1915f28fd2eeec1b31d11f5d55ce1390_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
1915f28fd2eeec1b31d11f5d55ce1390_NeikiAnalytics.exe
Size 426KB
Sample240527-zelasaae47
SHA256 ccf24bdadb8343dbd098f1382f47a7343a89b12761606bb5ad7c9c7b694bec5f
MD5 1915f28fd2eeec1b31d11f5d55ce1390
SHA1 f5fa0d3279610e5c007953c1e977814b7d82ef5a
SHA512 6eea37ae5f09b7c75f656a798934c10c9196ae6003c0f7fa270f2c78234958cdb41f8aa6957c78c41bcba6bcef644e7cc102562c112fae0eba9b67bf073a9822
SSDEEP 12288:sJHAVNmyaGKEszBj+MnS3GbFjxPBzWGITqYXOVOoQM:WgWljJBbF1ZzWGIO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

1915f28fd2eeec1b31d11f5d55ce1390_NeikiAnalytics.exe

.dll 426KB

1915f28fd2eeec1b31d11f5d55ce1390_NeikiAnalytics.exe

IMPHASH ef74d407814b63bfebdc40e820b7d58c
SHA256 ccf24bdadb8343dbd098f1382f47a7343a89b12761606bb5ad7c9c7b694bec5f
MD5 1915f28fd2eeec1b31d11f5d55ce1390
SHA1 f5fa0d3279610e5c007953c1e977814b7d82ef5a
SHA512 6eea37ae5f09b7c75f656a798934c10c9196ae6003c0f7fa270f2c78234958cdb41f8aa6957c78c41bcba6bcef644e7cc102562c112fae0eba9b67bf073a9822
SSDEEP 12288:sJHAVNmyaGKEszBj+MnS3GbFjxPBzWGITqYXOVOoQM:WgWljJBbF1ZzWGIO
MD5 SHA1 SHA512 SSDEEP

Digest

aa:a1:42:16:35:f0:74:67:81:63:4f:b2:45:ab:40:68:95:9e:f9:d6:97:ff:b4:36:dd:c7:7e:39:5a:93:25:61

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=RayShare Co.\, Ltd,O=RayShare Co.\, Ltd,L=Beijing,ST=Beijing,C=CN,1.2.840.113549.1.9.1=#0c1572617973686172656c746440676d61696c2e636f6d

Chains

Nov 22, 2023

CN=RayShare Co.\, Ltd,O=RayShare Co.\, Ltd,L=Beijing,ST=Beijing,C=CN,1.2.840.113549.1.9.1=#0c1572617973686172656c746440676d61696c2e636f6d

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=RayShare Co.\, Ltd,O=RayShare Co.\, Ltd,L=Beijing,ST=Beijing,C=CN,1.2.840.113549.1.9.1=#0c1572617973686172656c746440676d61696c2e636f6d

Serial Number

3a:ce:ec:3c:57:11:8e:80:3e:7d:93:c0

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 2, 2023 - Jun 2, 2026

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

228069

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\qu_2019_4_8\vcpkg-master\buildtrees\curl\x86-windows-rel\lib\libcurl.pdb

ws2_32

send WSAGetLastError setsockopt WSAIoctl bind closesocket connect listen htonl accept WSACleanup WSAStartup ioctlsocket freeaddrinfo getaddrinfo select __WSAFDIsSet WSASetLastError socket ntohs htons getsockopt getsockname getpeername recv

advapi32

CryptAcquireContextA CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptGenRandom CryptReleaseContext

crypt32

CertFreeCertificateContext CertFindCertificateInStore CertAddCertificateContextToStore CertCloseStore CertOpenStore CryptStringToBinaryA CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertEnumCertificatesInStore CertFreeCertificateChain

zlib1

inflateEnd inflateInit_ inflateInit2_ inflate zlibVersion

kernel32

FindClose SetStdHandle FindFirstFileExW GetFullPathNameW GetCurrentDirectoryW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetFileAttributesExW GetStringTypeW GetTimeZoneInformation HeapSize WriteConsoleW SetEndOfFile MultiByteToWideChar SetUnhandledExceptionFilter HeapReAlloc SetFilePointerEx FlushFileBuffers QueryPerformanceCounter GetTickCount ExpandEnvironmentStringsA SleepEx GetLastError SetLastError FormatMessageA Sleep FreeLibrary GetProcAddress CloseHandle WaitForSingleObjectEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection VerSetConditionMask QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerifyVersionInfoA CreateFileA GetFileSizeEx ReadFile UnhandledExceptionFilter DecodePointer GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleFileNameW GetConsoleMode ReadConsoleW WriteFile GetConsoleOutputCP HeapAlloc HeapFree GetStdHandle CompareStringW LCMapStringW

curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_init curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_strerror curl_easy_unescape curl_easy_upkeep curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_poll curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_multi_wakeup curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_pushheader_byname curl_pushheader_bynum curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_url curl_url_cleanup curl_url_dup curl_url_get curl_url_set curl_version curl_version_info

Sharing

General

Malware Config

Signatures

File Explorer

1915f28fd2eeec1b31d11f5d55ce1390_NeikiAnalytics.exe

ws2_32

advapi32

crypt32

zlib1

kernel32

generic