a0367cf21a05dad780a3054dd4c5dbb0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
a0367cf21a05dad780a3054dd4c5dbb0_NeikiAnalytics.exe
Size 340KB
Sample240603-mlafmsbd6s
SHA256 12db0a1fa28246fd8bfe8d029f499ca94e59dd05ecd4833f304fd675665f610f
MD5 a0367cf21a05dad780a3054dd4c5dbb0
SHA1 4d733db87e0dee168e0ed3e6a35efa0428344f83
SHA512 28361e4e1e4f12b0adf4f1c745fa4d06ef0e1dbdf99476a7feba1526464acedb34d9ec4ce104d7bad1127d66d3efa3471ef02b40829d4f7702a5b20e3763ced6
SSDEEP 6144:w2Uz2slHuNB45oruALGqUgvYyyyyai2i7yySznGQjGOWc:doGBOorZDUoi2i7yySznGW5Wc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a0367cf21a05dad780a3054dd4c5dbb0_NeikiAnalytics.exe

.exe 340KB

a0367cf21a05dad780a3054dd4c5dbb0_NeikiAnalytics.exe

IMPHASH ce7b6adaf5ded906e6105345b56b048c
SHA256 12db0a1fa28246fd8bfe8d029f499ca94e59dd05ecd4833f304fd675665f610f
MD5 a0367cf21a05dad780a3054dd4c5dbb0
SHA1 4d733db87e0dee168e0ed3e6a35efa0428344f83
SHA512 28361e4e1e4f12b0adf4f1c745fa4d06ef0e1dbdf99476a7feba1526464acedb34d9ec4ce104d7bad1127d66d3efa3471ef02b40829d4f7702a5b20e3763ced6
SSDEEP 6144:w2Uz2slHuNB45oruALGqUgvYyyyyai2i7yySznGQjGOWc:doGBOorZDUoi2i7yySznGW5Wc
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

73:91:d3:a3:40:4f:61:73:c7:5c:75:7b:1f:7e:b3:ae:cc:7d:4d:67

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=NHN corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=NHN corp.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Chains

Oct 22, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

4d:62:90:e5:8c:54:f0:f1:eb:17:34:1a:13:10:e6:a4

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Sep 30, 2010 - Jan 1, 2014

Subject

CN=NHN corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=NHN corp.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Serial Number

34:62:05:4a:5e:fe:75:45:48:7f:4f:15:48:70:8c:b4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 30, 2012 - Jan 29, 2015

Minor OS version

Major OS version

Entry point

78626

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetReadFile InternetOpenW InternetOpenUrlW InternetCloseHandle DeleteUrlCacheEntryW

kernel32

CreateThread GetShortPathNameA LoadLibraryW FlushFileBuffers WriteFile CreateFileW RaiseException EnterCriticalSection lstrcmpA LocalAlloc WriteConsoleW SetStdHandle LCMapStringW GetConsoleMode GetConsoleCP SetFilePointer GetStringTypeW GetCurrentProcessId QueryPerformanceCounter GetFileType SetHandleCount TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo GetStdHandle ExitProcess HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime RtlUnwind GetStartupInfoW HeapSetInformation DecodePointer EncodePointer HeapSize HeapReAlloc HeapDestroy InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedPushEntrySList InterlockedCompareExchange TerminateProcess GetExitCodeProcess Sleep GetVersionExW FreeEnvironmentStringsW CloseHandle WideCharToMultiByte FreeResource CopyFileW GetTickCount GetTempPathW GlobalAlloc GlobalLock LeaveCriticalSection GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection SizeofResource LockResource GlobalUnlock MulDiv lstrcmpW LocalFree GetCommandLineW GetUserDefaultLangID GetModuleFileNameW LoadLibraryExW MultiByteToWideChar FreeLibrary SetLastError lstrcmpiW InterlockedDecrement InterlockedIncrement GetModuleHandleW GetProcAddress LoadResource lstrlenW GetCurrentThreadId GetCurrentProcess FlushInstructionCache FindResourceExW FindResourceW GetEnvironmentStringsW

user32

DrawFocusRect DrawEdge GetWindowLongW CreateWindowExW DispatchMessageW ShowWindow UnregisterClassA CallWindowProcW SetWindowLongW SetCapture MessageBoxW GetForegroundWindow SendMessageW SetCursor DestroyWindow CharNextW PeekMessageW GetMessageW SetWindowPos TranslateMessage GetMenu GetWindowRect GetClientRect ClientToScreen UpdateWindow InvalidateRect GetParent GetDlgCtrlID AdjustWindowRectEx IsWindow SystemParametersInfoW GetCapture ReleaseCapture RegisterWindowMessageW CreateAcceleratorTableW RegisterClassExW LoadCursorW GetClassInfoExW SetFocus GetFocus GetWindow DestroyAcceleratorTable GetDesktopWindow FillRect GetClassNameW IsChild SetTimer KillTimer PtInRect DefWindowProcW InflateRect GetSystemMetrics BeginPaint EndPaint PostMessageW CreateDialogParamW DrawStateW DrawTextW GetWindowTextW GetWindowTextLengthW RedrawWindow LoadBitmapW TrackMouseEvent SetWindowTextW InvalidateRgn ReleaseDC GetDC ScreenToClient MoveWindow GetSysColor PostQuitMessage GetDlgItem SetDlgItemTextW IsDlgButtonChecked CheckDlgButton EnableWindow IsWindowVisible IsWindowEnabled

gdi32

DeleteDC SelectObject SetBkMode SetTextColor ExtTextOutW SetBkColor GetObjectW CreateCompatibleDC SetViewportOrgEx CreateCompatibleBitmap CreateFontIndirectW BitBlt GetDeviceCaps CreateSolidBrush GetStockObject DeleteObject

advapi32

GetUserNameW RegEnumKeyW RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW

shell32

CommandLineToArgvW ShellExecuteExW

ole32

CLSIDFromProgID CoTaskMemAlloc CoTaskMemRealloc OleUninitialize CoCreateInstance CreateStreamOnHGlobal CLSIDFromString OleInitialize CoGetClassObject OleLockRunning StringFromGUID2 CoInitialize CoUninitialize CoTaskMemFree

oleaut32

VariantClear OleCreateFontIndirect LoadRegTypeLi LoadTypeLi OleLoadPicture VariantInit SysAllocString SysAllocStringLen SysStringLen SysFreeString VarUI4FromStr

shlwapi

StrChrW PathFindFileNameW PathCombineW PathAppendW

comctl32

InitCommonControlsEx ImageList_Destroy _TrackMouseEvent ImageList_GetIconSize ImageList_Draw ImageList_Create ImageList_Add

urlmon

ObtainUserAgentString URLDownloadToCacheFileW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueW

crypt32

CertCloseStore CryptMsgClose CryptQueryObject CryptMsgGetParam CryptDecodeObject CertFindCertificateInStore CertGetNameStringW CertFreeCertificateContext

Sharing

General

Malware Config

Signatures

File Explorer

a0367cf21a05dad780a3054dd4c5dbb0_NeikiAnalytics.exe

PE Signature issue

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

urlmon

version

crypt32

generic