20aeda22d2611df34e500fbdeedc8740_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

20aeda22d2611df34e500fbdeedc8740_NeikiAnalytics
Size

45KB
MD5

20aeda22d2611df34e500fbdeedc8740
SHA1

2881c37268cdc36eec32edd97a9cc86301937884
SHA256

bb3cedccd61744da618237d03b1cf321ca67ec7c383a9225310403767564e959
SHA512

336cf3f62bbf5bf58d85f97b8e7bbd7f1f096dcb5d1a9dcd451ab5877d8922ad2c2144f717a087c9ccf970d4f5cb5f829c00bfb07ae2482b85a3a080d2e8512e
SSDEEP

384:fcW98MQMdV7VCn2bYWhzqYMQM1K2XYmKnVOjehHC:fHldV7k2RhzII2yVPhHC

Score

1^/10

Malware Config

Signatures

Files

20aeda22d2611df34e500fbdeedc8740_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

1dcc184eff5486b687f732d7aff1d952

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:49

Not After

03/09/2023, 07:53

Subject

CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

24/09/2020, 05:48

Not After

03/09/2023, 07:57

Subject

SERIALNUMBER=913700007357889006,CN=Zhongfu Information Inc.,O=Zhongfu Information Inc.,STREET=高新区新泺大街1166号奥盛大厦2号楼15-16层,L=Jinan,ST=Shandong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13054a494e414e,1.3.6.1.4.1.311.60.2.1.2=#13085348414e444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:50:14:1b:a5:ac:e2:40:7e:28:2c:13:ae:cb:eb:22:16:e5:d8:69:e4:f7:15:e4:1b:f8:da:47:d0:9f:c8:a2
Signer

Actual PE Digest

0c:50:14:1b:a5:ac:e2:40:7e:28:2c:13:ae:cb:eb:22:16:e5:d8:69:e4:f7:15:e4:1b:f8:da:47:d0:9f:c8:a2

Digest Algorithm

sha256

PE Digest Matches

true

a3:bb:2d:ba:48:c9:43:49:ed:ac:80:72:ba:6e:f5:9b:88:45:9d:90
Signer

Actual PE Digest

a3:bb:2d:ba:48:c9:43:49:ed:ac:80:72:ba:6e:f5:9b:88:45:9d:90

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord1253
ord342
ord823
ord1182
ord1168

msvcrt

free
_initterm
malloc
_adjust_fdiv

user32

SetWindowPos
ShowWindow
GetClassNameA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx

Exports

Exports

CallWndProc
SetMyHook

Sections

.text
Size: 4KB - Virtual size: 780B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 511B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1dcc184eff5486b687f732d7aff1d952

Code Sign

04:00:00:00:00:01:25:07:1d:f9:afCertificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0aCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:25:07:1d:f9:afCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:deCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

0c:50:14:1b:a5:ac:e2:40:7e:28:2c:13:ae:cb:eb:22:16:e5:d8:69:e4:f7:15:e4:1b:f8:da:47:d0:9f:c8:a2Signer

a3:bb:2d:ba:48:c9:43:49:ed:ac:80:72:ba:6e:f5:9b:88:45:9d:90Signer

Headers

File Characteristics

Imports

mfc42

msvcrt

user32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 780B

.rdata Size: 4KB - Virtual size: 511B

.data Size: 4KB - Virtual size: 96B

Shared Size: 4KB - Virtual size: 4B

.rsrc Size: 4KB - Virtual size: 848B

.reloc Size: 4KB - Virtual size: 160B

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

09:e7:92:bc:3b:39:cc:72:fb:9c:1f:0a
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

54:ba:7c:68:27:d6:70:d7:ab:c9:7e:de
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0c:50:14:1b:a5:ac:e2:40:7e:28:2c:13:ae:cb:eb:22:16:e5:d8:69:e4:f7:15:e4:1b:f8:da:47:d0:9f:c8:a2
Signer

a3:bb:2d:ba:48:c9:43:49:ed:ac:80:72:ba:6e:f5:9b:88:45:9d:90
Signer

.text
Size: 4KB - Virtual size: 780B

.rdata
Size: 4KB - Virtual size: 511B

.data
Size: 4KB - Virtual size: 96B

Shared
Size: 4KB - Virtual size: 4B

.rsrc
Size: 4KB - Virtual size: 848B

.reloc
Size: 4KB - Virtual size: 160B