0e9733a5217675b94bd6b3fde3612820_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0e9733a5217675b94bd6b3fde3612820_NeikiAnalytics.exe
Size

5.6MB
MD5

0e9733a5217675b94bd6b3fde3612820
SHA1

31bb7218fcb56a0c9bf350dd2b029994668ac7b9
SHA256

df45442b6ba39f530ae99d1f16e25d663229ba325600b058626a6bd1260e7331
SHA512

6c1cddcefd693f7468ab4fbd93932318f79db99079e5d7f8e3975c33cc26818aaa766eb06204c11e9c336b6ae66a52b9f1977b30366a97620fbdc12db6b6ff17
SSDEEP

49152:UKlQ7Vn1Z9DBRH8JN6EqU310Tp4wtoK8R96GcQkJC3vKGcZrj1CjMALnnAj0pgJD:3TyZ9C3BcfdALnAFb7sp61

Score

1^/10

Malware Config

Signatures

Files

0e9733a5217675b94bd6b3fde3612820_NeikiAnalytics.exe
.exe windows:5 windows x64 arch:x64

ab1e11f45e4dea6077d21c0039e549c3

Code Sign

04:7a:55
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:58

Not After

03/03/2024, 12:58

Subject

CN=Certum Time-Stamping Authority,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

04:7a:53
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:53

Not After

03/03/2024, 12:53

Subject

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:52:a4:30:42:a8:5b:8f:db:eb:62:61:c2:2b:29:7e
Certificate

Issuer

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/03/2012, 06:42

Not After

31/03/2013, 06:42

Subject

CN=Open Source Developer,O=Open Source Developer,C=DE,1.2.840.113549.1.9.1=#0c107a686e6d6a7531323340676d782e6465

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c1:39:e1:1b:08:57:f3:ac:2e:1e:c0:a1:43:40:27:97:39:94:e6:e2
Signer

Actual PE Digest

c1:39:e1:1b:08:57:f3:ac:2e:1e:c0:a1:43:40:27:97:39:94:e6:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

ImageList_BeginDrag
ImageList_SetDragCursorImage
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragMove
ImageList_EndDrag
CreateStatusWindowW
ImageList_Add
ImageList_Draw
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create
ImageList_GetIconSize
ImageList_GetImageCount
ord16
ord17

ws2_32

setsockopt
ioctlsocket
socket
bind
__WSAFDIsSet
select
recv
getsockname
listen
closesocket
shutdown
WSACleanup
getsockopt
accept
WSAStartup
sendto
recvfrom
connect
WSAGetLastError
ntohs
ntohl
gethostbyaddr
getservbyname
htons
htonl
inet_addr
gethostbyname
send

winmm

PlaySoundW

kernel32

GetModuleFileNameW
TerminateProcess
WideCharToMultiByte
MultiByteToWideChar
GetTimeZoneInformation
GetThreadLocale
ExitProcess
ResumeThread
TlsGetValue
TlsFree
TlsSetValue
TlsAlloc
SetEnvironmentVariableW
GetFileType
CopyFileW
SetCurrentDirectoryW
GetWindowsDirectoryW
SystemTimeToFileTime
GetTempPathW
GetTempFileNameW
GetStdHandle
OutputDebugStringW
CreateThread
ExpandEnvironmentStringsW
UnhandledExceptionFilter
MoveFileW
InitializeCriticalSectionAndSpinCount
SetStdHandle
ExitThread
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
RaiseException
RtlUnwindEx
RtlLookupFunctionEntry
GetStartupInfoW
GetCommandLineA
GetTimeFormatA
GetDateFormatA
RtlPcToFileHeader
GetTimeFormatW
DecodePointer
EncodePointer
GetStringTypeW
GetComputerNameW
IsValidCodePage
GetCPInfo
Sleep
GetEnvironmentVariableW
SetThreadLocale
IsValidLocale
GetUserDefaultLCID
GetACP
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapSize
GlobalSize
LocalAlloc
GetDateFormatW
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
LCMapStringW
GetFileAttributesExW
FindNextFileW
CompareFileTime
ReadFile
GetFileInformationByHandle
DeleteFileW
GetDiskFreeSpaceExW
GetShortPathNameW
DeviceIoControl
RemoveDirectoryW
BackupWrite
BackupRead
GetLongPathNameW
GetFileAttributesW
SetFileTime
CreateDirectoryW
MoveFileExW
CopyFileExW
LocalFileTimeToFileTime
FileTimeToLocalFileTime
GetNumberFormatW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetLocaleInfoW
GetVolumeInformationW
GetLogicalDriveStringsW
GetFullPathNameW
CompareStringW
GetProcAddress
GetVersionExW
ResetEvent
OpenEventA
LoadLibraryW
GetModuleHandleW
FreeLibrary
LocalFree
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
FindClose
GetComputerNameExW
SetLastError
GetLastError
CreateFileW
FormatMessageW
GetVolumePathNameW
WriteFile
SetFilePointerEx
GetDriveTypeW
FindFirstFileW
SetFileAttributesW
QueryPerformanceFrequency
QueryPerformanceCounter
SetThreadExecutionState
SetPriorityClass
GetCurrentThreadId
FormatMessageA
GetSystemTimeAsFileTime
SetEvent
WaitForSingleObject
CreateSemaphoreA
HeapFree
GetCurrentProcess
CloseHandle
CreateEventA
HeapAlloc
DuplicateHandle
ReleaseSemaphore
GetProcessHeap
GetTickCount
SetErrorMode
GetCommandLineW
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
GetOEMCP
HeapSetInformation
GetVersion
HeapCreate
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
WriteConsoleW
SetEndOfFile
GetLocaleInfoA
EnumSystemLocalesA
GetCurrentDirectoryW
CreateFileA
SetEnvironmentVariableA
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA

user32

DdeNameService
DdeConnect
DdePostAdvise
GetMessagePos
DrawStateW
DrawEdge
TranslateAcceleratorW
CreateAcceleratorTableW
DestroyAcceleratorTable
ValidateRect
GetMessageW
GetMenuStringW
DefMDIChildProcW
TranslateMDISysAccel
DefFrameProcW
DestroyCursor
GetWindowDC
RegisterClipboardFormatW
MapWindowPoints
GetClassInfoW
GetUpdateRect
BeginPaint
DrawIcon
EndPaint
SetMenu
OffsetRect
CopyRect
UnionRect
HideCaret
keybd_event
DrawTextW
OpenClipboard
IsClipboardFormatAvailable
CloseClipboard
ChildWindowFromPoint
GetWindowTextLengthW
GetWindowTextW
GetClassNameW
KillTimer
SetTimer
DrawIconEx
DrawFrameControl
GetForegroundWindow
InsertMenuItemW
GetSubMenu
CreateMenu
InsertMenuW
RemoveMenu
DestroyMenu
CreatePopupMenu
SetMenuItemInfoW
GetDlgItem
CreateDialogParamW
ModifyMenuW
CheckMenuRadioItem
CheckMenuItem
GetMenuState
InflateRect
GetUpdateRgn
IsDialogMessageW
TrackPopupMenu
IsWindow
PtInRect
SetCursor
DdeCreateStringHandleW
UnregisterHotKey
RegisterHotKey
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetActiveWindow
ShowCursor
GetMenuItemInfoW
GetMessageTime
BeginDeferWindowPos
EndDeferWindowPos
InvalidateRect
GetFocus
IsWindowEnabled
CallWindowProcW
DeferWindowPos
ClientToScreen
ScreenToClient
UpdateWindow
RedrawWindow
SetParent
WindowFromPoint
GetParent
ScrollWindow
SetScrollInfo
GetScrollInfo
SetCursorPos
SetCapture
EnableWindow
SetFocus
SetWindowLongPtrW
GetWindowLongPtrW
FillRect
GetAsyncKeyState
VkKeyScanW
TranslateMessage
DispatchMessageW
MessageBoxW
DestroyIcon
CopyIcon
GetIconInfo
PostQuitMessage
CreateDialogIndirectParamW
MoveWindow
SetWindowTextW
DefWindowProcW
DestroyWindow
FlashWindow
SetWindowRgn
GetClientRect
GetMenu
AdjustWindowRectEx
GetSystemMenu
EnableMenuItem
DrawMenuBar
GetWindowLongW
SetWindowLongW
SetWindowPos
IsIconic
IsZoomed
BringWindowToTop
GetWindowRect
CreateWindowExW
GetCursorPos
GetSysColor
GetDesktopWindow
CreateIconIndirect
ReleaseDC
GetDC
LoadImageW
DdeClientTransaction
DdeDisconnect
DdeInitializeW
DdeGetLastError
DdeGetData
DdeFreeDataHandle
DdeCreateDataHandle
DdeUninitialize
DdeQueryStringW
DdeFreeStringHandle
PostThreadMessageW
MessageBeep
GetCapture
GetWindow
IsWindowVisible
ShowWindow
SystemParametersInfoW
SendMessageW
ReleaseCapture
DrawFocusRect
RegisterWindowMessageW
PostMessageW
SetForegroundWindow
GetKeyState
RegisterClassW
LoadCursorW
UnregisterClassW
EnumDisplaySettingsW
SetClipboardData
ChangeDisplaySettingsW
GetMenuItemCount
GetSystemMetrics
LoadBitmapW
LoadIconW
PeekMessageW
AppendMenuW

gdi32

SetPixel
Polyline
PolyBezier
TextOutW
SetROP2
GetCharABCWidthsW
GetTextExtentExPointW
SetWindowOrgEx
SetViewportOrgEx
SetWindowExtEx
SetViewportExtEx
SetMapMode
GetBkColor
GetTextColor
SelectClipRgn
CreateSolidBrush
Arc
Pie
Polygon
SetPolyFillMode
PolyPolygon
Rectangle
RoundRect
Ellipse
GetStockObject
CreateFontIndirectW
MaskBlt
StretchBlt
StretchDIBits
GetNearestPaletteIndex
CreatePalette
CreateHatchBrush
CreatePatternBrush
ExtCreatePen
CreatePen
LineTo
GetPixel
CombineRgn
CreateRectRgnIndirect
RectInRegion
SetTextAlign
CreateICW
RestoreDC
SaveDC
GetRgnBox
EqualRgn
PtInRegion
CreateDIBSection
GetDIBits
CreateDIBitmap
GetDIBColorTable
GetSystemPaletteEntries
EnumFontFamiliesExW
GetEnhMetaFileW
CopyEnhMetaFileW
DeleteEnhMetaFile
SetAbortProc
EndDoc
StartPage
EndPage
StartDocW
CreateDCW
ExtFloodFill
ExtSelectClipRgn
GetClipBox
SetBkMode
SetTextColor
SetStretchBltMode
MoveToEx
GetDeviceCaps
ExcludeClipRect
CreateRectRgn
GetTextExtentPoint32W
SelectPalette
RealizePalette
GdiFlush
GetTextMetricsW
GetRegionData
ExtCreateRegion
OffsetRgn
SetBkColor
CreateBitmap
CreateCompatibleBitmap
BitBlt
SelectObject
DeleteDC
CreateCompatibleDC
GetPaletteEntries
PatBlt
DeleteObject
SetBrushOrgEx
GetObjectW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

comdlg32

PrintDlgW
ChooseFontW
ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError
PageSetupDlgW

advapi32

GetUserNameW
GetTokenInformation
ConvertSidToStringSidW
GetFileSecurityW
SetFileSecurityW
EncryptFileW
PrivilegeCheck
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
DragQueryFileW
DragQueryPoint
DragFinish
DragAcceptFiles
ExtractIconExW
ExtractIconW
Shell_NotifyIconW
SHQueryRecycleBinW
SHFileOperationW
CommandLineToArgvW
ShellExecuteExW
SHGetFolderPathW
SHGetFileInfoW
SHGetSpecialFolderLocation

ole32

CoUninitialize
CoInitializeEx
OleUninitialize
OleInitialize
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
ReleaseStgMedium
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
OleGetClipboard
CoCreateInstance

mpr

WNetAddConnection2W
WNetCancelConnection2W
WNetGetConnectionW

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 123KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 432KB - Virtual size: 431KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab1e11f45e4dea6077d21c0039e549c3

Code Sign

04:7a:55Certificate

Extended Key Usages

04:7a:53Certificate

Key Usages

47:52:a4:30:42:a8:5b:8f:db:eb:62:61:c2:2b:29:7eCertificate

Extended Key Usages

Key Usages

c1:39:e1:1b:08:57:f3:ac:2e:1e:c0:a1:43:40:27:97:39:94:e6:e2Signer

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

ws2_32

winmm

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

mpr

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 123KB - Virtual size: 291KB

.pdata Size: 187KB - Virtual size: 186KB

text Size: 7KB - Virtual size: 6KB

data Size: 23KB - Virtual size: 23KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 432KB - Virtual size: 431KB

.reloc Size: 110KB - Virtual size: 109KB

04:7a:55
Certificate

04:7a:53
Certificate

47:52:a4:30:42:a8:5b:8f:db:eb:62:61:c2:2b:29:7e
Certificate

c1:39:e1:1b:08:57:f3:ac:2e:1e:c0:a1:43:40:27:97:39:94:e6:e2
Signer

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 123KB - Virtual size: 291KB

.pdata
Size: 187KB - Virtual size: 186KB

text
Size: 7KB - Virtual size: 6KB

data
Size: 23KB - Virtual size: 23KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 432KB - Virtual size: 431KB

.reloc
Size: 110KB - Virtual size: 109KB