0ce2f838d045b3082d1bf7dba9be7918aa459a728669050ea9597a2be12d051c_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

0ce2f838d045b3082d1bf7dba9be7918aa459a728669050ea9597a2be12d051c_NeikiAnalytics
Size

1.2MB
MD5

38579bb81a2e4b868f9edf743441f990
SHA1

1057833bd82207216cd7293afacc9bca22fcde0d
SHA256

0ce2f838d045b3082d1bf7dba9be7918aa459a728669050ea9597a2be12d051c
SHA512

b80e8f09ffa0fdf0e2b3d993ac01f604d35f383683ed8bdff22b1893eb270204720d131032c10a00b21201e7c58888a6b7677591e1a57315d8585e1d92eca2ef
SSDEEP

24576:Q4Oy58Ia1SBA6THdGKHBmaIH/2fIXO/fsOfNLNfsOfNLSblSAf36fI:Q4Oy58Ia1SBA6TkKhmaIH/2fIXO/fsOa

Score

1^/10

Malware Config

Signatures

Files

0ce2f838d045b3082d1bf7dba9be7918aa459a728669050ea9597a2be12d051c_NeikiAnalytics
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

51:f2:bf:74:34:21:e1:be:2d:9a:39:89:74:31:c3:80
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

21/08/2014, 00:00

Not After

09/10/2016, 23:59

Subject

CN=PhysioTools Oy,O=PhysioTools Oy,L=Tampere,ST=Lansi-Suomi,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:6d:8b:7b:6c:5c:8a:1c:30:81:9d:5a:e1:43:9a:34
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

03/02/2016, 00:00

Not After

09/10/2016, 23:59

Subject

CN=PhysioTools Oy,O=PhysioTools Oy,L=Tampere,ST=Lansi-Suomi,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3a:69:27:c6:5f:1e:3b:ce:eb:23:48:1d:49:7c:87:5c:6a:98:c7:b6:34:d1:e7:1e:22:e0:b3:45:8e:56:c9:89
Signer

Actual PE Digest

3a:69:27:c6:5f:1e:3b:ce:eb:23:48:1d:49:7c:87:5c:6a:98:c7:b6:34:d1:e7:1e:22:e0:b3:45:8e:56:c9:89

Digest Algorithm

sha256

PE Digest Matches

true

9f:90:bd:74:1e:4a:c0:bf:ad:f5:00:cf:f2:f9:1e:d5:f1:b1:6a:f1
Signer

Actual PE Digest

9f:90:bd:74:1e:4a:c0:bf:ad:f5:00:cf:f2:f9:1e:d5:f1:b1:6a:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB Paths

D:\Projects\PhysioTools\TON\Utils\DownloadManager\DownloadManager2\bin\Release\Merged\DownloadManager.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

51:f2:bf:74:34:21:e1:be:2d:9a:39:89:74:31:c3:80Certificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

2c:6d:8b:7b:6c:5c:8a:1c:30:81:9d:5a:e1:43:9a:34Certificate

Extended Key Usages

Key Usages

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9eCertificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

3a:69:27:c6:5f:1e:3b:ce:eb:23:48:1d:49:7c:87:5c:6a:98:c7:b6:34:d1:e7:1e:22:e0:b3:45:8e:56:c9:89Signer

9f:90:bd:74:1e:4a:c0:bf:ad:f5:00:cf:f2:f9:1e:d5:f1:b1:6a:f1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 12B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

51:f2:bf:74:34:21:e1:be:2d:9a:39:89:74:31:c3:80
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

2c:6d:8b:7b:6c:5c:8a:1c:30:81:9d:5a:e1:43:9a:34
Certificate

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

3a:69:27:c6:5f:1e:3b:ce:eb:23:48:1d:49:7c:87:5c:6a:98:c7:b6:34:d1:e7:1e:22:e0:b3:45:8e:56:c9:89
Signer

9f:90:bd:74:1e:4a:c0:bf:ad:f5:00:cf:f2:f9:1e:d5:f1:b1:6a:f1
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 12B