2987d9a6061c77a8d2c56c0a47dd7100_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

2987d9a6061c77a8d2c56c0a47dd7100_NeikiAnalytics
Size

105KB
MD5

2987d9a6061c77a8d2c56c0a47dd7100
SHA1

f989a0d72dc75de9bdb76e82298935a4456e896e
SHA256

fa7f21749ef2c8c9d2629eb48adfafd1ae1d3e42658a125e7a48aec82c34afdb
SHA512

048a081e6880bbce9bfeabd91ed55d82e00ebe6dbb2c8abba7943b91293863ed9b0dd89637168a9bbc426b5811db2e7186dc6bef66b0511a3aefb89443d46142
SSDEEP

1536:yRdHSCEj+GAImY43m1J0VYOlECZs1THETl4i1n3+UJaIrKZe4aTD0:9PptTHET2Un3+wasKZe4aTD0

Score

1^/10

Malware Config

Signatures

Files

2987d9a6061c77a8d2c56c0a47dd7100_NeikiAnalytics
.dll windows:6 windows x64 arch:x64

3740b2feb36437a7812a15205bd0556c

Code Sign

06:58:f9:a5:68:f8:c5:8c:d6:86:27:79:05:9c:07:92
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

04/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Premiere Pro\, AME\, After Effects\, Speedgrade,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:1c:d4:19:d4:5a:4f:3e:a5:cc:01:c5:4d:c6:17:b5:c2:06:00:7d:32:3c:b6:c4:0f:3c:75:5f:61:76:c0:9e
Signer

Actual PE Digest

78:1c:d4:19:d4:5a:4f:3e:a5:cc:01:c5:4d:c6:17:b5:c2:06:00:7d:32:3c:b6:c4:0f:3c:75:5f:61:76:c0:9e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\ae1612cc\releases\AfterEffects\src\pkg\PREM\AEMCPlugins\ImporterIllustratorAE\lib\win\release\ImporterIllustratorAE.pdb

Imports

dvacore

?Get@Localizer@config@dvacore@@SAPEAV123@XZ
?UTF16to8@utility@dvacore@@YA?AV?$basic_string@EU?$char_traits@E@std@@U?$STLAllocator@E@SmallBlockAllocator@utility@dvacore@@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@U?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@4@@Z
?Dispose@SmallBlockAllocator@utility@dvacore@@YAXPEAX_K@Z

msvcp140

??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?widen@?$ctype@D@std@@QEBAPEBDPEBD0PEAD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBAPEBDPEBD0PEA_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
_Stolx
_Stoulx
_Stollx
_Stoullx
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??Bid@locale@std@@QEAA_KXZ
_Mbrtowc
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ

vcruntime140

__C_specific_handler
memcpy
memset
__CxxFrameHandler3
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memmove
__std_type_info_destroy_list
__std_terminate

api-ms-win-crt-runtime-l1-1-0

terminate
_cexit
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_initialize_narrow_environment
_initialize_onexit_table
_configure_narrow_argv
_errno
_seh_filter_dll
_initterm_e
_invalid_parameter_noinfo_noreturn
_initterm
_register_onexit_function

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc
_callnewh

api-ms-win-crt-convert-l1-1-0

strtod
strtof

api-ms-win-crt-math-l1-1-0

ldexp
pow
frexp
powf

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s

api-ms-win-crt-string-l1-1-0

strcspn

api-ms-win-crt-locale-l1-1-0

localeconv

kernel32

QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead

Exports

Exports

xImportEntry

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3740b2feb36437a7812a15205bd0556c

Code Sign

06:58:f9:a5:68:f8:c5:8c:d6:86:27:79:05:9c:07:92Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

78:1c:d4:19:d4:5a:4f:3e:a5:cc:01:c5:4d:c6:17:b5:c2:06:00:7d:32:3c:b6:c4:0f:3c:75:5f:61:76:c0:9eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

dvacore

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 69KB - Virtual size: 68KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 248B

06:58:f9:a5:68:f8:c5:8c:d6:86:27:79:05:9c:07:92
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

78:1c:d4:19:d4:5a:4f:3e:a5:cc:01:c5:4d:c6:17:b5:c2:06:00:7d:32:3c:b6:c4:0f:3c:75:5f:61:76:c0:9e
Signer

.text
Size: 69KB - Virtual size: 68KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 248B