936f63805f08bec14c117cff0d5f98d0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

936f63805f08bec14c117cff0d5f98d0_NeikiAnalytics.exe
Size

587KB
MD5

936f63805f08bec14c117cff0d5f98d0
SHA1

41e17d9ad1e71d989fa9069d95b23a0ac070bc4c
SHA256

d96694a62b86e5797032034d9e3a1fad686e4190462d5a2e5ef46de00ef6c685
SHA512

b4100f4916a26373a049e04cf5f5f8248d6855ee7bd4fd12c2fc7799200867830bea18207c8f8cba2b360189db40a3a9961a8329e7fff1e6670dee7ea1b39350
SSDEEP

12288:LurUnHOznXsLTgfziSXK9K4zn21sw1BEJWAelbs2P9qn62BjvrEH7uu:LurUnHmsHs1Aeln9+6grEH7J

Score

1^/10

Malware Config

Signatures

Files

936f63805f08bec14c117cff0d5f98d0_NeikiAnalytics.exe
.exe windows:0 windows x86 arch:x86

Code Sign

61:04:ca:69:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/06/2007, 22:03

Not After

05/06/2012, 22:13

Subject

CN=Microsoft Time-Stamp Service,OU=nCipher DSE ESN:A5B0-CDE0-DC94,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:01:c6:c1:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 20:39

Not After

22/01/2010, 20:49

Subject

CN=Microsoft Windows,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:07:02:dc:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

15/09/2005, 21:55

Not After

15/03/2016, 22:05

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

af:4d:29:d9:75:18:45:0c:09:65:2b:af:32:30:b1:ae:dc:df:3a:0b
Signer

Actual PE Digest

af:4d:29:d9:75:18:45:0c:09:65:2b:af:32:30:b1:ae:dc:df:3a:0b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

bootmgr.pdb

Sections

.text
Size: 330KB - Virtual size: 329KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGER32C
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGER32R
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INITDATA
Size: 512B - Virtual size: 5B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEDATA
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

61:04:ca:69:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:01:c6:c1:00:00:00:00:00:07Certificate

Extended Key Usages

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:07:02:dc:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

af:4d:29:d9:75:18:45:0c:09:65:2b:af:32:30:b1:ae:dc:df:3a:0bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Sections

.text Size: 330KB - Virtual size: 329KB

PAGER32C Size: 34KB - Virtual size: 33KB

PAGE Size: 15KB - Virtual size: 14KB

.rdata Size: 42KB - Virtual size: 42KB

.data Size: 4KB - Virtual size: 168KB

PAGER32R Size: 1024B - Virtual size: 896B

INITDATA Size: 512B - Virtual size: 5B

PAGEDATA Size: 512B - Virtual size: 1B

.rsrc Size: 75KB - Virtual size: 75KB

61:04:ca:69:00:00:00:00:00:08
Certificate

61:01:c6:c1:00:00:00:00:00:07
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:07:02:dc:00:00:00:00:00:0b
Certificate

af:4d:29:d9:75:18:45:0c:09:65:2b:af:32:30:b1:ae:dc:df:3a:0b
Signer

.text
Size: 330KB - Virtual size: 329KB

PAGER32C
Size: 34KB - Virtual size: 33KB

PAGE
Size: 15KB - Virtual size: 14KB

.rdata
Size: 42KB - Virtual size: 42KB

.data
Size: 4KB - Virtual size: 168KB

PAGER32R
Size: 1024B - Virtual size: 896B

INITDATA
Size: 512B - Virtual size: 5B

PAGEDATA
Size: 512B - Virtual size: 1B

.rsrc
Size: 75KB - Virtual size: 75KB