05282a470e56e0c6d2ce58ca324bb7d0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

05282a470e56e0c6d2ce58ca324bb7d0_NeikiAnalytics
Size

28KB
MD5

05282a470e56e0c6d2ce58ca324bb7d0
SHA1

4c314cb8972fd3e488fba103d804ff6418d0105f
SHA256

1735abe32cce0ac947761eb53a3a308e8671a0d370f75a765d60730f441299ce
SHA512

790e18fec96b3d1457c3bba059a33f6f66eb1618e538250a7d6288f17dddc73412cfd1c4e04899b004a984a4786cd42d982cce5822cd6c249123f363a9f9ba5b
SSDEEP

384:I9hl8ER7arPHYbz2mjhDX1Xo3yHIC74mdZtE0WNCEdwnaxkeSLAtCxXBhgLU8is:bMc/Qz201pKyHIC74mdXM3ZQOpis

Score

1^/10

Malware Config

Signatures

Files

05282a470e56e0c6d2ce58ca324bb7d0_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

26d64118fd5b4d97a7d3ab4e7b025bbb

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27/04/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

30/05/2020, 10:48

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

1e:86:8f:1b:42:ef:e0:41:46:f8:16:87:41:65:e1:2d
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

10/12/2018, 00:00

Not After

09/12/2020, 23:59

Subject

CN=福州奥森网络科技有限公司,O=福州奥森网络科技有限公司,POSTALCODE=350001,STREET=福建省福州市马尾区湖里路27号1#楼2-63N室（自贸试验区内）,L=福州,ST=福建,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b2:fc:9a:14:38:02:a3:5e:84:65:04:56:91:cf:58:be:24:8c:99:a3
Signer

Actual PE Digest

b2:fc:9a:14:38:02:a3:5e:84:65:04:56:91:cf:58:be:24:8c:99:a3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateProcessA
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessId
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

__dllonexit
_amsg_exit
_initterm
_iob
_lock
_onexit
_stricmp
_unlock
abort
calloc
free
fwrite
malloc
strlen
strncmp
vfprintf
wcslen

shell32

ShellExecuteA

shlwapi

PathAddBackslashA
PathFileExistsA
PathIsDirectoryA
PathRemoveFileSpecA

user32

WaitForInputIdle

Exports

Exports

luaopen_APP

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

26d64118fd5b4d97a7d3ab4e7b025bbb

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19Certificate

Extended Key Usages

Key Usages

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49Certificate

Extended Key Usages

Key Usages

1e:86:8f:1b:42:ef:e0:41:46:f8:16:87:41:65:e1:2dCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

b2:fc:9a:14:38:02:a3:5e:84:65:04:56:91:cf:58:be:24:8c:99:a3Signer

Headers

File Characteristics

Imports

kernel32

msvcrt

shell32

shlwapi

user32

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 88B

.rdata Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 1KB

.edata Size: 512B - Virtual size: 76B

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 1KB - Virtual size: 1KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

1e:86:8f:1b:42:ef:e0:41:46:f8:16:87:41:65:e1:2d
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

b2:fc:9a:14:38:02:a3:5e:84:65:04:56:91:cf:58:be:24:8c:99:a3
Signer

.text
Size: 11KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 88B

.rdata
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 76B

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 1KB - Virtual size: 1KB