2317b6b568e0f8bf6e80ebd92e2549d0_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

2317b6b568e0f8bf6e80ebd92e2549d0_NeikiAnalytics
Size

2.1MB
MD5

2317b6b568e0f8bf6e80ebd92e2549d0
SHA1

1396e2506aac68bbd509dab16901efaa88e26447
SHA256

8215598e92295deb265d75d9548bfac8cec0b0bfc47d35206cf1d8d08238b045
SHA512

01aa664815ceb128e0b80835cf7fe29111b1b3ad56fd2396d93f4fb1c65debd95e91b4f02b0e841246ece0a9a8f1f7c71089d8b97bced8ba74e248e12440049e
SSDEEP

24576:QN0M9WXRJlCnSLHJlnbJZC0VecuonRY0zi3CFdbbbd6WmrEH7F9f:H8SvnbJZCGecuo7z62bbbd6y9f

Score

1^/10

Malware Config

Signatures

Files

2317b6b568e0f8bf6e80ebd92e2549d0_NeikiAnalytics
.exe windows:4 windows x86 arch:x86

c9cd17d9c41c6a2880a89ffdb34362ea

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:e4:2d:04:da:33:db:42:75:57:21:52:c9:cf:da:be
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-03-2014 00:00

Not After

18-04-2015 23:59

Subject

CN=Canon Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Inkjet System Development Center,O=Canon Inc.,L=Kawasaki-shi,ST=Kanagawa,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b7:c0:19:e5:76:a9:bf:91:87:bc:9a:8a:25:fa:35:c3:ea:d7:82:86
Signer

Actual PE Digest

b7:c0:19:e5:76:a9:bf:91:87:bc:9a:8a:25:fa:35:c3:ea:d7:82:86

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\EGV\v200\a3.0\src\WinEGVV200_a3.0(20150202)\WinEGVV200_a3.0(20150202)\ManualViewer\release\cmview.pdb

Imports

kernel32

HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
GetACP
GetOEMCP
LCMapStringA
GetConsoleCP
GetConsoleMode
SetStdHandle
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetCurrentDirectoryA
GetDriveTypeA
CreateFileA
SetEnvironmentVariableA
RtlUnwind
GetSystemTimeAsFileTime
GetFileType
HeapReAlloc
GetStartupInfoW
GetProcessHeap
HeapAlloc
HeapFree
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
GlobalFlags
InterlockedIncrement
GetDiskFreeSpaceW
GetTempFileNameW
GetTickCount
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
CompareStringA
GetVersion
GlobalGetAtomNameW
GetFileTime
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateFileW
GetShortPathNameW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
lstrcmpiW
GetThreadLocale
GetStringTypeExW
MoveFileW
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenA
lstrcmpA
GetModuleHandleA
FormatMessageW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
lstrcmpW
GetVersionExA
FreeResource
RaiseException
LoadLibraryA
InterlockedExchange
FindNextFileW
GetTempPathW
GetDiskFreeSpaceExW
CreateDirectoryW
IsValidCodePage
LCMapStringW
GetCurrentProcess
ExpandEnvironmentStringsW
GetUserDefaultLCID
GetLocaleInfoW
WaitForSingleObject
OpenMutexW
ReleaseMutex
CreateMutexW
GetSystemTime
DeleteFileW
GetLocalTime
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesW
MulDiv
Sleep
LocalFree
LocalAlloc
FindClose
FindFirstFileW
MapViewOfFile
CreateFileMappingW
GetCurrentThreadId
GetCurrentProcessId
GetVersionExW
MultiByteToWideChar
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryExW
CloseHandle
UnmapViewOfFile
FreeLibrary
GetModuleFileNameW
InterlockedDecrement
GetModuleHandleW
LoadLibraryW
GetProcAddress
SetLastError
WideCharToMultiByte
lstrlenW
GetLastError
LockResource
SizeofResource
LoadResource
GetCPInfo
FindResourceW

user32

InsertMenuItemW
CreatePopupMenu
BringWindowToTop
SetMenu
TranslateAcceleratorW
CharUpperW
KillTimer
SetTimer
DestroyCursor
SetCursorPos
GetMessageW
ValidateRect
GetWindowThreadProcessId
EndPaint
BeginPaint
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
DestroyMenu
GetMenuItemInfoW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
CheckMenuItem
GetMenuState
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
RemovePropW
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
LoadAcceleratorsW
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetMenu
GetMenuItemID
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetActiveWindow
SendMessageW
EnableWindow
UnregisterClassA
ClientToScreen
WindowFromPoint
GetDC
GetFocus
GetWindowLongW
ReleaseDC
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
DispatchMessageW
TranslateMessage
PeekMessageW
RedrawWindow
SetActiveWindow
GetLastActivePopup
GetAncestor
MessageBoxW
LoadIconW
SystemParametersInfoW
IsIconic
SetForegroundWindow
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetMenuItemCount
IsZoomed
AppendMenuW
IntersectRect
ReuseDDElParam
UnpackDDElParam
FindWindowW
DrawIcon
SetWindowRgn
PostQuitMessage
RegisterClipboardFormatW
ShowOwnedPopups
MapDialogRect
SetWindowContextHelpId
CharNextW
GetSysColorBrush
UnregisterClassW
DeleteMenu
GetCursorPos
GetDCEx
LockWindowUpdate
CopyAcceleratorTableW
InvalidateRgn
SetParent
MessageBeep
GetNextDlgGroupItem
PostThreadMessageW
DestroyIcon
GetClientRect
DrawFocusRect
CopyRect
GetParent
OffsetRect
ScreenToClient
GetPropW
SetPropW
InflateRect
FillRect
PtInRect
InvalidateRect
GetSubMenu
LoadBitmapW
GetSysColor
GetTopWindow
GetWindowRect
GetSystemMetrics
GetKeyState
PostMessageW
IsRectEmpty
FrameRect
SetCursor
SetCapture
LoadCursorW
GetCapture
ReleaseCapture
SetRectEmpty
GetWindowDC
GetDesktopWindow
GetWindow
SetRect
LoadMenuW
EnableMenuItem
GetScrollBarInfo
EqualRect
IsWindowVisible
UpdateWindow

gdi32

ExtSelectClipRgn
CreateRectRgnIndirect
ScaleWindowExtEx
GetMapMode
PatBlt
GetBkColor
GetCharWidthW
CreateFontW
StretchDIBits
CreateEllipticRgn
LPtoDP
GetRgnBox
SetMapMode
CombineRgn
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
MoveToEx
LineTo
IntersectClipRect
SetRectRgn
BitBlt
SetStretchBltMode
SetROP2
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
RoundRect
AbortDoc
EndPage
StartPage
EndDoc
StartDocW
Ellipse
EnumFontFamiliesExW
GetTextMetricsW
GetDeviceCaps
CreateBitmap
DeleteObject
GetCurrentObject
ExtTextOutW
GetTextColor
GetCharABCWidthsI
ExtEscape
CreateDCW
DeleteDC
CreateFontIndirectW
CreateSolidBrush
CreatePen
CreatePatternBrush
Rectangle
SelectObject
GetStockObject
StretchBlt
GetPixel
GetObjectW
SetBrushOrgEx
CreateCompatibleDC
CreateCompatibleBitmap
GetTextExtentPoint32W
ExcludeClipRect

msimg32

TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

EnumPrintersW
ord203
DocumentPropertiesW
DeviceCapabilitiesW
GetPrinterW
ClosePrinter
GetPrinterDriverW
OpenPrinterW

advapi32

OpenProcessToken
RegCreateKeyW
GetFileSecurityW
SetFileSecurityW
RegQueryValueW
RegEnumKeyW
RegOpenKeyW
RegSetValueW
IsValidSid
ConvertStringSidToSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegUnLoadKeyW
RegLoadKeyW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
SetSecurityDescriptorDacl
RegQueryValueExW
InitializeSecurityDescriptor
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey

shell32

ExtractIconW
SHGetDesktopFolder
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ShellExecuteW
SHChangeNotify
ord680
ShellExecuteExW
SHGetFileInfoW
DragFinish
DragQueryFileW
SHGetMalloc

comctl32

_TrackMouseEvent

shlwapi

PathFileExistsW
PathCombineW
PathRenameExtensionW
PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW
PathIsDirectoryW
PathFindExtensionW
PathRemoveBackslashW
PathStripToRootW
PathIsUNCW

oledlg

OleUIBusyW

ole32

CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoTaskMemAlloc
CLSIDFromString
CoTaskMemFree
CoUninitialize
CreateStreamOnHGlobal
CoInitialize
OleRun
CoCreateInstance
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

VarBstrCmp
SysAllocString
SysFreeString
VariantInit
VariantClear
VariantChangeType
OleLoadPicture
VariantCopy
SysAllocStringLen
SysStringLen
SysStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 992KB - Virtual size: 990KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 872KB - Virtual size: 868KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9cd17d9c41c6a2880a89ffdb34362ea

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

42:e4:2d:04:da:33:db:42:75:57:21:52:c9:cf:da:beCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

b7:c0:19:e5:76:a9:bf:91:87:bc:9a:8a:25:fa:35:c3:ea:d7:82:86Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

version

Sections

.text Size: 992KB - Virtual size: 990KB

.rdata Size: 204KB - Virtual size: 202KB

.data Size: 40KB - Virtual size: 58KB

.rsrc Size: 872KB - Virtual size: 868KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

42:e4:2d:04:da:33:db:42:75:57:21:52:c9:cf:da:be
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

b7:c0:19:e5:76:a9:bf:91:87:bc:9a:8a:25:fa:35:c3:ea:d7:82:86
Signer

.text
Size: 992KB - Virtual size: 990KB

.rdata
Size: 204KB - Virtual size: 202KB

.data
Size: 40KB - Virtual size: 58KB

.rsrc
Size: 872KB - Virtual size: 868KB