8afb7475615db53dd6faebf6e4ae509482bcabdc186f71c6b9fb01474c6b763c_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8afb7475615db53dd6faebf6e4ae509482bcabdc186f71c6b9fb01474c6b763c_NeikiAnalytics.exe
Size

9.7MB
MD5

9f1348f235eb5dc68aeba375f870e8e0
SHA1

348f568a0270c3d6069fb1ec2e7ebc331901a83d
SHA256

8afb7475615db53dd6faebf6e4ae509482bcabdc186f71c6b9fb01474c6b763c
SHA512

ef62e22abcb107eb22435ebd2a8267e1404c1c24320e85efd7caaeb9f00cbc1453570338610c6c85a97e4582f6213d71d0c7cd82782ce682532836d1eeb27b09
SSDEEP

98304:vGEJ1PxX+RmEVtYi+DP9GGvrwLxxmyY8LLbpMFDuf66yF7eIdmhOa1p3nwvFyZhN:OEJ1JGmEPKv8Lxxe8LLNWPeOa1hyoYA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8afb7475615db53dd6faebf6e4ae509482bcabdc186f71c6b9fb01474c6b763c_NeikiAnalytics.exe

Files

8afb7475615db53dd6faebf6e4ae509482bcabdc186f71c6b9fb01474c6b763c_NeikiAnalytics.exe
.exe windows:6 windows x86 arch:x86

0038cb07e5e3f5565c74cf3fa36e1dc6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\VS_2022_USA\[Client]\Client\YGOnline.pdb

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

d3d9

Direct3DCreate9

winmm

timeGetTime

dinput8

DirectInput8Create

imm32

ImmSetOpenStatus
ImmReleaseContext
ImmSetCompositionFontA
ImmNotifyIME
ImmSetCompositionWindow
ImmGetCompositionStringA
ImmGetCompositionWindow
ImmIsIME
ImmSetCandidateWindow
ImmGetCandidateWindow
ImmGetCandidateListA
ImmGetOpenStatus
ImmGetConversionStatus
ImmSetConversionStatus
ImmSetCompositionStringW
ImmGetProperty
ImmGetContext

ws2_32

htons
gethostbyname
WSASetLastError
inet_ntoa
socket
connect
WSACreateEvent
WSAEventSelect
closesocket
WSACloseEvent
WSAIoctl
__WSAFDIsSet
getaddrinfo
inet_addr
WSASend
WSAGetLastError
WSARecv
WSAEnumNetworkEvents
WSAResetEvent
WSASetEvent
WSAWaitForMultipleEvents
getpeername
WSACleanup
gethostname
WSAStartup
freeaddrinfo
ioctlsocket
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
WSAAsyncSelect
getsockname
gethostbyaddr
getsockopt
recvfrom
sendto
shutdown
select
accept
listen
htonl
bind
setsockopt
send
ntohs
recv

ijl11

ord5
ord3
ord2

dsetup

ord11

ddraw

DirectDrawCreateEx

wininet

HttpSendRequestExA
HttpEndRequestA
InternetReadFileExA
HttpOpenRequestA
InternetCloseHandle
InternetSetStatusCallback
InternetConnectA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetCrackUrlA
FtpPutFileA
InternetOpenA

kilos

?OAL_stream_status@@YGHPAU__STREAM_OAL@@@Z
?OAL_sample_status@@YGHPAU__SAMPLE_OAL@@@Z
?OAL_allocate_sample_handle@@YGPAU__SAMPLE_OAL@@PAU_OPENAL_DIG_DRIVER@@@Z
?OAL_file_read@@YGPAXPBDPAX@Z
?OAL_set_sample_file@@YGHPAU__SAMPLE_OAL@@PBXH@Z
?OAL_set_sample_volume_levels@@YGXPAU__SAMPLE_OAL@@MM@Z
?OAL_start_sample@@YGXPAU__SAMPLE_OAL@@@Z
?OAL_mem_free_lock@@YGXPAX@Z
?OAL_release_sample_handle@@YGXPAU__SAMPLE_OAL@@@Z
?OAL_startup@@YGXH@Z
?OAL_open_digital_driver@@YGPAU_OPENAL_DIG_DRIVER@@KHHI@Z
?OAL_close_digital_driver@@YGXPAU_OPENAL_DIG_DRIVER@@@Z
?OAL_shutdown@@YGXXZ
?OAL_start_stream@@YGXPAU__STREAM_OAL@@@Z
?OAL_close_stream@@YGXPAU__STREAM_OAL@@@Z
?OAL_set_stream_loop_count@@YGXPAU__STREAM_OAL@@H@Z
?OAL_open_stream@@YGPAU__STREAM_OAL@@PAU_OPENAL_DIG_DRIVER@@PBDH@Z

libeay32

ord3106
ord3040
ord3033

steam_api

SteamAPI_Init
SteamAPI_Shutdown
SteamAPI_GetHSteamPipe
SteamAPI_IsSteamRunning
SteamInternal_CreateInterface
SteamInternal_ContextInit
SteamAPI_GetHSteamUser
SteamAPI_RestartAppIfNecessary

kernel32

InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
GetCurrentThread
GetThreadTimes
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FreeLibraryAndExitThread
SetEvent
CreateEventExW
SignalObjectAndWait
SwitchToThread
GetThreadPriority
GetStartupInfoW
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetProcessAffinityMask
GetProcessAffinityMask
FlushProcessWriteBuffers
lstrlenA
GetTickCount
OutputDebugStringA
CreateFileA
ReadFile
SetFilePointer
CloseHandle
WriteFile
GetFileSize
GetLocalTime
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
MultiByteToWideChar
WideCharToMultiByte
lstrcpyA
GetFileAttributesA
GetModuleFileNameA
lstrcatA
LoadLibraryA
GetProcAddress
FreeLibrary
DeviceIoControl
GetCurrentProcess
LocalFree
GetLastError
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalAlloc
GlobalLock
GlobalUnlock
CreateDirectoryA
FindFirstFileA
FindClose
SetUnhandledExceptionFilter
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
CopyFileA
DeleteFileA
FindNextFileA
CreateToolhelp32Snapshot
Process32First
Process32Next
VerSetConditionMask
VerifyVersionInfoA
GetCurrentDirectoryA
RemoveDirectoryA
GetVersionExA
HeapReAlloc
InitializeCriticalSection
CreateThread
SetThreadPriority
GlobalMemoryStatus
EnterCriticalSection
GetExitCodeThread
TerminateThread
LeaveCriticalSection
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
FormatMessageW
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
HeapAlloc
CreateMutexExW
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
VirtualAlloc
VirtualFree
GetModuleFileNameW
lstrlenW
GetSystemInfo
GetLocaleInfoEx
UnmapViewOfFile
DeleteCriticalSection
SetCurrentDirectoryA
CreateFileMappingA
GetModuleHandleA
_lread
_lopen
_lclose
_llseek
CreateFileW
GetDriveTypeW
GetVolumeInformationW
FindFirstFileW
FindNextFileW
FormatMessageA
IsBadReadPtr
IsBadWritePtr
IsDBCSLeadByteEx
GlobalMemoryStatusEx
Module32First
Module32Next
GetTimeZoneInformation
SystemTimeToFileTime
IsDBCSLeadByte
GlobalFree
GetVersion
IsWow64Process
GetFileAttributesW
LoadLibraryExW
LoadLibraryW
GetEnvironmentVariableW
InterlockedIncrement
InterlockedDecrement
GetEnvironmentVariableA
GetTempFileNameA
GetTempPathA
IsProcessorFeaturePresent
GetProfileIntA
FatalAppExitA
LockResource
LoadResource
SizeofResource
FindResourceA
FindResourceW
InterlockedExchange
InterlockedCompareExchange
GetFullPathNameA
lstrcmpiA
InitializeCriticalSectionEx
SleepEx
GetSystemDirectoryW
MoveFileExW
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
VerifyVersionInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentProcessorNumberEx
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetThreadGroupAffinity
SetThreadGroupAffinity
RegisterWaitForSingleObject
UnregisterWait
DuplicateHandle
HeapSize
HeapQueryInformation
GetTempPathW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
SetStdHandle
SetEndOfFile
DeleteFileW
GetFileSizeEx
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
SetConsoleCtrlHandler
GetExitCodeProcess
CreatePipe
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
SetEnvironmentVariableW
CreateDirectoryW
WriteConsoleW
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
TryEnterCriticalSection
RtlUnwind
RaiseException
VirtualQuery
InitializeCriticalSectionAndSpinCount
GetConsoleMode
ReadConsoleW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
ResumeThread
FindFirstFileExW
CreateProcessW
GetConsoleOutputCP
SetFilePointerEx
MapViewOfFile
GetFileAttributesExW
RtlCaptureStackBackTrace
TryAcquireSRWLockExclusive
WakeConditionVariable
SetFileInformationByHandle
InitOnceExecuteOnce
GetCurrentProcessorNumber
GetFileInformationByHandleEx
GetTickCount64
CreateSymbolicLinkW
InitializeSListHead
ExitProcess

user32

GetMenu
AdjustWindowRect
LoadIconA
IntersectRect
OffsetRect
GetWindowRect
GetWindowPlacement
IsIconic
GetSystemMetrics
EnumWindows
ShowCursor
SystemParametersInfoA
FindWindowA
GetWindowTextA
GetClassNameA
EndDialog
SetFocus
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
PtInRect
SetCursor
DrawTextA
wsprintfA
SetWindowPos
SetWindowLongA
CreateWindowExA
ClientToScreen
GetCaretPos
DestroyWindow
DestroyMenu
SendMessageA
RegisterClassA
PostQuitMessage
SetForegroundWindow
LoadCursorA
DefWindowProcA
GetWindowLongA
PostMessageA
GetAsyncKeyState
SetCursorPos
GetIconInfo
ClipCursor
PeekMessageA
GetMessageA
TranslateMessage
SetActiveWindow
ScreenToClient
GetClientRect
GetCursorPos
ReleaseDC
GetDC
GetActiveWindow
MessageBoxA
SetRect
DispatchMessageA
ChangeDisplaySettingsA
AdjustWindowRectEx
CharLowerA
MoveWindow
GetKeyboardState
keybd_event
LoadStringA
GetClassInfoA
SetWindowsHookExA
GetKeyboardLayout
GetKeyState
UnhookWindowsHookEx
CallNextHookEx
ToAscii
EnumDisplaySettingsA
UnionRect
FillRect
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
InvalidateRect
GetClipboardData
GetForegroundWindow
MonitorFromWindow
SetProcessDPIAware
IsWindowUnicode
GetLastActivePopup
MessageBoxW
ReleaseCapture
SetCapture
GetCapture
ShowWindow
TrackMouseEvent

gdi32

CreateFontIndirectA
GetFontLanguageInfo
MoveToEx
ExtTextOutW
GetTextMetricsW
GetTextMetricsA
GetCharacterPlacementW
GetCharacterPlacementA
GetObjectW
CreateRectRgn
GetDeviceCaps
BitBlt
CreateDIBSection
SetMapMode
CreateSolidBrush
Rectangle
AddFontResourceA
RemoveFontResourceA
GetDCOrgEx
GetClipBox
CreateFontA
TextOutA
GetTextColor
GetStockObject
GetDIBits
CreateCompatibleDC
GetObjectA
ExtTextOutA
SetTextAlign
SetBkColor
SetTextColor
SetBkMode
DeleteObject
SelectObject
DeleteDC
CreateFontIndirectW
GetTextExtentPoint32A

comdlg32

GetOpenFileNameA

advapi32

RegGetValueW
RegOpenKeyExA
RegQueryValueExA
ConvertSidToStringSidA
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
RegCloseKey
OpenProcessToken
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegOpenKeyA
RegCreateKeyExA
RegQueryValueExW
RegOpenKeyExW
EventUnregister
EventWriteTransfer
EventSetInformation
EventRegister
RegSetValueExA
GetTokenInformation

shell32

ShellExecuteA

ole32

CoTaskMemFree
CoCreateInstance
OleInitialize
CoUninitialize
CoInitialize
CoTaskMemAlloc

oleaut32

SetErrorInfo
VariantChangeType
GetErrorInfo
SysFreeString
SysAllocString
VariantClear
VariantInit
CreateErrorInfo

wldap32

ord26
ord117
ord41
ord208
ord216
ord27
ord46
ord219
ord145
ord301
ord147
ord133
ord127
ord14
ord142
ord79
ord167

shlwapi

ord12

netapi32

NetWkstaGetInfo
NetApiBufferFree

dwmapi

DwmIsCompositionEnabled
DwmEnableBlurBehindWindow
DwmGetColorizationColor

Sections

.text
Size: 8.2MB - Virtual size: 8.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 118KB - Virtual size: 65.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0038cb07e5e3f5565c74cf3fa36e1dc6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

d3d9

winmm

dinput8

imm32

ws2_32

ijl11

dsetup

ddraw

wininet

kilos

libeay32

steam_api

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

wldap32

shlwapi

netapi32

dwmapi

Sections

.text Size: 8.2MB - Virtual size: 8.2MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 118KB - Virtual size: 65.8MB

.rsrc Size: 80KB - Virtual size: 80KB

.text
Size: 8.2MB - Virtual size: 8.2MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 118KB - Virtual size: 65.8MB

.rsrc
Size: 80KB - Virtual size: 80KB