cbb219fa2bce5b25f9ee7e9ab5e83230_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

cbb219fa2bce5b25f9ee7e9ab5e83230_NeikiAnalytics.exe
Size

188KB
MD5

cbb219fa2bce5b25f9ee7e9ab5e83230
SHA1

95101ab5a287266ff1f067cb2de9cf969cdd9ee3
SHA256

5565e237a611a0b90ec7a857527cb533cad328144e35583ea5e84556a3f33427
SHA512

4775c58a3247c7650b44615aeb832037f223a8f3b40db52e73e0746a915d4875666a64b548d6557470f19f6efafe9f53603248ff35028c3a3549d7e5624a59b5
SSDEEP

3072:ZexcH7R7O/5/MbU+L7JBkyBVndTjIPw49MZOtVXwtj1l:kYS/MbU+L7VjIPJMZOtVC1l

Score

1^/10

Malware Config

Signatures

Files

cbb219fa2bce5b25f9ee7e9ab5e83230_NeikiAnalytics.exe
.dll windows:5 windows x86 arch:x86

81ddea8a46868671aa6ef643289d3954

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1c:04:dc:c9:be:35:c5:58:42:2b:af:ef:34:98:49:75
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/01/2015, 00:00

Not After

29/12/2016, 23:59

Subject

CN=DotCash Limited,OU=IT,O=DotCash Limited,L=Hong Kong,ST=Hong Kong,C=HK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:14:b4:80:8e:43:6e:19:50:38:5f:ca:0e:a3:b9:d6:fa:d8:cf:85
Signer

Actual PE Digest

55:14:b4:80:8e:43:6e:19:50:38:5f:ca:0e:a3:b9:d6:fa:d8:cf:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\AvazuMPC\Trunk\Build\TrunkBuild\Temp\CodeDir\Trunk\Bin\Pdb\Release\Config.pdb

Imports

utility

?KeyExists@CRegistry@util@@QAEHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?FormatT@StringHelper@util@@SA?AV?$AutoPtr@_W@2@PB_WZZ
?Utf8ToANSI@StringHelper@util@@SA?AV?$AutoPtr@D@2@PBD@Z
?errorMessage@CppSQLite3Exception@util@@QAEPBDXZ
??0CppSQLite3DB@util@@QAE@XZ
??1CppSQLite3DB@util@@UAE@XZ
?open@CppSQLite3DB@util@@QAEXPB_WPBD@Z
?close@CppSQLite3DB@util@@QAEXXZ
?execQuery@CppSQLite3DB@util@@QAE?AVCppSQLite3Query@2@PBD@Z
?IsOpen@CppSQLite3DB@util@@QAE_NXZ
??0CppSQLite3Query@util@@QAE@XZ
??1CppSQLite3Query@util@@UAE@XZ
?getStringField@CppSQLite3Query@util@@QAEPBDPBD0@Z
?getStringField@CppSQLite3Query@util@@QAEPBDHPBD@Z
?eof@CppSQLite3Query@util@@QAE_NXZ
?finalize@CppSQLite3Query@util@@QAEXXZ
?GetValueCount@CRegistry@util@@QAEHXZ
?SetWow64Key@CRegistry@util@@QAEXH@Z
??0CRegistry@util@@QAE@XZ
??1CRegistry@util@@UAE@XZ
?SplitString@StringHelper@util@@SAIABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$vector@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$allocator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@@4@PB_WHH@Z
?SetFullKey@CRegistry@util@@QAEPAUHKEY__@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@HK@Z
?ValueExists@CRegistry@util@@QAEHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?ReadString@CRegistry@util@@QAE?AV?$AutoPtr@_W@2@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?ReadDword@CRegistry@util@@QAEKV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@K@Z
?WriteString@CRegistry@util@@QAEHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@0@Z
?WriteDword@CRegistry@util@@QAEHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@K@Z
?ANSIToUnicode@StringHelper@util@@SA?AV?$AutoPtr@_W@2@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?UnicodeToANSI@StringHelper@util@@SA?AV?$AutoPtr@D@2@PB_W@Z
?FormatW@StringHelper@util@@SA?AV?$AutoPtr@_W@2@PB_WZZ
?ConvertToInt64@StringHelper@util@@SA_JV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?LoadFile@FileHelper@util@@SAHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?Utf8ToUnicode@StringHelper@util@@SA?AV?$AutoPtr@_W@2@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Utf8ToANSI@StringHelper@util@@SA?AV?$AutoPtr@D@2@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?IsFileExist@PathHelper@util@@SAHABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?UnicodeToANSI@StringHelper@util@@SA?AV?$AutoPtr@D@2@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?Utf8ToUnicode@StringHelper@util@@SA?AV?$AutoPtr@_W@2@PBD@Z
?UnicodeToUtf8@StringHelper@util@@SA?AV?$AutoPtr@D@2@PB_W@Z

kernel32

TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
IsDebuggerPresent
InterlockedExchange
OutputDebugStringA
GetPrivateProfileStringW

advapi32

RegEnumKeyExW
RegCloseKey

ole32

CoTaskMemAlloc
CoTaskMemFree

msvcp90

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?uncaught_exception@std@@YA_NXZ
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@D@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IBEPBDXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IBEPB_WXZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?width@ios_base@std@@QAEHH@Z
?width@ios_base@std@@QBEHXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?rdstate@ios_base@std@@QBEHXZ
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?length@?$char_traits@D@std@@SAIPBD@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z

msvcr90

strchr
??_V@YAXPAX@Z
_purecall
sprintf
sscanf
sprintf_s
strpbrk
fputc
sscanf_s
_vsnprintf_s
atoi
_CxxThrowException
fread
fprintf
ferror
ftell
fseek
atof
fclose
strncmp
isspace
isalnum
tolower
isalpha
memmove
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_except_handler4_common
malloc
free
??_U@YAPAXI@Z
_wtoi64
memset
memcmp
memcpy
??2@YAPAXI@Z
??3@YAXPAX@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
memmove_s
__CxxFrameHandler3
??0exception@std@@QAE@ABV01@@Z
fopen_s

Exports

Exports

?CreateConfig@config@@YGPAUIConfig@1@W4ENodeType@1@@Z
?ReleaseConfig@config@@YGXPAUIConfig@1@@Z

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

81ddea8a46868671aa6ef643289d3954

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

1c:04:dc:c9:be:35:c5:58:42:2b:af:ef:34:98:49:75Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

55:14:b4:80:8e:43:6e:19:50:38:5f:ca:0e:a3:b9:d6:fa:d8:cf:85Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

utility

kernel32

advapi32

ole32

msvcp90

msvcr90

Exports

Exports

Sections

.text Size: 132KB - Virtual size: 131KB

.rdata Size: 33KB - Virtual size: 33KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 10KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

1c:04:dc:c9:be:35:c5:58:42:2b:af:ef:34:98:49:75
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

55:14:b4:80:8e:43:6e:19:50:38:5f:ca:0e:a3:b9:d6:fa:d8:cf:85
Signer

.text
Size: 132KB - Virtual size: 131KB

.rdata
Size: 33KB - Virtual size: 33KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 10KB