7a457655c303636df512657ad0ee3420_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7a457655c303636df512657ad0ee3420_NeikiAnalytics.exe
Size

3.6MB
MD5

7a457655c303636df512657ad0ee3420
SHA1

303d29bfb832d5a996f019c9876c745a434a38a3
SHA256

c622d88e700eeda8dba4b27d0712a765f5e25af385e36696c75936d96e400769
SHA512

072d9cda4d4a99261390e27eebb26ef99cd7ff6a316ff29c177eac3b567c371d446e281c3e489bdb841060d8540d305a8e0eded92a2ff0992d5ba526300db823
SSDEEP

49152:LiA3v32fjIqdLl8/WlRLuJwn/5I0a1fsTkW5CSHc8y8cXKk6VX3ECo:LLv32fnLSma1CW8HcXh0S

Score

1^/10

Malware Config

Signatures

Files

7a457655c303636df512657ad0ee3420_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

63e0f3e462c73e454c4ad90ac2c02d00

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:d2:d2:68:c7:7c:c3:3a:aa:da:c9:5d:ca:ff:11:bd:c0:26:ec:43
Signer

Actual PE Digest

06:d2:d2:68:c7:7c:c3:3a:aa:da:c9:5d:ca:ff:11:bd:c0:26:ec:43

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\work\SE5\360se5\branches\se5_errpage\bin\360SE.pdb

Imports

kernel32

lstrlenA
InterlockedIncrement
GetSystemTimeAsFileTime
GetSystemInfo
CreateEventW
SetEvent
WaitForSingleObject
Sleep
IsBadReadPtr
IsBadWritePtr
TlsSetValue
GetTickCount
WaitForMultipleObjects
CancelWaitableTimer
ResetEvent
GetTempPathW
GetTempFileNameW
CreateWaitableTimerW
SetWaitableTimer
GetDiskFreeSpaceExW
SetEndOfFile
TlsAlloc
TlsFree
DeleteFileW
GetModuleFileNameW
GetShortPathNameW
FindFirstFileW
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
FindClose
GetUserDefaultLangID
FileTimeToSystemTime
FileTimeToLocalFileTime
FindResourceW
LoadResource
SizeofResource
LockResource
FreeResource
LocalFree
GetFileAttributesExW
CopyFileW
GetSystemTime
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
LocalAlloc
GlobalFree
OpenProcess
GetVersionExW
GetModuleHandleA
SetProcessWorkingSetSize
ExitProcess
TerminateProcess
GetPrivateProfileStringW
GetWindowsDirectoryW
MoveFileExW
GetFileTime
SetErrorMode
LoadLibraryExW
HeapAlloc
GetProcessHeap
HeapFree
GetProcessTimes
GlobalAddAtomW
GlobalDeleteAtom
GetSystemDirectoryW
RaiseException
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
VirtualFreeEx
SetThreadPriority
GetSystemDefaultLangID
GetPrivateProfileIntW
SetCurrentDirectoryW
TlsGetValue
OutputDebugStringW
GetCommandLineW
CreateMutexW
OpenThread
WritePrivateProfileStringW
OpenFileMappingW
GetExitCodeProcess
TerminateThread
GetLocalTime
DeviceIoControl
CreateRemoteThread
CreateThread
lstrcpyW
lstrcatW
OpenEventW
GlobalSize
lstrcmpA
SetPriorityClass
GetVersion
EnumResourceLanguagesW
lstrcpynW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
lstrcmpiA
ExpandEnvironmentStringsW
HeapCreate
DeleteCriticalSection
CompareStringW
lstrcmpW
HeapReAlloc
FormatMessageW
MoveFileW
lstrcmpiW
OpenMutexW
GetPrivateProfileStringA
CompareFileTime
FindResourceExW
DebugBreak
lstrlenW
InterlockedDecrement
LoadLibraryW
SetFileTime
CreateDirectoryW
IsProcessorFeaturePresent
SetEnvironmentVariableA
CompareStringA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
LCMapStringA
LCMapStringW
HeapSize
GetConsoleMode
GetConsoleCP
SetHandleCount
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
HeapDestroy
RtlUnwind
GetStartupInfoA
GetCommandLineA
IsDebuggerPresent
ExitThread
InterlockedExchange
GetCurrentDirectoryW
SystemTimeToFileTime
GetFileType
DuplicateHandle
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
ReadFile
VirtualFree
LoadLibraryA
GetProcAddress
GetModuleHandleW
FreeLibrary
CloseHandle
CreateFileMappingW
WriteFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
SetLastError
SuspendThread
GetCurrentThreadId
VirtualProtect
VirtualAlloc
FlushInstructionCache
GetCurrentThread
InterlockedCompareExchange
GetCurrentProcess
VirtualQuery
SetThreadContext
GetThreadContext
DisableThreadLibraryCalls
ResumeThread
WriteProcessMemory
VirtualAllocEx
GetLastError
ReadProcessMemory
VirtualQueryEx
GetLongPathNameW
CreateProcessW

user32

GetMenuItemRect
MenuItemFromPoint
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
GetWindowPlacement
SetWindowPlacement
SendNotifyMessageW
RedrawWindow
GetWindowRgn
IsMenu
MonitorFromRect
UpdateLayeredWindow
GetDoubleClickTime
IntersectRect
GetActiveWindow
PrintWindow
InvalidateRgn
GetWindowTextLengthW
SetLayeredWindowAttributes
EnumWindows
MsgWaitForMultipleObjects
AllowSetForegroundWindow
LoadIconW
GetFocus
EndMenu
IsChild
GetWindowLongW
IsZoomed
TrackMouseEvent
SetWindowLongW
SendMessageCallbackW
RegisterClassExW
GetClassInfoExW
DestroyWindow
CreateWindowExW
GetClientRect
GetWindow
SetCapture
SetMessageExtraInfo
GetMenuInfo
SetTimer
GetMenu
DestroyMenu
ClientToScreen
InsertMenuW
CreatePopupMenu
SetCursor
LoadCursorW
PtInRect
ReleaseCapture
WindowFromPoint
GetCursorPos
GetKeyState
IsWindowVisible
InflateRect
EndPaint
BeginPaint
DefWindowProcW
LoadImageW
DrawIconEx
RegisterClipboardFormatW
CharLowerW
WaitForInputIdle
EqualRect
LockSetForegroundWindow
IsWindowEnabled
SetFocus
SetWindowRgn
InSendMessageEx
SetPropW
SetParent
EnumThreadWindows
GetWindowTextW
CharLowerA
GetAncestor
IsDlgButtonChecked
EndDialog
DrawIcon
MapWindowPoints
CheckDlgButton
GetDlgItem
SetDlgItemTextW
SetMenuInfo
GetSysColor
GetMenuItemID
GetMenuState
GetMenuItemInfoW
EnableMenuItem
MoveWindow
IsHungAppWindow
SetWindowTextW
wsprintfW
InsertMenuItemW
CheckMenuItem
DeleteMenu
GetMenuStringW
GetGUIThreadInfo
GetSubMenu
LoadMenuW
GetDlgItemTextW
keybd_event
SetMenuItemInfoW
GetKeyboardLayout
ActivateKeyboardLayout
RemovePropW
UpdateWindow
MessageBoxIndirectW
CreateWindowExA
TrackPopupMenuEx
TrackPopupMenu
CreateDialogIndirectParamW
RegisterWindowMessageW
LoadStringA
GetPropW
GetWindowDC
RemoveMenu
GetMenuItemCount
SystemParametersInfoW
GetMessageW
CallWindowProcW
TranslateAcceleratorW
DestroyAcceleratorTable
CopyAcceleratorTableW
CreateAcceleratorTableW
LoadAcceleratorsW
SetActiveWindow
EnableWindow
KillTimer
ReplyMessage
DialogBoxParamW
MessageBoxW
wvsprintfW
CharNextW
CharNextA
GetParent
GetWindowRect
SetWindowPos
UnregisterHotKey
RegisterHotKey
SendMessageTimeoutW
GetClassNameW
IsWindow
SubtractRect
PostQuitMessage
InvalidateRect
FindWindowExW
DispatchMessageW
TranslateMessage
PeekMessageW
SendMessageW
IsIconic
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
FindWindowW
MonitorFromPoint
GetMonitorInfoW
MonitorFromWindow
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
DrawTextW
MapVirtualKeyW
SetForegroundWindow
ShowWindow
DestroyIcon
GetDesktopWindow
PostMessageW
LoadStringW
CopyRect
ScreenToClient
GetMessagePos
ReleaseDC
GetDC
OffsetRect
FillRect
GetSystemMetrics
UnregisterClassA
WindowFromDC
CreateIconFromResourceEx
GetIconInfo
GetCapture
DrawFrameControl
DrawFocusRect
GetSystemMenu
PostThreadMessageW

gdi32

OffsetRgn
GetStockObject
CreateCompatibleDC
SelectObject
DeleteDC
CreateDIBSection
CreateCompatibleBitmap
BitBlt
GetObjectW
GetDeviceCaps
GetDIBits
EnumFontsW
CreateFontIndirectW
CreateSolidBrush
SetBkMode
SetTextColor
CreateRectRgnIndirect
SetBitmapBits
CreatePen
Rectangle
MoveToEx
LineTo
SetStretchBltMode
StretchBlt
GetBitmapBits
GetTextExtentPoint32W
FillRgn
CombineRgn
RestoreDC
IntersectClipRect
SaveDC
ExcludeClipRect
CreateRoundRectRgn
EqualRgn
CreateRectRgn
RectVisible
OffsetViewportOrgEx
GetObjectType
CreatePatternBrush
SetViewportOrgEx
GdiAlphaBlend
SetBrushOrgEx
GetRandomRgn
GetLayout
SetLayout
GetCurrentObject
LPtoDP
SelectClipRgn
DeleteObject

shell32

SHGetSpecialFolderPathA
ShellExecuteExW
SHChangeNotify
ExtractIconExW
DragQueryFileW
Shell_NotifyIconW
ord680
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHAppBarMessage
ShellExecuteW
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetMalloc
SHGetFolderPathW
SHFileOperationW

shlwapi

UrlCombineA
SHStrDupW
PathCombineA
UrlUnescapeW
StrTrimW
SHEnumKeyExW
ord154
StrCmpW
SHGetValueA
StrChrIA
SHRegGetPathW
UrlCanonicalizeW
PathMatchSpecW
StrChrW
SHDeleteValueW
SHDeleteKeyW
StrToIntW
PathMatchSpecA
StrRStrIA
UrlIsOpaqueW
PathIsDirectoryW
SHSetValueW
StrRStrIW
UrlGetPartW
StrCmpIW
PathRemoveFileSpecW
StrCmpNIW
PathFindFileNameW
StrCmpNW
PathFindExtensionW
StrRetToBufW
PathFindFileNameA
UrlEscapeW
StrStrW
StrCatW
PathRenameExtensionW
PathAppendW
SHGetValueW
PathIsURLW
PathIsRootW
PathCombineW
PathFileExistsW
PathGetDriveNumberW
StrStrIW
StrStrIA
GetMenuPosFromID

psapi

GetModuleFileNameExW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

inet_addr

Exports

Exports

SetIEDocType

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 428KB - Virtual size: 427KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 370KB - Virtual size: 923KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.taihang
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 631KB - Virtual size: 630KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63e0f3e462c73e454c4ad90ac2c02d00

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

06:d2:d2:68:c7:7c:c3:3a:aa:da:c9:5d:ca:ff:11:bd:c0:26:ec:43Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

shlwapi

psapi

version

ws2_32

Exports

Exports

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 428KB - Virtual size: 427KB

.data Size: 370KB - Virtual size: 923KB

.taihang Size: 60KB - Virtual size: 60KB

.rsrc Size: 631KB - Virtual size: 630KB

.reloc Size: 156KB - Virtual size: 156KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

06:d2:d2:68:c7:7c:c3:3a:aa:da:c9:5d:ca:ff:11:bd:c0:26:ec:43
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 428KB - Virtual size: 427KB

.data
Size: 370KB - Virtual size: 923KB

.taihang
Size: 60KB - Virtual size: 60KB

.rsrc
Size: 631KB - Virtual size: 630KB

.reloc
Size: 156KB - Virtual size: 156KB