4e87a4a174f8e2032940367ecc40a830_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

4e87a4a174f8e2032940367ecc40a830_NeikiAnalytics
Size

741KB
MD5

4e87a4a174f8e2032940367ecc40a830
SHA1

463855110c17b05c1608c2af2d3b9d7988132c54
SHA256

135b39fbbd4ed8a5713925e7c5c350d4f658279da17132cda06d698fe13d8f9c
SHA512

fcee0e3e7707174efb6e9d8301d2f0a526eff7af6aa9ddd7fe8a7399739ca2f446d2e74f552421ad6b470d78cc238d6af80145d5e57b719efe58481bbbd6eb01
SSDEEP

12288:TpN7OIZagvhvzeRwGBmi02haD5+Ncv+OaGH/vMwXgBI9ORR2n+3RFPy:TpN7OiagvZsTaD5RftXRORcn+BJy

Score

1^/10

Malware Config

Signatures

Files

4e87a4a174f8e2032940367ecc40a830_NeikiAnalytics
.exe windows:6 windows x86 arch:x86

f03fcb8c3c766793695f9da9381d2814

Code Sign

13:97:f7:a6:64:d0:a2:58:d2:fc:d6:a6:46:ad:1a:52
Certificate

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

19/09/2022, 14:03

Not After

29/08/2025, 14:53

Subject

SERIALNUMBER=91371300MABX6G2P0P,CN=Yubi Software (Linyi) Co.\, Ltd.,O=Yubi Software (Linyi) Co.\, Ltd.,L=Linyi,C=CN,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

26/03/2019, 17:44

Not After

22/03/2034, 17:44

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7
Certificate

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

19/02/2024, 16:18

Not After

16/02/2034, 16:18

Subject

CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

13/11/2019, 18:50

Not After

12/11/2034, 18:50

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:d3:53:a2:d4:0a:5a:69:e1:52:7c:22:c4:b8:c4:2d:a4:8c:7b:de:c8:60:fa:19:47:1c:32:79:2f:8e:dc:82
Signer

Actual PE Digest

90:d3:53:a2:d4:0a:5a:69:e1:52:7c:22:c4:b8:c4:2d:a4:8c:7b:de:c8:60:fa:19:47:1c:32:79:2f:8e:dc:82

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

imgdrive.pdb

Imports

kernel32

GlobalUnlock
GlobalLock
CreateThread
CreateEventW
SetEvent
WritePrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileIntW
GetTickCount
CreateMutexW
LoadLibraryA
GetDiskFreeSpaceExW
SetEnvironmentVariableA
WriteConsoleW
SetStdHandle
OutputDebugStringW
LCMapStringW
CompareStringW
LoadLibraryExW
ReadConsoleW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTimeZoneInformation
GetStringTypeW
GetFileType
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
GetOEMCP
GetACP
IsValidCodePage
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
UnhandledExceptionFilter
HeapSize
AreFileApisANSI
GetModuleHandleExW
GetSystemTimeAsFileTime
RtlUnwind
RaiseException
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
QueryDosDeviceA
lstrcmpW
FlushFileBuffers
FileTimeToDosDateTime
SystemTimeToFileTime
GetLocalTime
GetExitCodeProcess
FindResourceExW
LoadResource
LockResource
lstrcpynW
GetSystemDefaultLangID
GetVersionExA
GetTempFileNameW
GetStartupInfoW
CreateProcessW
SetUnhandledExceptionFilter
TerminateProcess
OpenProcess
GlobalMemoryStatusEx
GlobalSize
GetUserDefaultLangID
LocalFree
GetCommandLineW
SetVolumeMountPointW
DeleteVolumeMountPointW
GetVolumeNameForVolumeMountPointW
GetVolumeInformationW
GetNativeSystemInfo
CreateProcessA
GetModuleFileNameA
CreateFileA
GetTempPathA
RemoveDirectoryW
Sleep
ExitProcess
GetSystemDirectoryW
GetPrivateProfileStringW
GetWindowsDirectoryW
FreeLibrary
LoadLibraryW
MoveFileExW
GetLogicalDrives
CreateDirectoryW
GetTempPathW
GetDriveTypeW
QueryDosDeviceW
DeviceIoControl
GetLongPathNameW
SetEndOfFile
WriteFile
CreateFileW
HeapReAlloc
GetCurrentThreadId
GetCurrentProcessId
GetPrivateProfileStringA
GetFileSize
SetFilePointer
FormatMessageW
lstrcpyW
GetLastError
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetNumberFormatW
GetLocaleInfoW
GetModuleFileNameW
lstrlenW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetProcAddress
FindClose
FindNextFileW
FindFirstFileW
SetFilePointerEx
GetFileSizeEx
HeapFree
GetModuleHandleW
HeapAlloc
GetProcessHeap
ReadFile
DeleteFileW
WaitForSingleObject
CloseHandle
MulDiv
GetFullPathNameW
lstrcatW
GetCPInfo
LoadLibraryExA

user32

IsWindowEnabled
DrawTextW
OpenClipboard
GetClipboardData
CloseClipboard
GetWindowTextA
CreateDialogIndirectParamW
DialogBoxIndirectParamW
LoadMenuIndirectW
ExitWindowsEx
CallWindowProcW
SetDlgItemInt
InvalidateRect
ReleaseDC
EnableWindow
GetDlgItem
ShowWindow
SetDlgItemTextA
SetDlgItemTextW
IsIconic
GetDlgItemTextW
SendMessageW
GetMenuStringW
SendDlgItemMessageW
InflateRect
EnumChildWindows
GetComboBoxInfo
GetWindowTextLengthA
SystemParametersInfoW
RegisterHotKey
GetDC
UnregisterHotKey
GetMonitorInfoW
MonitorFromRect
GetWindowPlacement
SetMenuInfo
GetMenuInfo
GetFocus
CreateMenu
RegisterClassExW
DefWindowProcW
SetActiveWindow
PostQuitMessage
ChildWindowFromPoint
RemoveMenu
GetMenuItemID
AppendMenuW
CreateWindowExW
SetWindowTextA
LoadImageW
SetForegroundWindow
GetWindowTextW
CheckMenuRadioItem
GetCursorPos
GetMenuItemCount
SetMenu
GetMenu
RegisterWindowMessageW
FindWindowW
GetSysColorBrush
GetClassNameW
GetWindowTextLengthW
GetKeyState
GetDlgCtrlID
GetKeyNameTextW
MapVirtualKeyW
SetFocus
SetWindowTextW
GetDlgItemTextA
wsprintfA
SetWindowPos
SendMessageA
ShowCursor
GetSysColor
DestroyAcceleratorTable
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
IsWindow
CreateAcceleratorTableW
DestroyWindow
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetClientRect
MapWindowPoints
GetWindowRect
DestroyMenu
TrackPopupMenu
CheckMenuItem
CreatePopupMenu
EnableMenuItem
InsertMenuItemW
DeleteMenu
GetSubMenu
GetMessagePos
SetMenuItemInfoW
GetMenuItemInfoW
ReleaseCapture
UpdateWindow
LoadCursorW
SetCursor
SetCapture
GetDesktopWindow
ClientToScreen
GetSystemMetrics
GetParent
ScreenToClient
MessageBoxA
LoadIconW
EndDialog
PostMessageW
DrawIcon
PtInRect
GetIconInfo
EnumDisplayMonitors
GetCursorInfo
GetSystemMenu
DrawTextExW
BeginPaint
EndPaint
GetWindow
MonitorFromWindow
KillTimer
SetTimer
SetWindowLongW
GetWindowLongW
IsDlgButtonChecked
MessageBoxW
wsprintfW
CheckDlgButton

gdi32

DeleteDC
PatBlt
SetBrushOrgEx
CreatePatternBrush
CreateCompatibleDC
GetObjectW
SetBkMode
GetTextExtentPoint32W
DeleteObject
CreateDIBSection
SetTextColor
GetDeviceCaps
CreateFontIndirectW
GetStockObject
CreateCompatibleBitmap
BitBlt
CreateDCW
GetDIBits
CreatePen
GetTextExtentPointW
Rectangle
GetTextMetricsW
SelectObject
CreateBitmap

comdlg32

GetOpenFileNameW
GetSaveFileNameW

comctl32

ImageList_Destroy
ImageList_AddMasked
ImageList_Create
ord410
PropertySheetW
InitCommonControlsEx
ImageList_DragLeave
ord412
ord413
ImageList_EndDrag
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragEnter
ImageList_BeginDrag
ImageList_Draw

advapi32

RegOpenKeyExA
RegQueryValueW
RegSetValueExW
RegDeleteKeyW
RegSetValueW
RegCreateKeyW
RegOpenKeyA
RegCloseKey
RegEnumValueA
RegOpenKeyW
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSetValueExA
RegCreateKeyA
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegDeleteValueW
RegDeleteKeyExW
RegOpenKeyExW
RegCreateKeyExW
CloseServiceHandle
DeleteService
QueryServiceStatus
ControlService
OpenServiceW
OpenSCManagerW
RegQueryValueExW
RegEnumKeyW

shell32

ShellExecuteExW
SHGetSpecialFolderLocation
SHGetMalloc
Shell_NotifyIconW
DragQueryPoint
CommandLineToArgvW
ord680
ShellExecuteW
SHGetSpecialFolderPathW
SHGetFileInfoW
ord155
SHBrowseForFolderW
SHGetPathFromIDListW
SHChangeNotify
SHGetFolderPathW
DragAcceptFiles
DragFinish
DragQueryFileW

ole32

OleUninitialize
OleInitialize
StringFromGUID2
CoUninitialize
CoInitialize
CoTaskMemFree
CoCreateInstance
RevokeDragDrop
RegisterDragDrop
ReleaseStgMedium
GetHGlobalFromStream
CreateStreamOnHGlobal

oleaut32

SysFreeString
SysAllocString

shlwapi

SHDeleteKeyA
ord176
StrFormatByteSizeW
SHDeleteKeyW
PathMatchSpecW
PathCanonicalizeW

Sections

.text
Size: 409KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 158KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f03fcb8c3c766793695f9da9381d2814

Code Sign

13:97:f7:a6:64:d0:a2:58:d2:fc:d6:a6:46:ad:1a:52Certificate

Extended Key Usages

Key Usages

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04Certificate

Extended Key Usages

Key Usages

5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7Certificate

Extended Key Usages

Key Usages

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56Certificate

Extended Key Usages

Key Usages

90:d3:53:a2:d4:0a:5a:69:e1:52:7c:22:c4:b8:c4:2d:a4:8c:7b:de:c8:60:fa:19:47:1c:32:79:2f:8e:dc:82Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

comctl32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 409KB - Virtual size: 408KB

.rdata Size: 72KB - Virtual size: 71KB

.data Size: 158KB - Virtual size: 166KB

.rsrc Size: 75KB - Virtual size: 74KB

.reloc Size: 19KB - Virtual size: 18KB

13:97:f7:a6:64:d0:a2:58:d2:fc:d6:a6:46:ad:1a:52
Certificate

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04
Certificate

5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7
Certificate

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56
Certificate

90:d3:53:a2:d4:0a:5a:69:e1:52:7c:22:c4:b8:c4:2d:a4:8c:7b:de:c8:60:fa:19:47:1c:32:79:2f:8e:dc:82
Signer

.text
Size: 409KB - Virtual size: 408KB

.rdata
Size: 72KB - Virtual size: 71KB

.data
Size: 158KB - Virtual size: 166KB

.rsrc
Size: 75KB - Virtual size: 74KB

.reloc
Size: 19KB - Virtual size: 18KB