90aa636b7c96eb816b59d232ce7601c42a7e49a3a3b77c164c0f62180bd7b6a2_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

90aa636b7c96eb816b59d232ce7601c42a7e49a3a3b77c164c0f62180bd7b6a2_NeikiAnalytics.exe
Size

1.4MB
MD5

7eabd33c674e2b0022f3914a2342be00
SHA1

5442c960bec43271c0060842f0faa425f0f29264
SHA256

90aa636b7c96eb816b59d232ce7601c42a7e49a3a3b77c164c0f62180bd7b6a2
SHA512

cdf28859e94d943054c79b9ab8f671da0bd3340214f384eba71d0d9279579e70361a2e9aca635675b7a63a0b85dede86e4f7918e8456fa6b91c38e934a03ba7e
SSDEEP

24576:mnIV9nxrCZ9TV74TM2lP0j5tq7LMFDaSQZjTbd5RiMbYZUce+tz:5xOTV78lPktqPGaTJmM+L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
90aa636b7c96eb816b59d232ce7601c42a7e49a3a3b77c164c0f62180bd7b6a2_NeikiAnalytics.exe

Files

90aa636b7c96eb816b59d232ce7601c42a7e49a3a3b77c164c0f62180bd7b6a2_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

f8c420efb307c7db6ec922761b30644f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\E\languang\project\Mobile\InternetBar\HttpSendData\Release\MobileMonitor.pdb

Imports

kernel32

CreateFileW
WriteFile
CloseHandle
InitializeCriticalSection
OutputDebugStringW
Sleep
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
CreateDirectoryA
DeleteFileA
CreateToolhelp32Snapshot
Process32FirstW
GetCurrentProcessId
OpenProcess
TerminateProcess
Process32NextW
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
GetModuleHandleW
GetCurrentProcess
GetExitCodeThread
TerminateThread
CreatePipe
DuplicateHandle
GetStdHandle
CreateProcessA
SetFilePointer
GetFileSize
GetExitCodeProcess
ReadFile
WaitForSingleObject
CreateFileA
DeviceIoControl
SizeofResource
GetComputerNameA
GetVersionExW
GetLocalTime
GetFileSizeEx
GetTickCount
CopyFileA
GetProcessHeap
SetEndOfFile
GetModuleHandleA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
LCMapStringW
LCMapStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LockResource
LoadResource
GetLastError
FindResourceW
GetCommandLineW
DeleteCriticalSection
GetModuleFileNameW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
VirtualAlloc
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
HeapCreate
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
HeapSize
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
RaiseException
CreateThread
GetCurrentThreadId
ExitThread
HeapAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapFree
GetStartupInfoW

user32

ShowWindow
CreateWindowExW
RegisterClassExW
UpdateWindow
LoadIconW
DispatchMessageW
LoadStringW
LoadAcceleratorsW
GetMessageW
EndPaint
TranslateAcceleratorW
DialogBoxParamW
DestroyWindow
DefWindowProcW
BeginPaint
LoadCursorW
FindWindowExW
PostMessageW
FindWindowW
UnregisterDeviceNotification
RegisterDeviceNotificationW
PeekMessageW
PostThreadMessageW
wsprintfW
EndDialog
PostQuitMessage
TranslateMessage

advapi32

LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
AdjustTokenPrivileges

shell32

CommandLineToArgvW
SHGetSpecialFolderPathA
ShellExecuteExA

ole32

CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

VariantClear
VariantInit

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
CM_Locate_DevNodeA
CM_Get_Parent
CM_Get_Device_IDA
CM_Get_Child
CM_Get_Sibling
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

shlwapi

StrStrIA
PathFileExistsW
StrStrA
PathFileExistsA

wininet

InternetCheckConnectionA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
HttpSendRequestW
InternetCrackUrlA
DeleteUrlCacheEntryA
InternetReadFile
HttpQueryInfoW

netapi32

Netbios

Sections

.text
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f8c420efb307c7db6ec922761b30644f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

setupapi

shlwapi

wininet

netapi32

Sections

.text Size: 175KB - Virtual size: 174KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 6KB - Virtual size: 18KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 175KB - Virtual size: 174KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 6KB - Virtual size: 18KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 13KB - Virtual size: 13KB