3a7a54dc711c4d05f2f93447dae8bc40_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

3a7a54dc711c4d05f2f93447dae8bc40_NeikiAnalytics.exe
Size

573KB
MD5

3a7a54dc711c4d05f2f93447dae8bc40
SHA1

f5a76c6792e99d6e5b1b107aa49f51447f138e71
SHA256

3aa5b3c939f61e538f6d1b8ff3e44341b69e9e31ff7f16bfa7edbac539c47313
SHA512

d23766ea49a1646abd86e08b351ebca1b0c5f8d44cadc3430af2cc2acd4a24e56b80c0364478b1a7e0537f0dfc3defeaab68bf85bce4395766e54cbcb8bf696f
SSDEEP

12288:k8YkydRcLxq3bz1ALWxw1HB90Ea677IiL5oAH90Bne6QubV:6kydRcLxq6L7177Iitoi+Bne6QubV

Score

1^/10

Malware Config

Signatures

Files

3a7a54dc711c4d05f2f93447dae8bc40_NeikiAnalytics.exe
.dll regsvr32 windows:4 windows x86 arch:x86

3ecf753bb4f6b60853a491da245841ba

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

31/07/2009, 00:00

Not After

30/07/2012, 23:59

Subject

CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\clientci\workspace\browser-c-dev1.2-buildonly\bdbrowser\BrowserOutput\Release\bin\syncengine.pdb

Imports

objectfactory

?GetService@Com@Util@@YGJABU_GUID@@PAPAX@Z

kernel32

CreateEventW
WaitForSingleObject
GetLastError
CloseHandle
DeleteTimerQueueEx
CreateTimerQueue
CreateTimerQueueTimer
ChangeTimerQueueTimer
MultiByteToWideChar
GetModuleFileNameW
SetEvent
lstrcmpiW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
LoadLibraryA
FreeLibrary
GlobalMemoryStatus
GetCurrentProcessId
QueryPerformanceCounter
GetTickCount
FlushConsoleInputBuffer
GetStdHandle
GetFileType
GetVersion
GetModuleHandleA
lstrlenW
GetThreadLocale
SetThreadLocale
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
RaiseException
OutputDebugStringW
GetModuleHandleW
WideCharToMultiByte
GetProcAddress
GetCurrentThreadId
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy

user32

GetProcessWindowStation
UnregisterClassA
GetDesktopWindow
MessageBoxA
GetMessageW
PostThreadMessageW
wsprintfW
CharNextW
GetUserObjectInformationW

advapi32

RegisterEventSourceA
ReportEventA
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
DeregisterEventSource

shell32

SHGetFileInfoW

ole32

CoTaskMemFree
StringFromCLSID
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

VariantClear
VariantInit
SysAllocStringLen
SysAllocString
VarUI4FromStr
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysFreeString

atl80

ord58
ord32
ord61
ord23
ord64
ord22
ord18
ord15
ord30
ord31

winhttp

WinHttpAddRequestHeaders
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpWriteData
WinHttpSetOption
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpConnect
WinHttpSetTimeouts
WinHttpOpen

msvcr80

??3@YAXPAX@Z
memset
memcpy
malloc
memcpy_s
memmove_s
_CxxThrowException
_vscwprintf
vswprintf_s
_recalloc
__CxxFrameHandler3
free
_wtoi64
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
wcscpy_s
wcsncpy_s
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_vscprintf
vsprintf_s
??_U@YAPAXI@Z
_purecall
_beginthreadex
memmove
strtoul
getenv
wcsstr
_vsnprintf
vfprintf
__iob_func
_exit
raise
realloc
strncpy
strchr
fprintf
strncmp
_strnicmp
isdigit
isspace
qsort
strcmp
_time64
tolower
fclose
ferror
fread
fwrite
fflush
fopen
_setmode
_fileno
ftell
feof
fseek
fgets
_errno
_wfopen
isxdigit
atoi
_gmtime64
isupper
sscanf
fputs
signal
_getch
sprintf
strstr
?terminate@@YAXXZ
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
??_V@YAXPAX@Z

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 380KB - Virtual size: 378KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3ecf753bb4f6b60853a491da245841ba

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8dCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

objectfactory

kernel32

user32

advapi32

shell32

ole32

oleaut32

atl80

winhttp

msvcr80

msvcp80

Exports

Exports

Sections

.text Size: 380KB - Virtual size: 378KB

.rdata Size: 140KB - Virtual size: 139KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 4KB - Virtual size: 840B

.reloc Size: 32KB - Virtual size: 29KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d
Certificate

.text
Size: 380KB - Virtual size: 378KB

.rdata
Size: 140KB - Virtual size: 139KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 840B

.reloc
Size: 32KB - Virtual size: 29KB