a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe
Size 9.5MB
Sample240603-qa99nsfc91
SHA256 8a205eb2de82354fba17ef8793ba5f99cfcb3a8b830f485d0fe0f7b2833065d9
MD5 a45e2482beb82d36042e23a506a1ffd0
SHA1 3d07fcb1ccd7a96e65a4942ae31ea4b59aa3a362
SHA512 0c98d9c8ace3f0c9d4dc26895935e1ca32739051ca6fcf3bcea392b2a66e5156931a7ab1f5c6580ba4638345c228a7d37c7e396ed079f5c709f9d9581a7ebd62
SSDEEP 196608:jSeE2E7TdIyHRhCrtAriSzyRKKYFBlags9qltnoFbaxc4GBGiadQSs0nqVCrxsp:jSJN57eKiJCUSnaax4QlQShkCr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$LOCALAPPDATA/arphaCrashReport/arphadump64.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsProcess.dll

File Explorer

a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe

.exe 9.5MB
$LOCALAPPDATA/arphaCrashReport/app.dat

8.9MB
$LOCALAPPDATA/arphaCrashReport/arphaCrashReport64.exe

.exe 233KB
$LOCALAPPDATA/arphaCrashReport/arphadump64.dll

.dll 3.4MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/nsProcess.dll

.dll 4KB

a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 8a205eb2de82354fba17ef8793ba5f99cfcb3a8b830f485d0fe0f7b2833065d9
MD5 a45e2482beb82d36042e23a506a1ffd0
SHA1 3d07fcb1ccd7a96e65a4942ae31ea4b59aa3a362
SHA512 0c98d9c8ace3f0c9d4dc26895935e1ca32739051ca6fcf3bcea392b2a66e5156931a7ab1f5c6580ba4638345c228a7d37c7e396ed079f5c709f9d9581a7ebd62
SSDEEP 196608:jSeE2E7TdIyHRhCrtAriSzyRKKYFBlags9qltnoFbaxc4GBGiadQSs0nqVCrxsp:jSJN57eKiJCUSnaax4QlQShkCr
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

94:61:68:f0:3b:d9:27:71:00:3c:92:d9:cd:86:44:a2:4c:d0:5d:8d:b2:c6:26:c2:4b:e6:0e:10:d0:0e:ca:3b

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Sangfor Technologies Inc.,OU=research and development department,O=Sangfor Technologies Inc.,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jan 7, 2020

CN=Sangfor Technologies Inc.,OU=research and development department,O=Sangfor Technologies Inc.,L=Shenzhen,ST=Guangdong,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

7d:2c:f2:c5:f2:f0:fb:f2:cc:66:7e:8a:72:91:a8:ab:24:66:32:8f

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Sangfor Technologies Inc.,OU=research and development department,O=Sangfor Technologies Inc.,L=Shenzhen,ST=Guangdong,C=CN

Chains

Jan 7, 2020

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - May 30, 2020

Subject

CN=Sangfor Technologies Inc.,OU=research and development department,O=Sangfor Technologies Inc.,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

01:1e:e5:96:44:38:85:4b:74:29:58:7c:12:3e:cf:12

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2019 - Mar 11, 2020

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Sangfor Technologies Inc.,OU=research and development department,O=Sangfor Technologies Inc.,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

02:68:49:b6:54:10:cd:f5:5a:e0:b0:64:df:83:f8:84

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2019 - Mar 11, 2020

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

13564

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$LOCALAPPDATA/arphaCrashReport/arphaCrashReport64.exe

IMPHASH 8b07da5ac377ada918d640ece1590145
SHA256 2b9a7960a5d7cc77318af937cadd47270fe5ada6e42067c241a2b9b0830c5f2c
MD5 da5f97cab6279eed78b6f1d47aa267ed
SHA1 6ae39162d0e1e32c0a8a51baaf3fab491a37c3f3
SHA512 a1fbc66ffbb99f09a91487b5d2bf9285e76184fe23d3045b5b1eee185943541a9bbcdfbf33acf5edc754d8d25cec2e5ad823d477f57f3bcf00ac11792a510552
SSDEEP 3072:TN9rZ5vuFomptSepjTxUPjfOgwXCtRLDya09M9EvoHmkQ/2Y8L0puG:PZ5qomPSeCx7tRNQjSo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Digest

dd:7e:e8:63:9d:ca:7f:9d:09:05:cb:28:3e:ab:79:d0:f5:07:7c:f8:3a:73:8d:f0:2d:6f:07:5e:e4:34:88:6b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91330100716105852F,CN=ALIBABA (CHINA) NETWORK TECHNOLOGY CO.\,LTD.,O=ALIBABA (CHINA) NETWORK TECHNOLOGY CO.\,LTD.,L=杭州市,ST=浙江省,C=CN,1.3.6.1.4.1.311.60.2.1.1=#0c21e69dade5b79ee9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 14, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

66:76:d0:c4:15:89:e7:5f:9a:85:17:8f:d1:67:4b:3a:94:bb:a2:c0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

May 23, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:57:ec:d1:bb:fa:85:dd:ca:ca:78:bf:7a:23:68:3d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 29, 2021 - Aug 21, 2024

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

0e:57:ec:d1:bb:fa:85:dd:ca:ca:78:bf:7a:23:68:3d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 29, 2021 - Aug 21, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

59940

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\jenkins\workspace\ci.arphasdk.build\qtc_out\Release_X64\arphaCrashReport64.exe.pdb

arphadump64

SetWindowLocalDump GetArphaCrashReport GetArphaUtils

shlwapi

PathFileExistsW PathStripPathW PathRemoveFileSpecW

kernel32

HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte GetCommandLineW SetLastError EnterCriticalSection LeaveCriticalSection GetCurrentThreadId FindResourceExW FreeLibrary GetModuleFileNameW GetModuleHandleW HeapFree LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW LocalFree lstrcmpiW GetPrivateProfileStringW CreateFileW GetFileAttributesExW GetFileSize ReadFile CloseHandle CreateProcessW HeapReAlloc HeapAlloc GetProcAddress HeapDestroy GetLastError RaiseException DecodePointer LCMapStringW GetConsoleMode FreeEnvironmentStringsW GetEnvironmentStringsW GetConsoleCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType WriteFile GetStdHandle GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW WaitForSingleObjectEx ResetEvent SetEvent LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache GetCurrentProcess WriteConsoleW IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList

gdi32

CreateFontW GetStockObject

advapi32

RegSetValueExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCloseKey

shell32

ExtractIconExW ShellExecuteW CommandLineToArgvW

ole32

CoTaskMemFree CoUninitialize CoTaskMemAlloc CoInitialize CoCreateInstance CoTaskMemRealloc

oleaut32

VarUI4FromStr

user32

IsWindowVisible ShowWindow PostThreadMessageW PostMessageW GetMonitorInfoW MonitorFromWindow GetWindow GetParent GetWindowLongW MapWindowPoints GetWindowRect GetClientRect SetDlgItemTextW EndDialog SetWindowPos IsWindow SendMessageW SetWindowLongPtrW CharNextW CreateDialogParamW DestroyWindow PeekMessageW DispatchMessageW TranslateMessage GetMessageW UnregisterClassW CheckDlgButton IsDlgButtonChecked GetActiveWindow SetTimer KillTimer GetWindowThreadProcessId LoadIconW IsDialogMessageW DialogBoxParamW EnableWindow SetWindowTextW UpdateWindow GetDlgItem

comctl32

InitCommonControlsEx

$LOCALAPPDATA/arphaCrashReport/arphadump64.dll

IMPHASH 9447f3e39209723f98fb27738b787aa9
SHA256 a5736a1535c81b3a15a5589cc0717a20e05fce0201bed7be96dbacca1fc47da2
MD5 daacd794a6cbf927804a158cfaf14b09
SHA1 a8247e9ee7c40423d0a8e14a41dc2713699c7860
SHA512 edc0abfcc92ab51cc2578d2b0288b4df3af6aad02f983303073a137e0b8fbcb25e0c151e386fbe0b2dca279645cfc50fd53192c655af5884e8d8d2846d5f6686
SSDEEP 98304:fCJTfEYHRjVHPCIq6UC98RRMjQNJX/sipEC2:GTsIpqkUCe4QvX/5p4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentThread Sleep FreeConsole GetProcAddress LoadLibraryA GetModuleFileNameA SuspendThread SetEndOfFile CreateFileW EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetCurrentThreadId FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW HeapSetInformation GetVersion HeapCreate HeapDestroy GetModuleHandleW ExitProcess ReadFile SetFilePointer WriteFile GetConsoleCP GetConsoleMode FlushFileBuffers CloseHandle FlsGetValue FlsFree SetLastError FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameW GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW HeapReAlloc LoadLibraryW SetStdHandle WriteConsoleW CreateFileA GetProcessHeap

user32

ShowWindow

Name

.text

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.(/7

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

702B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH 439074d1c01f7b16781bdf060930814a
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

a45e2482beb82d36042e23a506a1ffd0_NeikiAnalytics.exe

PE Signature issue

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$LOCALAPPDATA/arphaCrashReport/app.dat

$LOCALAPPDATA/arphaCrashReport/arphaCrashReport64.exe

arphadump64

shlwapi

kernel32

gdi32

advapi32

shell32

ole32

oleaut32

user32

comctl32

generic

$LOCALAPPDATA/arphaCrashReport/arphadump64.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

user32

generic