2cacfc33c007c304ac7ea6e9ef91b940_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

2cacfc33c007c304ac7ea6e9ef91b940_NeikiAnalytics
Size

93KB
MD5

2cacfc33c007c304ac7ea6e9ef91b940
SHA1

0bf789e480d8c1856f8101b721ce49914958427c
SHA256

c1da7112e1dcd460b1a2c501ce758393cb294dbf47c119cca7cd6629401b94bc
SHA512

a8e97a2bdca1026c38be8f744b7c03a47ca8ff4f53a6167b58dea90db476c22f7558357a26bc5f09dea8d7692fbff1df34197b3fe85765954616b2a78e852f7a
SSDEEP

1536:d5YN4ht2WdmGJ+PD22piuvpRZOb1VHP9lZ3g+OAf6Nega/AhA:TYN4hkUb1VHP93g+OAfsM

Score

1^/10

Malware Config

Signatures

Files

2cacfc33c007c304ac7ea6e9ef91b940_NeikiAnalytics
.dll windows:6 windows x64 arch:x64

25141388cc50b89b403ee330f2114d3f

Code Sign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:fc:1a:5e:14:00:45:3f:59:a4:26:ca:71:f0:aa:6f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/05/2015, 00:00

Not After

07/05/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Photoshop\, Bridge,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

11/04/2027, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

58:71:e4:38:3e:9c:65:80:62:af:a6:f5:30:9c:53:93:2f:6d:60:95
Signer

Actual PE Digest

58:71:e4:38:3e:9c:65:80:62:af:a6:f5:30:9c:53:93:2f:6d:60:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Projects\Photoshop\workarea\video_dva_releases_build\shared\dva\third_party\projects\boost_signals\lib\win\release\64\boost_signals.pdb

Imports

msvcp120

?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ

msvcr120

??0exception@std@@QEAA@AEBQEBD@Z
??0exception@std@@QEAA@AEBV01@@Z
??1exception@std@@UEAA@XZ
?what@exception@std@@UEBAPEBDXZ
_lock
_unlock
_calloc_crt
memcpy
__C_specific_handler
_onexit
__CppXcptFilter
_amsg_exit
free
_malloc_crt
_initterm
_initterm_e
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__clean_type_info_names_internal
__CxxFrameHandler3
_CxxThrowException
_hypot
memmove
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_purecall
__dllonexit

kernel32

DecodePointer
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
EncodePointer

Exports

Exports

??0call_notification@detail@signals@boost@@QEAA@AEBV0123@@Z
??0call_notification@detail@signals@boost@@QEAA@AEBV?$shared_ptr@Vsignal_base_impl@detail@signals@boost@@@3@@Z
??0connection@signals@boost@@QEAA@AEBV012@@Z
??0connection@signals@boost@@QEAA@XZ
??0named_slot_map@detail@signals@boost@@QEAA@AEBV0123@@Z
??0named_slot_map@detail@signals@boost@@QEAA@AEBV?$function2@_NVstored_group@detail@signals@boost@@V1234@@3@@Z
??0named_slot_map_iterator@detail@signals@boost@@AEAA@V?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBVstored_group@detail@signals@boost@@V?$list@Uconnection_slot_pair@detail@signals@boost@@V?$allocator@Uconnection_slot_pair@detail@signals@boost@@@std@@@std@@@std@@@std@@@std@@@std@@0@Z
??0named_slot_map_iterator@detail@signals@boost@@AEAA@V?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBVstored_group@detail@signals@boost@@V?$list@Uconnection_slot_pair@detail@signals@boost@@V?$allocator@Uconnection_slot_pair@detail@signals@boost@@@std@@@std@@@std@@@std@@@std@@@std@@0V?$_List_iterator@V?$_List_val@U?$_List_simple_types@Uconnection_slot_pair@detail@signals@boost@@@std@@@std@@@5@@Z
??0named_slot_map_iterator@detail@signals@boost@@QEAA@AEBV0123@@Z
??0named_slot_map_iterator@detail@signals@boost@@QEAA@XZ
??0scoped_connection@signals@boost@@QEAA@AEBV012@@Z
??0scoped_connection@signals@boost@@QEAA@AEBVconnection@12@@Z
??0scoped_connection@signals@boost@@QEAA@XZ
??0signal_base@detail@signals@boost@@QEAA@AEBV?$function2@_NVstored_group@detail@signals@boost@@V1234@@3@AEBVany@3@@Z
??0signal_base_impl@detail@signals@boost@@QEAA@AEBV0123@@Z
??0signal_base_impl@detail@signals@boost@@QEAA@AEBV?$function2@_NVstored_group@detail@signals@boost@@V1234@@3@AEBVany@3@@Z
??0slot_base@detail@signals@boost@@QEAA@AEBV0123@@Z
??0slot_base@detail@signals@boost@@QEAA@XZ
??0trackable@signals@boost@@IEAA@AEBV012@@Z
??0trackable@signals@boost@@IEAA@XZ
??1call_notification@detail@signals@boost@@QEAA@XZ
??1connection@signals@boost@@QEAA@XZ
??1named_slot_map@detail@signals@boost@@QEAA@XZ
??1scoped_connection@signals@boost@@QEAA@XZ
??1signal_base@detail@signals@boost@@QEAA@XZ
??1signal_base_impl@detail@signals@boost@@QEAA@XZ
??1slot_base@detail@signals@boost@@QEAA@XZ
??1trackable@signals@boost@@IEAA@XZ
??4?$empty_base@Vconnection@signals@boost@@@detail@boost@@QEAAAEAV012@AEBV012@@Z
??4?$equality_comparable1@Vconnection@signals@boost@@V?$empty_base@Vconnection@signals@boost@@@detail@3@@boost@@QEAAAEAU01@AEBU01@@Z
??4?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@QEAAAEAV01@AEBV01@@Z
??4?$less_than_comparable1@Vconnection@signals@boost@@V?$empty_base@Vconnection@signals@boost@@@detail@3@@boost@@QEAAAEAU01@AEBU01@@Z
??4call_notification@detail@signals@boost@@QEAAAEAV0123@AEBV0123@@Z
??4connection@signals@boost@@QEAAAEAV012@AEBV012@@Z
??4named_slot_map@detail@signals@boost@@QEAAAEAV0123@AEBV0123@@Z
??4named_slot_map_iterator@detail@signals@boost@@QEAAAEAV0123@AEBV0123@@Z
??4scoped_connection@signals@boost@@QEAAAEAV012@AEBV012@@Z
??4scoped_connection@signals@boost@@QEAAAEAV012@AEBVconnection@12@@Z
??4signal_base_impl@detail@signals@boost@@QEAAAEAV0123@AEBV0123@@Z
??4slot_base@detail@signals@boost@@QEAAAEAV0123@AEBV0123@@Z
??4trackable@signals@boost@@IEAAAEAV012@AEBV012@@Z
??8connection@signals@boost@@QEBA_NAEBV012@@Z
??A?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@QEBA?AV?$operator_brackets_proxy@Vnamed_slot_map_iterator@detail@signals@boost@@@detail@1@_J@Z
??C?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@QEBAPEAUconnection_slot_pair@detail@signals@1@XZ
??D?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@QEBAAEAUconnection_slot_pair@detail@signals@1@XZ
??E?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@QEAAAEAVnamed_slot_map_iterator@detail@signals@1@XZ
??F?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@QEAA?AVnamed_slot_map_iterator@detail@signals@1@H@Z
??F?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@QEAAAEAVnamed_slot_map_iterator@detail@signals@1@XZ
??G?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@QEBA?AVnamed_slot_map_iterator@detail@signals@1@_J@Z
??Mconnection@signals@boost@@QEBA_NAEBV012@@Z
??Y?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@QEAAAEAVnamed_slot_map_iterator@detail@signals@1@_J@Z
??Z?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@QEAAAEAVnamed_slot_map_iterator@detail@signals@1@_J@Z
?add_bound_object@connection@signals@boost@@AEAAXAEBUbound_object@detail@23@@Z
?advance@named_slot_map_iterator@detail@signals@boost@@QEAAX_J@Z
?begin@named_slot_map@detail@signals@boost@@QEAA?AVnamed_slot_map_iterator@234@XZ
?block@connection@signals@boost@@QEAAX_N@Z
?blocked@connection@signals@boost@@QEBA_NXZ
?bound_object_destructed@slot_base@detail@signals@boost@@CAXPEAX0@Z
?clear@named_slot_map@detail@signals@boost@@QEAAXXZ
?connect_slot@signal_base@detail@signals@boost@@IEAA?AVconnection@34@AEBVany@4@AEBVstored_group@234@V?$shared_ptr@Udata_t@slot_base@detail@signals@boost@@@4@W4connect_position@34@@Z
?connect_slot@signal_base_impl@detail@signals@boost@@QEAA?AVconnection@34@AEBVany@4@AEBVstored_group@234@V?$shared_ptr@Udata_t@slot_base@detail@signals@boost@@@4@W4connect_position@34@@Z
?connected@connection@signals@boost@@QEBA_NXZ
?create_connection@slot_base@detail@signals@boost@@IEAAXXZ
?decrement@named_slot_map_iterator@detail@signals@boost@@QEAAXXZ
?dereference@named_slot_map_iterator@detail@signals@boost@@QEBAAEAUconnection_slot_pair@234@XZ
?derived@?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@AEAAAEAVnamed_slot_map_iterator@detail@signals@2@XZ
?derived@?$iterator_facade@Vnamed_slot_map_iterator@detail@signals@boost@@Uconnection_slot_pair@234@Uforward_traversal_tag@4@AEAU5234@_J@boost@@AEBAAEBVnamed_slot_map_iterator@detail@signals@2@XZ
?disconnect@connection@signals@boost@@QEBAXXZ
?disconnect@named_slot_map@detail@signals@boost@@QEAAXAEBVstored_group@234@@Z
?disconnect@signal_base_impl@detail@signals@boost@@QEAAXAEBVstored_group@234@@Z
?disconnect_all_slots@signal_base@detail@signals@boost@@QEAAXXZ
?disconnect_all_slots@signal_base_impl@detail@signals@boost@@QEAAXXZ
?empty@named_slot_map@detail@signals@boost@@AEBA_NV?$_Tree_const_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBVstored_group@detail@signals@boost@@V?$list@Uconnection_slot_pair@detail@signals@boost@@V?$allocator@Uconnection_slot_pair@detail@signals@boost@@@std@@@std@@@std@@@std@@@std@@@std@@@Z
?empty@signal_base@detail@signals@boost@@QEBA_NXZ
?empty@signal_base_impl@detail@signals@boost@@QEBA_NXZ
?end@named_slot_map@detail@signals@boost@@QEAA?AVnamed_slot_map_iterator@234@XZ
?equal@named_slot_map_iterator@detail@signals@boost@@QEBA_NAEBV1234@@Z
?erase@named_slot_map@detail@signals@boost@@QEAAXVnamed_slot_map_iterator@234@@Z
?get_bound_objects@slot_base@detail@signals@boost@@QEBAAEAV?$vector@PEBVtrackable@signals@boost@@V?$allocator@PEBVtrackable@signals@boost@@@std@@@std@@XZ
?get_connection@connection@signals@boost@@QEBA?AV?$shared_ptr@Ubasic_connection@detail@signals@boost@@@3@XZ
?get_data@slot_base@detail@signals@boost@@QEBA?AV?$shared_ptr@Udata_t@slot_base@detail@signals@boost@@@4@XZ
?increment@named_slot_map_iterator@detail@signals@boost@@QEAAXXZ
?init_next_group@named_slot_map_iterator@detail@signals@boost@@AEAAXXZ
?insert@named_slot_map@detail@signals@boost@@QEAA?AVnamed_slot_map_iterator@234@AEBVstored_group@234@AEBVconnection@34@AEBVany@4@W4connect_position@34@@Z
?is_active@slot_base@detail@signals@boost@@QEBA_NXZ
?num_slots@signal_base@detail@signals@boost@@QEBA_KXZ
?num_slots@signal_base_impl@detail@signals@boost@@QEBA_KXZ
?release@scoped_connection@signals@boost@@QEAA?AVconnection@23@XZ
?remove_disconnected_slots@named_slot_map@detail@signals@boost@@QEAAXXZ
?remove_disconnected_slots@signal_base_impl@detail@signals@boost@@AEBAXXZ
?reset@connection@signals@boost@@AEAAXPEAUbasic_connection@detail@23@@Z
?set_controlling@connection@signals@boost@@QEAAX_N@Z
?signal_connected@trackable@signals@boost@@AEBAXVconnection@23@AEAUbound_object@detail@23@@Z
?signal_disconnected@trackable@signals@boost@@CAXPEAX0@Z
?slot_disconnected@signal_base_impl@detail@signals@boost@@SAXPEAX0@Z
?swap@connection@signals@boost@@QEAAXAEAV123@@Z
?swap@scoped_connection@signals@boost@@QEAAXAEAV123@@Z
?unblock@connection@signals@boost@@QEAAXXZ

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25141388cc50b89b403ee330f2114d3f

Code Sign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

4c:fc:1a:5e:14:00:45:3f:59:a4:26:ca:71:f0:aa:6fCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13Certificate

Extended Key Usages

Key Usages

58:71:e4:38:3e:9c:65:80:62:af:a6:f5:30:9c:53:93:2f:6d:60:95Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp120

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 46KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 1024B - Virtual size: 1KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 224B

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

4c:fc:1a:5e:14:00:45:3f:59:a4:26:ca:71:f0:aa:6f
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

58:71:e4:38:3e:9c:65:80:62:af:a6:f5:30:9c:53:93:2f:6d:60:95
Signer

.text
Size: 47KB - Virtual size: 46KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 1024B - Virtual size: 1KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 224B