4459bbb4e7c17ee49c473f37b0416ff0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

4459bbb4e7c17ee49c473f37b0416ff0_NeikiAnalytics
Size

202KB
MD5

4459bbb4e7c17ee49c473f37b0416ff0
SHA1

cc7f677f88bfa7157eb662c5ebbf11dd65660373
SHA256

cd3a4df6551691be0913dc588792c5dce86de9819672058b58a439a677f8dd71
SHA512

58cd956ac64d3a4a6e537a13da86a784e0af0c09aae29432d2b27fbc66ed7c7709b6242473f700c0eafbc1045035e0d5ba680166a817bc528cdda6d2c1e4d1e1
SSDEEP

6144:P9LziDQE9aWNUSXvOpLxGu5QS8XNaZiAvOyh2/j5ggu1FTLegttye5Sg9hQezkzE:P9nE8WNUSXvALxGu5QS8XsZiAvOyh2/A

Score

1^/10

Malware Config

Signatures

Files

4459bbb4e7c17ee49c473f37b0416ff0_NeikiAnalytics
.dll windows:6 windows x64 arch:x64

b47a35e117d942f7271e035b094abcfc

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:10:58:84:eb:95:9d:3b:c8:b9:94:f9:18:a7:b6:ee
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2020, 00:00

Not After

11/01/2022, 12:00

Subject

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US,1.2.840.113549.1.9.1=#0c14706b6961646d5f7573406f7261636c652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

99:60:3b:6f:a5:27:c7:c6:3a:ba:21:0a:15:3f:11:0c:bb:d7:52:c6:07:fb:7d:b7:3d:6f:e5:40:3c:3c:1b:5c
Signer

Actual PE Digest

99:60:3b:6f:a5:27:c7:c6:3a:ba:21:0a:15:3f:11:0c:bb:d7:52:c6:07:fb:7d:b7:3d:6f:e5:40:3c:3c:1b:5c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u301\1513\build\windows-amd64\jdk\objs\libjdwp\jdwp.pdb

Imports

kernel32

GetProcAddress
LoadLibraryA
GetCurrentThreadId
CreateProcessA
GetLastError
FormatMessageA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead

vcruntime140

memset
longjmp
memcpy
strchr
strrchr
__intrinsic_setjmp
__C_specific_handler
__std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsprintf
setvbuf
fopen
fclose
fflush

api-ms-win-crt-string-l1-1-0

strtok_s
strcpy
strlen
isdigit
strcmp
strncmp
_strdup
strncpy
strcat

api-ms-win-crt-utility-l1-1-0

abs

api-ms-win-crt-runtime-l1-1-0

exit
_initterm
_initterm_e
_getpid
_crt_atexit
_sleep
_errno
_execute_onexit_table
strerror
_cexit
abort
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll

api-ms-win-crt-convert-l1-1-0

atol
strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_access

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-time-l1-1-0

_localtime64
_time64
strftime

Exports

Exports

Agent_OnLoad
Agent_OnUnload

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b47a35e117d942f7271e035b094abcfc

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

09:10:58:84:eb:95:9d:3b:c8:b9:94:f9:18:a7:b6:eeCertificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

99:60:3b:6f:a5:27:c7:c6:3a:ba:21:0a:15:3f:11:0c:bb:d7:52:c6:07:fb:7d:b7:3d:6f:e5:40:3c:3c:1b:5cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 153KB - Virtual size: 153KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 1KB - Virtual size: 4KB

.pdata Size: 7KB - Virtual size: 6KB

.rsrc Size: 1024B - Virtual size: 920B

.reloc Size: 512B - Virtual size: 224B

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

09:10:58:84:eb:95:9d:3b:c8:b9:94:f9:18:a7:b6:ee
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

99:60:3b:6f:a5:27:c7:c6:3a:ba:21:0a:15:3f:11:0c:bb:d7:52:c6:07:fb:7d:b7:3d:6f:e5:40:3c:3c:1b:5c
Signer

.text
Size: 153KB - Virtual size: 153KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 1KB - Virtual size: 4KB

.pdata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 512B - Virtual size: 224B