7d86adc18ffb239cda4076ff00975f877a0e806995ac11d6dc6b8638880dc147_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7d86adc18ffb239cda4076ff00975f877a0e806995ac11d6dc6b8638880dc147_NeikiAnalytics.exe
Size

610KB
MD5

b2af6e8089d489a34c0c962d2cf085f0
SHA1

0807f9c03f565dc16a05f497aed459f7f917aa3f
SHA256

7d86adc18ffb239cda4076ff00975f877a0e806995ac11d6dc6b8638880dc147
SHA512

a99d4ef637124b09f519e773ace3caab972996025a1ad7f86d45708312d1ca52f0cf6b928ea9a81c8ac401cd8e774dc17c5eb9584c41ac60dbef6e3eb03cb1ef
SSDEEP

12288:QA4lKm740kP4IL6/8tomLhiLfLkAvGWx0FRSWSBfmejcSOIp1zelZAl2RbxvBzaD:QA4lKmfAomLQDwwGWPWSJmmEKSHzapG0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d86adc18ffb239cda4076ff00975f877a0e806995ac11d6dc6b8638880dc147_NeikiAnalytics.exe

Files

7d86adc18ffb239cda4076ff00975f877a0e806995ac11d6dc6b8638880dc147_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

7ff9aacd9f78fd0b5c5c68330c25aa16

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\ysws_dev\launcher\source\bin\Release\GenPatchRuntime.pdb

Imports

kernel32

InterlockedExchangeAdd
LoadLibraryA
GetVersionExA
GetCurrentThreadId
DeleteCriticalSection
GetModuleHandleA
EnterCriticalSection
GetThreadLocale
InterlockedExchange
RaiseException
FlushInstructionCache
GetACP
CreateProcessA
LeaveCriticalSection
InitializeCriticalSection
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
IsBadCodePtr
QueryPerformanceCounter
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetProcessHeap
HeapFree
GetCurrentProcess
HeapAlloc
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetOEMCP
FlushFileBuffers
ReadFile
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CloseHandle
CreateMutexA
GetLastError
UnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
HeapSize
GetProcAddress
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
LCMapStringW
LCMapStringA
RtlUnwind
GetCPInfo
VirtualAlloc
VirtualProtect
CreateThread
SetFileTime
GetFileTime
CreateFileA
GetFileSize
GetSystemTimeAsFileTime
GetFileAttributesA
CreateDirectoryA
SetCurrentDirectoryA
RemoveDirectoryA
SetFileAttributesA
MoveFileA
GetCurrentDirectoryA
DeleteFileA
AllocConsole
Process32First
GetLogicalDrives
GetStdHandle
AttachConsole
Process32Next
GetModuleFileNameA
CreateToolhelp32Snapshot
GetDiskFreeSpaceExA
ExitProcess
SetFilePointer
WaitForSingleObject
GetTickCount
WriteFile
SetLastError
OutputDebugStringA
ReleaseMutex
GetCurrentProcessId
ExpandEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
GetExitCodeProcess
TerminateProcess
GetCurrentThread
IsDebuggerPresent
FileTimeToDosDateTime
GlobalMemoryStatus
VirtualQuery
lstrcpynA
SetUnhandledExceptionFilter
IsBadStringPtrA
Module32First
GetLocalTime
GetSystemInfo
Module32Next
FileTimeToLocalFileTime
GetVersion
LocalFree
FindResourceA
lstrlenA
FreeLibrary
LoadResource
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
SizeofResource
IsDBCSLeadByte
MultiByteToWideChar
lstrlenW
lstrcmpiA
LoadLibraryExA
IsBadReadPtr
HeapReAlloc
GetStartupInfoA
GetCommandLineA
SetStdHandle
GetFileType
GetTimeZoneInformation
ExitThread

user32

SystemParametersInfoA
SetWindowPos
MapWindowPoints
GetSystemMetrics
EnableWindow
CallWindowProcA
SetWindowTextA
LoadImageA
GetDlgItem
EndDialog
CreateWindowExA
GetWindowLongA
UnregisterClassA
LoadCursorA
GetWindow
IsWindow
PostMessageA
DefWindowProcA
GetActiveWindow
DialogBoxParamA
GetWindowRect
RegisterClassExA
GetClassInfoExA
GetParent
LoadIconA
wsprintfA
GetClientRect
SendMessageA
GetWindowTextA
CharNextA
SetWindowLongA
MessageBoxA

gdi32

GetStockObject
GetObjectA
DeleteObject
CreateFontIndirectA

shell32

ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA

oleaut32

VarUI4FromStr

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shlwapi

wnsprintfA

dbghelp

SymSetOptions
SymInitialize
SymFromAddr
SymGetTypeInfo
SymGetLineFromAddr
SymCleanup
SymFunctionTableAccess
SymGetModuleBase
MiniDumpWriteDump
StackWalk
SymEnumSymbols
UnDecorateSymbolName
SymSetContext

advapi32

RegCloseKey
RegQueryValueExA
RegEnumKeyExA
GetUserNameA
RegDeleteKeyA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance

Sections

.text
Size: 304KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7ff9aacd9f78fd0b5c5c68330c25aa16

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

oleaut32

version

shlwapi

dbghelp

advapi32

ole32

Sections

.text Size: 304KB - Virtual size: 300KB

.rdata Size: 56KB - Virtual size: 55KB

.data Size: 12KB - Virtual size: 18KB

.rsrc Size: 20KB - Virtual size: 17KB

.text
Size: 304KB - Virtual size: 300KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 12KB - Virtual size: 18KB

.rsrc
Size: 20KB - Virtual size: 17KB