870b121103fc1b0e22c36e1d35105e80_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

870b121103fc1b0e22c36e1d35105e80_NeikiAnalytics
Size

6.2MB
MD5

870b121103fc1b0e22c36e1d35105e80
SHA1

e2ee05e8bf9a18b928b37a415a585f6914915cce
SHA256

5ff6e1fa9979340b00a91c586bc5d9e6ffe7ff46efc7ee8a9121ca0cd8219b7e
SHA512

41b37ad83b799e766f8dc7a572373ba944449758db9f26cf7b67e7eb45e10ab1523b70d1ac362478a740bf9b93244a0de2d5167566cd59205307b47e90459725
SSDEEP

98304:Ugj+U99QmwYOxycJNUPD4ms2/opKhkQSSumklLj4EyhHh5ZKOqzPlTV7TBx7mmXK:Rz96YOFNa+8ruVlLHEHhBcJ9Rkvn

Score

1^/10

Malware Config

Signatures

Files

870b121103fc1b0e22c36e1d35105e80_NeikiAnalytics
.exe windows:5 windows x86 arch:x86

eeea431e1866fc459b16fed81a707ac6

Code Sign

04:00:00:00:00:01:15:4b:5a:c3:94
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

01/09/1998, 12:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

23/08/2013, 00:00

Not After

23/09/2024, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:05:2c:9a:90:c9:c1:89:a8:95:59:f9:47:bb:69:c9:ff
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

29/07/2013, 15:59

Not After

23/11/2015, 15:31

Subject

CN=Rock Hippo Productions Ltd.,O=Rock Hippo Productions Ltd.,L=Markham,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e3:fd:f0:7a:78:79:2e:38:5f:3b:57:e3:54:bc:f4:e6:61:f7:f7:7e
Signer

Actual PE Digest

e3:fd:f0:7a:78:79:2e:38:5f:3b:57:e3:54:bc:f4:e6:61:f7:f7:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetCommandLineA
HeapAlloc
HeapFree
LoadLibraryA
GetVersionExA
FreeLibrary

user32

MessageBoxA

imm32

ImmSetCompositionWindow

Exports

Exports

fcEXP

Sections

Size: 4.5MB - Virtual size: 17.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 386KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

knqqrwoh
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

njncfhsi
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

njncfhsi
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

eeea431e1866fc459b16fed81a707ac6

Code Sign

04:00:00:00:00:01:15:4b:5a:c3:94Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45Certificate

Extended Key Usages

Key Usages

11:21:05:2c:9a:90:c9:c1:89:a8:95:59:f9:47:bb:69:c9:ffCertificate

Extended Key Usages

Key Usages

e3:fd:f0:7a:78:79:2e:38:5f:3b:57:e3:54:bc:f4:e6:61:f7:f7:7eSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

imm32

Exports

Exports

Sections

Size: 4.5MB - Virtual size: 17.7MB

.rsrc Size: 46KB - Virtual size: 386KB

.idata Size: 512B - Virtual size: 4KB

Size: 512B - Virtual size: 2.1MB

knqqrwoh Size: 1.6MB - Virtual size: 1.6MB

njncfhsi Size: 512B - Virtual size: 4KB

njncfhsi Size: 3KB - Virtual size: 4KB

.data Size: - Virtual size: 4KB

04:00:00:00:00:01:15:4b:5a:c3:94
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

11:21:05:2c:9a:90:c9:c1:89:a8:95:59:f9:47:bb:69:c9:ff
Certificate

e3:fd:f0:7a:78:79:2e:38:5f:3b:57:e3:54:bc:f4:e6:61:f7:f7:7e
Signer

.rsrc
Size: 46KB - Virtual size: 386KB

.idata
Size: 512B - Virtual size: 4KB

knqqrwoh
Size: 1.6MB - Virtual size: 1.6MB

njncfhsi
Size: 512B - Virtual size: 4KB

njncfhsi
Size: 3KB - Virtual size: 4KB

.data
Size: - Virtual size: 4KB