908369fb121a3a132bb33f909612a1d0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

908369fb121a3a132bb33f909612a1d0_NeikiAnalytics.exe
Size

61KB
MD5

908369fb121a3a132bb33f909612a1d0
SHA1

2762213ab0866a32c0fd6aa6cda903d52f1a7c1a
SHA256

3207ad6b473fc44ce84c08a1e424a753897f05b6a76098965a02bf1e9b6256c7
SHA512

25d82010167276220fd56273721c0bdf0f4b858f689466265c92e02872a86657626a008e86aff1cc5dd52803208033ad5f2bbf3bd815c93db0fb56cbc8aa2bc9
SSDEEP

768:ZJBdnblg9TIOWk0HzhmdozDcEYdFHX+kDgTcm7syuLCElYayo6i1RyjKS:Pq9TcnHzlYEYr3aTcPCEz6iD2

Score

1^/10

Malware Config

Signatures

Files

908369fb121a3a132bb33f909612a1d0_NeikiAnalytics.exe
.exe windows:5 windows x64 arch:x64

b88129ba71a3ad7548f1285e82d38fe2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:a6:a4:b1:0c:1c:23:11:0c:2c:40:a2:aa:4b:5c:3c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/10/2013, 00:00

Not After

18/10/2014, 23:59

Subject

CN=O&O Software GmbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3f:f3:dd:d8:ed:fa:9a:fa:15:0d:f4:44:12:df:8c:38:97:9d:25:84
Signer

Actual PE Digest

3f:f3:dd:d8:ed:fa:9a:fa:15:0d:f4:44:12:df:8c:38:97:9d:25:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

E:\DR\loc\build\OOD\work\current\bin\vc10\x64\Unicode Static Release\oodsvct.pdb

Imports

advapi32

StartServiceW
QueryServiceStatus
ControlService
OpenServiceW
OpenSCManagerW
CloseServiceHandle
ChangeServiceConfigW

kernel32

Sleep
GetLastError
GetCommandLineW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DecodePointer
TerminateProcess
GetCurrentProcess
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
RtlUnwindEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
HeapSetInformation
GetVersion
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
HeapFree
LoadLibraryW
HeapAlloc
HeapReAlloc
HeapSize

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b88129ba71a3ad7548f1285e82d38fe2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

02:a6:a4:b1:0c:1c:23:11:0c:2c:40:a2:aa:4b:5c:3cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

3f:f3:dd:d8:ed:fa:9a:fa:15:0d:f4:44:12:df:8c:38:97:9d:25:84Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

Sections

.text Size: 21KB - Virtual size: 21KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 8KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 16KB - Virtual size: 16KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

02:a6:a4:b1:0c:1c:23:11:0c:2c:40:a2:aa:4b:5c:3c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

3f:f3:dd:d8:ed:fa:9a:fa:15:0d:f4:44:12:df:8c:38:97:9d:25:84
Signer

.text
Size: 21KB - Virtual size: 21KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 8KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 16KB - Virtual size: 16KB