d8d0c89f362cc63169a882e922024b60_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

d8d0c89f362cc63169a882e922024b60_NeikiAnalytics.exe
Size

36KB
MD5

d8d0c89f362cc63169a882e922024b60
SHA1

da2c62c53ce3d6a44a582bb662aa5e9b532f5fba
SHA256

9b89b7a9d7d726c30b186acd29ca3dad39892f05cfb0d2e6f9fd930fb1c4aee5
SHA512

9b32e87e4dd46db61e5365ef394e2522fe17ac8b737e188f69777b9312ea794f492f7e38f5cae8aef0259e1834f7aa12be050e39abe15a4d752fb14ad0361311
SSDEEP

384:bnJJx3T71CkAdAjEFaDCapHWbHFq+IQxMLFkfyHlQHKgVITo8TZsHLUJ1/X8JN7e:bJJgdkIblqQuqSXPMG/c3hWLT

Score

1^/10

Malware Config

Signatures

Files

d8d0c89f362cc63169a882e922024b60_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

7a0efa3383a24d8843ffe7a2b07b12d9

Code Sign

03:c6:ab:dd:e7:aa:44:0b:c1:99:0a:06:d5:34:89:db
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/03/2017, 00:00

Not After

20/03/2019, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Photoshop\, Bridge,O=Adobe Systems Incorporated,POSTALCODE=95110,STREET=345 Park Avenue,L=San Jose,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

99:40:8b:85:91:be:3d:00:18:46:b5:bd:b3:a8:bc:1d:a4:63:d1:3a:37:69:ac:3f:e1:58:a6:2a:83:a3:81:22
Signer

Actual PE Digest

99:40:8b:85:91:be:3d:00:18:46:b5:bd:b3:a8:bc:1d:a4:63:d1:3a:37:69:ac:3f:e1:58:a6:2a:83:a3:81:22

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\jslave\workspace\CEP_9.2.1\P\omnius\csxs\v9_2_1\builds\native\binaries\windows\x64\Release\PlugPlugExternalObject.pdb

Imports

kernel32

GetModuleFileNameW
LoadLibraryW
GetProcAddress
FreeLibrary
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent
RtlCaptureContext

msvcp140

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_BADOFF@std@@3_JB
?_Xbad_alloc@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

__CxxFrameHandler3
memcpy
memset
__std_type_info_destroy_list
_CxxThrowException
__std_exception_copy
__C_specific_handler
wcsrchr
__std_exception_destroy
memmove

api-ms-win-crt-runtime-l1-1-0

_cexit
_seh_filter_dll
_errno
_crt_atexit
_execute_onexit_table
_initterm_e
_initterm
_configure_narrow_argv
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_initialize_narrow_environment
_invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

wcsncpy_s
wcscat_s
strcmp

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

Exports

Exports

ESClientInterface
ESFreeMem
ESGetVersion
ESInitialize
ESMallocMem
ESTerminate

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7a0efa3383a24d8843ffe7a2b07b12d9

Code Sign

03:c6:ab:dd:e7:aa:44:0b:c1:99:0a:06:d5:34:89:dbCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

99:40:8b:85:91:be:3d:00:18:46:b5:bd:b3:a8:bc:1d:a4:63:d1:3a:37:69:ac:3f:e1:58:a6:2a:83:a3:81:22Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 12KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 44B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 140B

03:c6:ab:dd:e7:aa:44:0b:c1:99:0a:06:d5:34:89:db
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

99:40:8b:85:91:be:3d:00:18:46:b5:bd:b3:a8:bc:1d:a4:63:d1:3a:37:69:ac:3f:e1:58:a6:2a:83:a3:81:22
Signer

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 44B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 140B