15cd35c9bfca924cbd70202698ef31a0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

15cd35c9bfca924cbd70202698ef31a0_NeikiAnalytics
Size

114KB
MD5

15cd35c9bfca924cbd70202698ef31a0
SHA1

01cbf5bb5e9b5fc49c80779a4f9f4b87dd5ec088
SHA256

b93e4f8918cacbd29471514a18474f0ef0b2318d26f72c581ae2e60e4eaa87e2
SHA512

03048b383a9ae716969113b9ede582619429c03334455e951b207a73f5f361759de29eb133077a9b62cec15d27bbf156feb91f15a2835df70d11920715f441ee
SSDEEP

1536:ZFIAaATKXwEYjLYdq5nMP9hzd9fDx1sFg6OBACmx19IeIei:4A28YdUsfDx1sFuOz8ev

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Files

15cd35c9bfca924cbd70202698ef31a0_NeikiAnalytics
.exe windows:4 windows x86 arch:x86

2b977d12cc7128b7c9d4ed918a54fdbd

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cb:56:e3:56:75:b6:4e:14:8a:b0:06:a3:79:1e:02:b6
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

21/01/2022, 00:00

Not After

20/01/2025, 23:59

Subject

CN=Trader Genius Payments LLC,O=Trader Genius Payments LLC,ST=Florida,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:88:e8:08:6f:b9:1b:c9:bb:fa:e8:a2:d6:14:0d:98:4b:c6:ba:7b:8d:9e:d8:f0:79:6e:ab:af:8a:48:de:62
Signer

Actual PE Digest

b4:88:e8:08:6f:b9:1b:c9:bb:fa:e8:a2:d6:14:0d:98:4b:c6:ba:7b:8d:9e:d8:f0:79:6e:ab:af:8a:48:de:62

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaHresultCheck
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaCyMul
__vbaAryMove
__vbaFreeVar
__vbaLateIdCall
__vbaGosubReturn
__vbaStrVarMove
__vbaLenBstr
__vbaEnd
__vbaVarIdiv
__vbaFreeVarList
__vbaPut3
_adj_fdiv_m64
__vbaFpCDblR8
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaResume
__vbaStrCat
__vbaBoolErrVar
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
ord661
__vbaLenBstrB
ord662
__vbaHresultCheckObj
ord663
ord557
ord558
_adj_fdiv_m32
__vbaAryDestruct
__vbaCyErrVar
ord592
__vbaExitProc
ord593
ord300
ord594
__vbaI4Abs
ord301
ord595
__vbaOnError
__vbaObjSet
ord302
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord305
__vbaFpR4
ord306
__vbaStrFixstr
__vbaForEachCollVar
ord307
ord308
__vbaFPFix
ord309
ord523
_CIsin
ord709
ord631
__vbaVargVarMove
ord525
__vbaChkstk
__vbaGosubFree
__vbaCyVar
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord527
__vbaGenerateBoundsError
__vbaCyI2
__vbaStrCmp
__vbaGet3
ord529
__vbaAryConstruct2
__vbaVarTstEq
__vbaR4Str
ord560
__vbaCyI4
__vbaDateR8
__vbaNextEachCollVar
ord561
__vbaI2I4
DllFunctionCall
ord563
ord564
__vbaCastObjVar
__vbaStrR4
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
ord569
__vbaRedim
__vbaR8Cy
__vbaUI1ErrVar
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
__vbaLateIdCallSt
ord311
EVENT_SINK_QueryInterface
__vbaUI1I4
__vbaVarMul
__vbaExceptHandler
ord313
__vbaStrToUnicode
ord712
__vbaR4ErrVar
__vbaDateStr
ord606
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
__vbaGosub
ord714
__vbaR8ErrVar
__vbaFailedFriend
ord607
ord608
ord531
__vbaFPException
__vbaInStrVar
ord717
__vbaStrVarVal
__vbaUbound
ord534
__vbaVarCat
ord535
__vbaDateVar
__vbaI2Var
__vbaLsetFixstrFree
ord644
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
ord570
__vbaNew2
ord648
__vbaCyMulI2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
ord577
__vbaR8Var
_adj_fdiv_r
ord578
ord685
ord100
ord579
__vbaI4Var
ord610
__vbaFpCy
__vbaVarAdd
__vbaAryLock
__vbaStrToAnsi
__vbaVarDup
ord616
__vbaVarCopy
__vbaFpI4
ord617
__vbaRecDestructAnsi
_CIatan
__vbaI2ErrVar
__vbaCastObj
ord618
__vbaStrMove
__vbaStrVarCopy
ord650
_allmul
__vbaLateIdSt
__vbaFpCSngR4
_CItan
ord546
__vbaFPInt
__vbaUI1Var
__vbaAryUnlock
__vbaFpCSngR8
_CIexp
__vbaI4ErrVar
__vbaFreeObj
ord580
__vbaFreeStr

kernel32

LoadLibraryA
GetProcAddress
GetModuleHandleA

Sections

.text
Size: 48KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX0
Size: 12KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX1
Size: 32KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2b977d12cc7128b7c9d4ed918a54fdbd

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

cb:56:e3:56:75:b6:4e:14:8a:b0:06:a3:79:1e:02:b6Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

b4:88:e8:08:6f:b9:1b:c9:bb:fa:e8:a2:d6:14:0d:98:4b:c6:ba:7b:8d:9e:d8:f0:79:6e:ab:af:8a:48:de:62Signer

Headers

File Characteristics

Imports

msvbvm60

kernel32

Sections

.text Size: 48KB - Virtual size: 141KB

.data Size: 4KB - Virtual size: 10KB

.rsrc Size: 4KB - Virtual size: 4KB

.UPX0 Size: 12KB - Virtual size: 5.0MB

.UPX1 Size: 32KB - Virtual size: 36KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

cb:56:e3:56:75:b6:4e:14:8a:b0:06:a3:79:1e:02:b6
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

b4:88:e8:08:6f:b9:1b:c9:bb:fa:e8:a2:d6:14:0d:98:4b:c6:ba:7b:8d:9e:d8:f0:79:6e:ab:af:8a:48:de:62
Signer

.text
Size: 48KB - Virtual size: 141KB

.data
Size: 4KB - Virtual size: 10KB

.rsrc
Size: 4KB - Virtual size: 4KB

.UPX0
Size: 12KB - Virtual size: 5.0MB

.UPX1
Size: 32KB - Virtual size: 36KB