a70eff39a073a01d05c6596e99cb6c6fdf32f6ac879e7e8f4e6a89ed23e1e95b_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a70eff39a073a01d05c6596e99cb6c6fdf32f6ac879e7e8f4e6a89ed23e1e95b_NeikiAnalytics.exe
Size

758KB
MD5

90ffe0aa4182b44546702d313bd48a50
SHA1

56038fbd4b8b22183d66d097d579c39130c8621c
SHA256

a70eff39a073a01d05c6596e99cb6c6fdf32f6ac879e7e8f4e6a89ed23e1e95b
SHA512

643a3775724ecf2f1b0ce1eac349c73f5a5a762423a8c7f5f485b3fc8a4e4285d3c2dd480e248fae2f5cf37a5a8aab2a17126f724f195be05c5f6d710874cfbe
SSDEEP

6144:6v7Wc4dyC7dXNBzn68YoC+6VoQSkgrpZHqk61peBN1L+I8pfeDYeWHMzyy14pL1k:6vSbJxPRC+XQSxb6Dc7RwEWHeGL7GOK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a70eff39a073a01d05c6596e99cb6c6fdf32f6ac879e7e8f4e6a89ed23e1e95b_NeikiAnalytics.exe

Files

a70eff39a073a01d05c6596e99cb6c6fdf32f6ac879e7e8f4e6a89ed23e1e95b_NeikiAnalytics.exe
.exe windows:6 windows x86 arch:x86

f93b5d76132f6e6068946ec238813ce1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

calc.pdb

Imports

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
ShellAboutW
ord165
ShellExecuteExW

shlwapi

ord225

gdiplus

GdipDrawLineI
GdipDrawArcI
GdipFillRectangleI
GdipCloneBrush
GdipCloneImage
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipDrawImageRectI
GdipSetInterpolationMode
GdipSetPageUnit
GdipCreateSolidFill
GdipCreateBitmapFromScan0
GdipDisposeImage
GdipDeleteGraphics
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipGetImageGraphicsContext
GdipSetSmoothingMode
GdipCloneBitmapAreaI
GdipCreateHBITMAPFromBitmap

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegGetValueW
RegEnumValueW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
RegCreateKeyExW
RegCloseKey
EventWrite
EventUnregister
EventRegister

oleaut32

SysAllocString
SysStringLen
VariantInit
SysAllocStringByteLen
SysFreeString
VariantClear

uxtheme

IsThemeActive

ole32

CoInitialize
CoUninitialize
CoCreateInstance

comctl32

ImageList_Destroy
ImageList_Add
ImageList_Create
ord413
CreatePropertySheetPageW
PropertySheetW
ord380
ord410
ord392

ntdll

WinSqmAddToStreamEx
WinSqmIncrementDWORD
WinSqmAddToStream
NtQueryLicenseValue
RtlInitUnicodeString

kernel32

lstrlenA
WideCharToMultiByte
GetStartupInfoA
OutputDebugStringA
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetModuleHandleW
GetSystemTime
SetEvent
CloseHandle
WaitForSingleObject
CreateThread
CreateEventW
ResetEvent
lstrcmpW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalSize
MulDiv
GlobalFindAtomW
GetLastError
InterlockedDecrement
MultiByteToWideChar
GetLocalTime
GetLocaleInfoW
GetDateFormatW
InterlockedIncrement
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrcmpiW
GetLocaleInfoEx
GetProcAddress
LoadLibraryW
FreeLibrary
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
HeapFree
HeapAlloc
GetProcessHeap
GetVersionExW
InterlockedExchange
FreeLibraryAndExitThread
GetFileAttributesW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
IsWow64Process
GetCurrentProcess
GetModuleFileNameW
LocalFree
LocalReAlloc
LocalAlloc
GetProfileStringW
lstrlenW
CompareStringW
ApplicationRecoveryInProgress
Sleep
ApplicationRecoveryFinished
RegisterApplicationRecoveryCallback
RegisterApplicationRestart
CompareFileTime
SystemTimeToFileTime
GetTempFileNameW
FileTimeToSystemTime
DeleteFileW
CreateFileW
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
HeapDestroy
HeapReAlloc
HeapSize
RaiseException

user32

GetSysColor
SetClassLongW
GetClassLongW
DrawMenuBar
SetMenuItemInfoW
AppendMenuW
RemoveMenu
GetSubMenu
GetWindowLongW
InsertMenuItemW
SetWindowLongW
IsWindowEnabled
PostMessageW
CharNextA
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
GetMenuState
IsClipboardFormatAvailable
DefWindowProcW
InvalidateRect
PostQuitMessage
GetFocus
DispatchMessageW
TranslateMessage
GetMessageExtraInfo
TranslateAcceleratorW
GetMessageW
SetForegroundWindow
SetWindowPlacement
RegisterClassExW
DrawTextW
ReleaseDC
GetDC
GetSystemMetrics
EnumChildWindows
SetPropW
GetMenu
CheckRadioButton
UpdateWindow
SendDlgItemMessageW
IsDlgButtonChecked
MoveWindow
GetDlgItemInt
SetDlgItemInt
CheckMenuItem
GetNextDlgTabItem
OffsetRect
GetMonitorInfoW
MonitorFromWindow
CopyRect
IntersectRect
EnumDisplayMonitors
EqualRect
MonitorFromRect
GetClassWord
EnumDesktopWindows
GetProcessDefaultLayout
CreateDialogParamW
TrackPopupMenu
CreatePopupMenu
GetAncestor
FindWindowW
EndDialog
EnableMenuItem
DestroyWindow
MapWindowPoints
GetClassNameW
GetDlgItem
GetWindowRect
SetWindowPos
SendMessageW
LoadCursorW
SetCursor
GetKeyState
IsDialogMessageW
LoadAcceleratorsW
GetWindowTextLengthW
GetWindowTextW
EnableWindow
SetFocus
LoadStringW
SetWindowTextW
GetParent
GetClientRect
ShowWindow
GetWindowPlacement
LoadImageW
UnregisterClassA
FillRect
CheckMenuRadioItem
CreateWindowExW
MessageBeep
SystemParametersInfoW
DialogBoxParamW

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

winmm

timeGetTime

version

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

gdi32

EqualRgn
CreateDIBSection
DeleteObject
DeleteDC
GetTextExtentPointW
CreateFontIndirectW
CreateCompatibleDC
GetDeviceCaps
GetRgnBox
CreateSolidBrush
GetTextMetricsW
GetTextExtentPoint32W
GetObjectW
LineTo
MoveToEx
ExtCreatePen
CreateCompatibleBitmap
CreateRectRgn
CreateRectRgnIndirect
SetRectRgn
CombineRgn
SelectObject
CreatePatternBrush
SetTextColor
SetBkMode
GetStockObject
SetBkColor

msvcrt

wcsncmp
_wcsnicmp
iswdigit
_wcslwr_s
iswalpha
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
localeconv
memchr
strcspn
sprintf_s
_strtoi64
_strtoui64
_wcsdup
_i64tow_s
_wtoi64
wcsrchr
wcstoul
isalpha
time
difftime
memmove
_callnewh
__pctype_func
___lc_codepage_func
___lc_handle_func
_itow_s
___mb_cur_max_func
setlocale
__crtGetStringTypeW
__crtLCMapStringW
__mb_cur_max
tolower
isspace
abort
isalnum
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
__uncaught_exception
_except_handler4_common
_controlfp
_wtoi
_itoa
calloc
wcschr
_wcsicmp
_vsnwprintf
memcpy
wcscat_s
wcstol
wcscpy_s
exit
mbstowcs_s
toupper
isxdigit
isdigit
_ftol2_sse
memset
_ftol2
malloc
_purecall
free
??0exception@@QAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memmove_s
memcpy_s
__CxxFrameHandler3
_errno
_wcsrev

Sections

.text
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 394KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f93b5d76132f6e6068946ec238813ce1

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

shlwapi

gdiplus

advapi32

oleaut32

uxtheme

ole32

comctl32

ntdll

kernel32

user32

rpcrt4

winmm

version

gdi32

msvcrt

Sections

.text Size: 331KB - Virtual size: 331KB

.data Size: 16KB - Virtual size: 16KB

.rsrc Size: 394KB - Virtual size: 393KB

.reloc Size: 15KB - Virtual size: 16KB

.text
Size: 331KB - Virtual size: 331KB

.data
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 394KB - Virtual size: 393KB

.reloc
Size: 15KB - Virtual size: 16KB