de3356fde77fee58fcc1849a6f093860_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

de3356fde77fee58fcc1849a6f093860_NeikiAnalytics
Size

53KB
MD5

de3356fde77fee58fcc1849a6f093860
SHA1

1b6f2be0ccee509145f2d9722b491c3cbbc0c573
SHA256

a3c6ae5c416ac73de893cb3d32366bfab9737b0755decc6e9928a41f8118026a
SHA512

a94a797492c3579b50b69184ccdc5f262c4e4ada042db254f324d9b0444666520908031f1c02a1cad80c34b58687dc752db1be7971217bd3a776588ddb67146a
SSDEEP

384:4lg7wiPYggOQ9FSFgHg3ud4Gi+IKopon+oqwee0fgjPKVeILCeq5y5mDqEkHo462:40Y/CmA3udB7I2QZu3smDYHo4rZ

Score

1^/10

Malware Config

Signatures

Files

de3356fde77fee58fcc1849a6f093860_NeikiAnalytics
.exe windows:4 windows x86 arch:x86

3ee545fc6dbdedfb438b19bf0015d734

Code Sign

67:99:3f:ae:7b:b3:48:46:75:85:bf:af:e1:4f:e2:b9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

01/12/2011, 00:00

Not After

11/12/2013, 23:59

Subject

CN=EAZ SOLUTION\, INC.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=EAZ SOLUTION\, INC.,L=Richardson,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:c8:77:6f:95:2d:4f:c1:7d:58:ff:dc:53:58:6a:3d:ad:e1:f7:10
Signer

Actual PE Digest

43:c8:77:6f:95:2d:4f:c1:7d:58:ff:dc:53:58:6a:3d:ad:e1:f7:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
lstrlenA
FormatMessageA
SetConsoleCtrlHandler
GetStringTypeA
FlushFileBuffers
SetStdHandle
GetOEMCP
GetLastError
OutputDebugStringA
LoadLibraryA
GetVersionExA
GetModuleFileNameA
lstrcmpiA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
Sleep
GetCurrentThreadId
CreateThread
GetStringTypeW
GetACP
GetCPInfo
ExitProcess
TerminateProcess
GetStartupInfoA
GetCommandLineA
GetVersion
HeapReAlloc
HeapAlloc
HeapSize
HeapFree
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
VirtualAlloc
SetFilePointer
MultiByteToWideChar
LCMapStringA
LCMapStringW
CloseHandle

user32

MessageBoxA
PostThreadMessageA
GetMessageA
DispatchMessageA

advapi32

OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

client

_ClientThread

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3ee545fc6dbdedfb438b19bf0015d734

Code Sign

67:99:3f:ae:7b:b3:48:46:75:85:bf:af:e1:4f:e2:b9Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

43:c8:77:6f:95:2d:4f:c1:7d:58:ff:dc:53:58:6a:3d:ad:e1:f7:10Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

client

Sections

.text Size: 28KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 17KB

67:99:3f:ae:7b:b3:48:46:75:85:bf:af:e1:4f:e2:b9
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

43:c8:77:6f:95:2d:4f:c1:7d:58:ff:dc:53:58:6a:3d:ad:e1:f7:10
Signer

.text
Size: 28KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 17KB