5a7f0157938a5eff9ee28d1383d39080_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5a7f0157938a5eff9ee28d1383d39080_NeikiAnalytics.exe
Size

475KB
MD5

5a7f0157938a5eff9ee28d1383d39080
SHA1

52f45ded094cc75f4d90cb94b8b375ccb2d11012
SHA256

bcbef5ba9a579c2d81596a9e9cf1d94183c5298d6d9bdf19397b94279a142856
SHA512

1b0b0cb156a586cbb5222e302c65982f2240ce99e0202ed67b334eee58dc1535f891ea8d3ac232d168d39d273773ba635e0c3e28f06c700dcea107d87c66be08
SSDEEP

6144:2kYzS8PUThOIUCgDrqcHSs078QXnMPJlQXx1bJY0zrDf+3gEViywi4SK0hsfqqB:259PUTtgfqcH9pJlMv+lRwia

Score

1^/10

Malware Config

Signatures

Files

5a7f0157938a5eff9ee28d1383d39080_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

6081abd02e06ad157363bbec38866d39

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f7:11:8a:81:cb:2f:3a:39:12:76:d3:bc:ee:f5:ca:ce:ba:80:9c:4d
Signer

Actual PE Digest

f7:11:8a:81:cb:2f:3a:39:12:76:d3:bc:ee:f5:ca:ce:ba:80:9c:4d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ngen.pdb

Imports

mscoree

GetRequestedRuntimeInfo
GetRequestedRuntimeVersion
CorBindToRuntimeEx
GetCORVersion
LoadLibraryShim
GetRealProcAddress
CorGetSvc
GetCORSystemDirectory

msvcr80

_vsnprintf
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
free
malloc
_putws
_flushall
wcstoul
towupper
memmove
_vsnprintf_s
_errno
wcsncpy_s
wcscpy_s
strcpy_s
wcsncmp
strncmp
_vsnwprintf_s
strchr
_CxxThrowException
_wtoi
_wcsicmp
tolower
_wcsnicmp
exit
_purecall
memset
wcscat_s
__CxxFrameHandler3
memcpy
_vswprintf_c_l

advapi32

RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey

kernel32

GetEnvironmentVariableW
GetEnvironmentVariableA
GetCurrentDirectoryW
GetCurrentDirectoryA
GetFileAttributesExW
GetFileAttributesExA
GetFileAttributesW
GetFileAttributesA
CreateEventW
CreateEventA
CreateMutexW
LocalAlloc
FormatMessageA
FormatMessageW
CreateProcessA
CreateProcessW
DebugBreak
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
TlsSetValue
TlsAlloc
TlsFree
HeapAlloc
GetProcessHeap
HeapFree
WaitForSingleObjectEx
ReleaseMutex
SleepEx
VirtualAlloc
VirtualFree
VirtualQuery
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
InterlockedExchange
Sleep
SetUnhandledExceptionFilter
GetTickCount
UnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameA
CloseHandle
WaitForSingleObject
GetCurrentProcessId
GetLocalTime
WriteFile
GetStdHandle
RaiseException
GetConsoleOutputCP
SetErrorMode
SetLastError
GetLastError
TlsGetValue
InterlockedCompareExchange
GetModuleHandleA
FreeLibrary
InterlockedIncrement
InterlockedDecrement
lstrlenW
GetCurrentProcess
LocalFree
MultiByteToWideChar
IsDBCSLeadByte
GetCPInfo
GetACP
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFilePointer
GetVersionExA
GetModuleHandleW
WideCharToMultiByte
TerminateProcess
LoadLibraryExA
LoadLibraryExW
GetFullPathNameA
GetFullPathNameW
CreateMutexA
GetModuleFileNameW
CreateFileA
CreateFileW
CopyFileA
DeleteFileA
MoveFileExW
CreateSemaphoreA
CreateSemaphoreW
LCMapStringA
LCMapStringW
GetVersionExW
OutputDebugStringA
OutputDebugStringW

oleaut32

SetErrorInfo
SysAllocString
SysFreeString

user32

LoadStringA
LoadStringW

Sections

.text
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6081abd02e06ad157363bbec38866d39

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:0f:78:4d:00:00:00:00:00:03Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

f7:11:8a:81:cb:2f:3a:39:12:76:d3:bc:ee:f5:ca:ce:ba:80:9c:4dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

msvcr80

advapi32

kernel32

oleaut32

user32

Sections

.text Size: 87KB - Virtual size: 86KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:0f:78:4d:00:00:00:00:00:03
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

f7:11:8a:81:cb:2f:3a:39:12:76:d3:bc:ee:f5:ca:ce:ba:80:9c:4d
Signer

.text
Size: 87KB - Virtual size: 86KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB