Size: 150KB - Virtual size: 149KB

.code Size: 1024B - Virtual size: 747B

.pata Size: 19KB - Virtual size: 19KB

.uata Size: 19KB - Virtual size: 19KB

.rata Size: 19KB - Virtual size: 19KB

.zata Size: 19KB - Virtual size: 19KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 10KB - Virtual size: 10KB

.text
Size: 150KB - Virtual size: 149KB

.code
Size: 1024B - Virtual size: 747B

.pata
Size: 19KB - Virtual size: 19KB

.uata
Size: 19KB - Virtual size: 19KB

.rata
Size: 19KB - Virtual size: 19KB

.zata
Size: 19KB - Virtual size: 19KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 10KB - Virtual size: 10KB