0a2231ab9d89cd2117fba35432acfdf0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0a2231ab9d89cd2117fba35432acfdf0_NeikiAnalytics.exe
Size

2.9MB
MD5

0a2231ab9d89cd2117fba35432acfdf0
SHA1

62bf3dce554543bd57f38a5e84c0fb38c38de743
SHA256

5ba0896265f83c89faddd011139316db6553a089ee6f61cf252167f4cc45da24
SHA512

b46aadcf5a570e816e7d545c50554a9c72c120a991857e646b005ba7744506a8801e532bb56e6329635c1c7904e4cec3d8871c27f99f27009174f52adcb7cb29
SSDEEP

49152:RhftjzCjx36SotXQbfl3VOMGiQqbcb/mQp097EILGrn5iGZ4MEiL6ktQcmLgPMV:zRzCjx3Lo5yfl3VOM3Q2xe03Lyn5iGZO

Score

1^/10

Malware Config

Signatures

Files

0a2231ab9d89cd2117fba35432acfdf0_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

15cafd4b6a8dd5c6180c250a39683c08

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:e6:97:bc:25:4c:2e:4c:4b:55:fd:d7
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

30/03/2021, 02:43

Not After

30/04/2024, 07:55

Subject

CN=FUJIFILM (China) Investment Co.\,Ltd.,O=FUJIFILM (China) Investment Co.\,Ltd.,L=Shanghai,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

33:da:56:3d:d7:19:0e:9e:6f:78:55:72:05:43:fb:f4:f1:53:e0:83:3b:5d:3f:52:d3:23:6d:b4:32:ca:c9:54
Signer

Actual PE Digest

33:da:56:3d:d7:19:0e:9e:6f:78:55:72:05:43:fb:f4:f1:53:e0:83:3b:5d:3f:52:d3:23:6d:b4:32:ca:c9:54

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

DeleteCriticalSection
GetModuleHandleA
GetProcAddress
VirtualProtect

user32

GetKeyboardType
MessageBoxA

advapi32

RegQueryValueExA

oleaut32

SysFreeString

version

VerQueryValueW

gdi32

UnrealizeObject

msimg32

AlphaBlend

ole32

IsEqualGUID

comctl32

ImageList_SetIconSize

shell32

ShellExecuteW

imm32

ImmGetVirtualKey

winspool.drv

OpenPrinterA

comdlg32

ChooseFontA

wsock32

send

msvcrt

_gcvt

avifil32

AVISaveOptionsFree

msvfw32

DrawDibRealize

winmm

timeGetTime

gdiplus

GdipDrawCachedBitmap

freeimage

_FreeImage_Rescale@16

sqlite3

sqlite3_reset

Sections

CODE
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2.6MB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 188B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 319KB - Virtual size: 915KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp2
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

15cafd4b6a8dd5c6180c250a39683c08

Code Sign

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

14:e6:97:bc:25:4c:2e:4c:4b:55:fd:d7Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

33:da:56:3d:d7:19:0e:9e:6f:78:55:72:05:43:fb:f4:f1:53:e0:83:3b:5d:3f:52:d3:23:6d:b4:32:ca:c9:54Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

oleaut32

version

gdi32

msimg32

ole32

comctl32

shell32

imm32

winspool.drv

comdlg32

wsock32

msvcrt

avifil32

msvfw32

winmm

gdiplus

freeimage

sqlite3

Sections

CODE Size: - Virtual size: 3.7MB

DATA Size: - Virtual size: 216KB

BSS Size: - Virtual size: 2.6MB

.idata Size: - Virtual size: 30KB

.tls Size: - Virtual size: 188B

.rdata Size: 512B - Virtual size: 24B

.vmp0 Size: - Virtual size: 175KB

.rsrc Size: 319KB - Virtual size: 915KB

.vmp1 Size: - Virtual size: 220KB

.vmp2 Size: 2.5MB - Virtual size: 2.5MB

.reloc Size: 512B - Virtual size: 120B

04:00:00:00:00:01:21:58:53:08:a2
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

14:e6:97:bc:25:4c:2e:4c:4b:55:fd:d7
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

33:da:56:3d:d7:19:0e:9e:6f:78:55:72:05:43:fb:f4:f1:53:e0:83:3b:5d:3f:52:d3:23:6d:b4:32:ca:c9:54
Signer

CODE
Size: - Virtual size: 3.7MB

DATA
Size: - Virtual size: 216KB

BSS
Size: - Virtual size: 2.6MB

.idata
Size: - Virtual size: 30KB

.tls
Size: - Virtual size: 188B

.rdata
Size: 512B - Virtual size: 24B

.vmp0
Size: - Virtual size: 175KB

.rsrc
Size: 319KB - Virtual size: 915KB

.vmp1
Size: - Virtual size: 220KB

.vmp2
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 512B - Virtual size: 120B