45bd17e57a8346385c4b87f51a178670_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

45bd17e57a8346385c4b87f51a178670_NeikiAnalytics.exe
Size

276KB
MD5

45bd17e57a8346385c4b87f51a178670
SHA1

64004a92b1694257f08aff48fccfcb3eff4ea9f9
SHA256

4ce82ad890559cca1188a7133e6fa893ee7923f2260434c52cc71724e26296c6
SHA512

168a5831168b1ac29bde37c1a8d20019ad436af791c51213aa59e187c2f36f853c3a3aab33d438509c9da29e7a10450652ccf99dcf2f5ecb0254124eb212042d
SSDEEP

3072:NxvTk17HnQxwksbBiIyUkX/0nNT+CdDR1xztnB2D:NpTU7HQxSoci/0o61xztBC

Score

1^/10

Malware Config

Signatures

Files

45bd17e57a8346385c4b87f51a178670_NeikiAnalytics.exe
.exe windows:5 windows x64 arch:x64

8753e5c2ab72a819f1d9b28b7bf0a4f7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

12:eb:32:79:cf:bc:2d:30:c6:fa:2e:70:9e:0a:4a:40
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

28-05-2013 00:00

Not After

28-05-2014 23:59

Subject

CN=北京昌华礼泰科技有限公司,OU=技术部,O=北京昌华礼泰科技有限公司,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

dd:e9:f5:93:1a:8b:67:75:cb:f2:b0:45:b6:12:a5:c4:5d:88:a9:c7
Signer

Actual PE Digest

dd:e9:f5:93:1a:8b:67:75:cb:f2:b0:45:b6:12:a5:c4:5d:88:a9:c7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

user32

MessageBoxA
CharNextW
LoadStringW
SendMessageW
MessageBoxW
LoadStringW
GetWindowThreadProcessId
GetSystemMetrics
GetWindow
GetClassNameW
FindWindowExW
FindWindowW
EnumWindows
CharUpperW

kernel32

Sleep
VirtualFree
VirtualAlloc
HeapFree
HeapAlloc
GetProcessHeap
lstrlenW
lstrcpynW
VirtualQuery
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsDBCSLeadByteEx
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetConsoleOutputCP
GetConsoleCP
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwindEx
RtlUnwind
RaiseException
ExitProcess
GetCurrentThreadId
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
SetFilePointer
SetEndOfFile
ReadFile
GetFileType
GetFileSize
CreateFileW
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
WriteProcessMemory
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualFreeEx
VirtualAllocEx
SetEvent
ResetEvent
ReadProcessMemory
OpenProcess
LocalFree
IsValidLocale
GetVersionExW
GetThreadLocale
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetDiskFreeSpaceW
GetDateFormatW
GetCommandLineW
GetCPInfo
FreeLibrary
FormatMessageW
EnumSystemLocalesW
EnumCalendarInfoW
CreateEventW
CompareStringW
CloseHandle

Sections

.text
Size: 225KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 36KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 416B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8753e5c2ab72a819f1d9b28b7bf0a4f7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

12:eb:32:79:cf:bc:2d:30:c6:fa:2e:70:9e:0a:4a:40Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

dd:e9:f5:93:1a:8b:67:75:cb:f2:b0:45:b6:12:a5:c4:5d:88:a9:c7Signer

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

Sections

.text Size: 225KB - Virtual size: 224KB

.data Size: 22KB - Virtual size: 22KB

.bss Size: - Virtual size: 36KB

.idata Size: 4KB - Virtual size: 4KB

.didata Size: 512B - Virtual size: 448B

.tls Size: - Virtual size: 416B

.rdata Size: 512B - Virtual size: 40B

.pdata Size: 11KB - Virtual size: 11KB

.rsrc Size: 5KB - Virtual size: 5KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

12:eb:32:79:cf:bc:2d:30:c6:fa:2e:70:9e:0a:4a:40
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

dd:e9:f5:93:1a:8b:67:75:cb:f2:b0:45:b6:12:a5:c4:5d:88:a9:c7
Signer

.text
Size: 225KB - Virtual size: 224KB

.data
Size: 22KB - Virtual size: 22KB

.bss
Size: - Virtual size: 36KB

.idata
Size: 4KB - Virtual size: 4KB

.didata
Size: 512B - Virtual size: 448B

.tls
Size: - Virtual size: 416B

.rdata
Size: 512B - Virtual size: 40B

.pdata
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 5KB - Virtual size: 5KB