a7c5250e4da36749706db15d7b1ccfb63c51fceb9a136edfcd6174388918af8f_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a7c5250e4da36749706db15d7b1ccfb63c51fceb9a136edfcd6174388918af8f_NeikiAnalytics.exe
Size

1.4MB
MD5

c7b0ec926e2797171a6bc9a84be30360
SHA1

6a7526f9bbf3313a0a5e1947f5a7998ca988ff5c
SHA256

a7c5250e4da36749706db15d7b1ccfb63c51fceb9a136edfcd6174388918af8f
SHA512

07d0b3674c1483180004f315523bac04c8a0a53e918db2bf66d514813c6be4ac099a55d99f3cf6d845149722c088c16bf9f6b60a6eae03e4ccb236cf69973f4b
SSDEEP

12288:d9BJ7Gjy3ght9BJ7Gjy3ghpz9BJ7Gjy3gh29BJ7Gjy3ghr9BJ7Gjy3ghO:dP3ghtP3ghpzP3gh2P3ghrP3ghO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a7c5250e4da36749706db15d7b1ccfb63c51fceb9a136edfcd6174388918af8f_NeikiAnalytics.exe

Files

a7c5250e4da36749706db15d7b1ccfb63c51fceb9a136edfcd6174388918af8f_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

4b8a9adfe2a143fc15277e17573f2ba0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SetupAction1.pdb

Imports

msi

ord73
ord49
ord8
ord74
ord118
ord125
ord103
ord32
ord159
ord162
ord163
ord166
ord121
ord17
ord145
ord124

winhttp

WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData
WinHttpSendRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpOpen

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW
EnumPrintersW
GetPrinterW

gdi32

CreateDCW
DeleteDC
ExtEscape
GetStockObject
GetDeviceCaps
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
DeleteObject
ExtTextOutW
SaveDC
RestoreDC
SetMapMode
PtVisible
RectVisible
TextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx

ws2_32

htonl

kernel32

GlobalFlags
GetModuleHandleA
InterlockedExchange
CompareStringA
GetLocaleInfoW
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetCurrentProcess
FindClose
FindFirstFileW
GetFullPathNameW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLocalTime
GetCommandLineW
GetUserDefaultLCID
GetACP
GetLocaleInfoA
HeapDestroy
RaiseException
GetThreadLocale
LoadLibraryW
CompareStringW
LoadLibraryA
GetVersionExA
GetVersion
InterlockedIncrement
GetCurrentThreadId
FreeLibrary
InterlockedDecrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalReAlloc
TlsGetValue
LocalFree
LocalAlloc
GetCurrentProcessId
GetModuleFileNameW
GetTimeZoneInformation
lstrcmpW
HeapSize
SetLastError
GlobalDeleteAtom
GetTickCount
GlobalFindAtomW
GlobalAddAtomW
ReadFile
CreateMutexW
WaitForSingleObject
CreateDirectoryW
SetFileAttributesW
GetFileSize
CreateFileW
WriteFile
HeapAlloc
HeapFree
GetProcessHeap
HeapReAlloc
CloseHandle
ReleaseMutex
Sleep
GetSystemTime
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetModuleHandleW
GetProcAddress
GetVersionExW
GlobalAlloc
GlobalLock
OutputDebugStringW
GetUserGeoID
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GlobalFree
GlobalHandle
GlobalUnlock
MultiByteToWideChar
lstrlenA
GetLastError
DeleteFileA
GetCommandLineA
RtlUnwind
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
VirtualAlloc
GetCPInfo
GetOEMCP
IsValidCodePage
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
lstrlenW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
FindNextFileW
GetCurrentDirectoryA
GetDriveTypeA

user32

IsWindow
RemovePropW
GetForegroundWindow
GetPropW
SetPropW
GetClassNameW
GetClassLongW
GetCapture
WinHelpW
LoadIconW
RegisterWindowMessageW
SetWindowTextW
ClientToScreen
DestroyMenu
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
UnregisterClassA
PostQuitMessage
GetWindowTextW
GetDlgItem
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
GetClientRect
GetMenu
PostMessageW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
LoadCursorW
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
SetWindowsHookExW
CallNextHookEx
DispatchMessageW
GetKeyState
PeekMessageW
ValidateRect
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
UnhookWindowsHookEx
GetWindowThreadProcessId
SendMessageW
GetParent
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
CharUpperW
DestroyWindow

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
ControlService
CloseServiceHandle
RegCreateKeyExW
RegDeleteKeyW
FreeSid
SetSecurityDescriptorDacl
GetAce
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid

shell32

SHGetSpecialFolderPathW
ShellExecuteW

oleaut32

VariantClear
VariantInit
VariantChangeType

Exports

Exports

AddAppletPrinter
AddDeviceID
CheckCommunication
CheckCondition
CheckConditionForEAI
CheckInstalledCondition
CheckMIQ
ChoosePrinter
EnumAppletPrinter
EnumDeletePrinter
EnumEPSONPrinter
EpaudfCreate2
EventKeyCreate
EventKeyDelete
LaunchBrowser
OpenReadme
RemoveAllModels
RemoveOnePrinter
SaveRegisteredModelsPath
SendUninstallData
ServiceChange
ServiceStart
ServiceStop
SetProxyFromUI
SetQuestionnaireValue

Sections

.text
Size: 188KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4b8a9adfe2a143fc15277e17573f2ba0

Headers

File Characteristics

PDB Paths

Imports

msi

winhttp

winspool.drv

gdi32

ws2_32

kernel32

user32

advapi32

shell32

oleaut32

Exports

Exports

Sections

.text Size: 188KB - Virtual size: 185KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 36KB - Virtual size: 51KB

.rsrc Size: 4KB - Virtual size: 912B

.reloc Size: 24KB - Virtual size: 21KB

.text
Size: 188KB - Virtual size: 185KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 36KB - Virtual size: 51KB

.rsrc
Size: 4KB - Virtual size: 912B

.reloc
Size: 24KB - Virtual size: 21KB