0b705ade9a5910b5433e1160b5f0f860_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
0b705ade9a5910b5433e1160b5f0f860_NeikiAnalytics.exe
Size 223KB
Sample240527-w8l8dsde4t
SHA256 2cdd596dd81ce9835fc6c64bd39f325441671908385d87a65b6c042eaf628f22
MD5 0b705ade9a5910b5433e1160b5f0f860
SHA1 1c8db7e0b9071af3d7f4a52386ff3544f0420438
SHA512 e5764c3f46f215c8847eef8f4bc0fa6e08b078424b118ce8f64eca6fb2c2b1a7093786140ff42b6376e2b3bb4222f8b94fd572cb425645681708c436d40808cc
SSDEEP 3072:6huf5i0WGIcv9JvK2agufAnAZdlGZxIOtY81fs2lQBV+UdE+rECWp7hKC+d5AW:ZBi0WGHVagufYLIBV+UdvrEFp7hKpeW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

0b705ade9a5910b5433e1160b5f0f860_NeikiAnalytics.exe

.dll 223KB

0b705ade9a5910b5433e1160b5f0f860_NeikiAnalytics.exe

IMPHASH 14d7e894316e66043ec9a3b8c4aa62c2
SHA256 2cdd596dd81ce9835fc6c64bd39f325441671908385d87a65b6c042eaf628f22
MD5 0b705ade9a5910b5433e1160b5f0f860
SHA1 1c8db7e0b9071af3d7f4a52386ff3544f0420438
SHA512 e5764c3f46f215c8847eef8f4bc0fa6e08b078424b118ce8f64eca6fb2c2b1a7093786140ff42b6376e2b3bb4222f8b94fd572cb425645681708c436d40808cc
SSDEEP 3072:6huf5i0WGIcv9JvK2agufAnAZdlGZxIOtY81fs2lQBV+UdE+rECWp7hKC+d5AW:ZBi0WGHVagufYLIBV+UdvrEFp7hKpeW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

fa:36:43:d2:4d:7a:cf:61:37:66:68:f0:eb:77:06:ec:57:cf:33:47:38:3a:05:28:05:74:9a:6f:40:96:ab:98

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110111-1138985,CN=AhnLab\, Inc.,O=AhnLab\, Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130b53656f6e676e616d2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Oct 13, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

06:03:43:da:68:34:f4:51:3c:e9:a1:a5:80:9e:5e:a5

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2022 - Nov 6, 2023

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

39024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetFileSize CreateFileA lstrcatA lstrlenA lstrcpynA CopyFileA GetLastError lstrcmpiA SetLastError WaitNamedPipeA WriteFile SetNamedPipeHandleState SetFileTime DeleteFileA SetEndOfFile FreeLibrary GetProcAddress LoadLibraryA CallNamedPipeA TlsAlloc TlsFree LocalFree TlsSetValue LocalAlloc TlsGetValue GetComputerNameA GetModuleFileNameA ReadFile CloseHandle GetSystemDirectoryA GetFileTime FileTimeToSystemTime OutputDebugStringA GetCurrentProcessId GetVersion ReleaseMutex CreateMutexA GetTickCount Sleep SystemTimeToFileTime GetWindowsDirectoryA GetModuleHandleA GetCurrentProcess SetFilePointer UnmapViewOfFile MapViewOfFile CreateFileMappingA GetShortPathNameA MoveFileExA CreateDirectoryA RemoveDirectoryA FindClose FindNextFileA SetFileAttributesA FindFirstFileA LocalFileTimeToFileTime lstrcmpA HeapFree HeapAlloc GetCommandLineA GetLocalTime FileTimeToLocalFileTime GetDriveTypeA RtlUnwind GetFileType GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ExitProcess FatalAppExitA TerminateProcess HeapSize GetCurrentThreadId GetCurrentThread SetHandleCount GetStdHandle GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW GetCPInfo GetACP GetOEMCP GetFullPathNameA GetCurrentDirectoryA SetCurrentDirectoryA MultiByteToWideChar LCMapStringA LCMapStringW SetStdHandle InterlockedDecrement InterlockedIncrement GetStringTypeA GetStringTypeW UnhandledExceptionFilter FlushFileBuffers GetTimeZoneInformation IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA FormatMessageA lstrcpyA

user32

IsCharAlphaA wsprintfA LoadStringA CharNextA CharLowerA

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

Sharing

General

Malware Config

Signatures

File Explorer

0b705ade9a5910b5433e1160b5f0f860_NeikiAnalytics.exe

PE Signature issue

kernel32

user32

advapi32

generic