1deb0b1f3897d0f6711d2082f1a23760_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1deb0b1f3897d0f6711d2082f1a23760_NeikiAnalytics.exe
Size

6.2MB
MD5

1deb0b1f3897d0f6711d2082f1a23760
SHA1

d012c0ff49285735230d8ba2fc5a0e7f24eb2573
SHA256

e916aa4352ec4850e47ac648dee0de05bf72a53f7c0c62b75d270bfa06140a36
SHA512

b34050e135c885e9a656f44b1520fa63c077e7ccab1a062b839d88ae251671e5db8028abc152caedf50cf80f58bfda114b35ee8e34f1f963fea72a7103e2137a
SSDEEP

98304:czmnvFBrQG0Z1/n+y8FNtEtp+mJb9kyYcFV+P3O32tqYjfUhYKcyOQEp3oK:czmnvHrQG0Z1nMzy2mJpnFwGFYDecPt

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Files

1deb0b1f3897d0f6711d2082f1a23760_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:6b:57:de:04:b4:52:03:64:63:73:d6:71:20:1b:08
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

13/11/2023, 00:00

Not After

01/11/2024, 23:59

Subject

CN=上海巨人统平网络科技有限公司,O=上海巨人统平网络科技有限公司,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:6b:57:de:04:b4:52:03:64:63:73:d6:71:20:1b:08
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

13/11/2023, 00:00

Not After

01/11/2024, 23:59

Subject

CN=上海巨人统平网络科技有限公司,O=上海巨人统平网络科技有限公司,ST=Shanghai,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

00:69:1d:0c:85:eb:b7:ee:c8:ed:82:ae:c7:a1:9d:f0:46:b8:6f:30
Signer

Actual PE Digest

00:69:1d:0c:85:eb:b7:ee:c8:ed:82:ae:c7:a1:9d:f0:46:b8:6f:30

Digest Algorithm

sha1

PE Digest Matches

true

56:27:62:de:6a:fc:72:5a:e6:48:28:b3:f5:1e:ca:36:6d:ec:b0:48:21:f6:11:62:52:4c:1f:35:6e:13:b4:ad
Signer

Actual PE Digest

56:27:62:de:6a:fc:72:5a:e6:48:28:b3:f5:1e:ca:36:6d:ec:b0:48:21:f6:11:62:52:4c:1f:35:6e:13:b4:ad

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

Size: 2.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 284KB - Virtual size: 964KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 20KB - Virtual size: 737KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 192KB - Virtual size: 425KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.loadcon
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.boot
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 32B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:6b:57:de:04:b4:52:03:64:63:73:d6:71:20:1b:08Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:6b:57:de:04:b4:52:03:64:63:73:d6:71:20:1b:08Certificate

Extended Key Usages

Key Usages

00:69:1d:0c:85:eb:b7:ee:c8:ed:82:ae:c7:a1:9d:f0:46:b8:6f:30Signer

56:27:62:de:6a:fc:72:5a:e6:48:28:b3:f5:1e:ca:36:6d:ec:b0:48:21:f6:11:62:52:4c:1f:35:6e:13:b4:adSigner

Headers

DLL Characteristics

File Characteristics

Sections

Size: 2.4MB - Virtual size: 5.4MB

Size: 284KB - Virtual size: 964KB

Size: 20KB - Virtual size: 737KB

Size: 4KB - Virtual size: 245KB

Size: 8KB - Virtual size: 17KB

Size: 192KB - Virtual size: 425KB

.idata Size: 4KB - Virtual size: 4KB

.tls Size: 248KB - Virtual size: 248KB

.rsrc Size: 16KB - Virtual size: 16KB

.themida Size: - Virtual size: 4.9MB

.loadcon Size: 12KB - Virtual size: 12KB

.boot Size: 3.0MB - Virtual size: 3.0MB

.reloc Size: 32B - Virtual size: 4KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:6b:57:de:04:b4:52:03:64:63:73:d6:71:20:1b:08
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:6b:57:de:04:b4:52:03:64:63:73:d6:71:20:1b:08
Certificate

00:69:1d:0c:85:eb:b7:ee:c8:ed:82:ae:c7:a1:9d:f0:46:b8:6f:30
Signer

56:27:62:de:6a:fc:72:5a:e6:48:28:b3:f5:1e:ca:36:6d:ec:b0:48:21:f6:11:62:52:4c:1f:35:6e:13:b4:ad
Signer

.idata
Size: 4KB - Virtual size: 4KB

.tls
Size: 248KB - Virtual size: 248KB

.rsrc
Size: 16KB - Virtual size: 16KB

.themida
Size: - Virtual size: 4.9MB

.loadcon
Size: 12KB - Virtual size: 12KB

.boot
Size: 3.0MB - Virtual size: 3.0MB

.reloc
Size: 32B - Virtual size: 4KB