28f24f38e8916490ce254027b2174490_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

28f24f38e8916490ce254027b2174490_NeikiAnalytics.exe
Size

720KB
MD5

28f24f38e8916490ce254027b2174490
SHA1

2193a53e2eb57609614dbeb1bc40e40e9c710ee8
SHA256

b529456ac3d55e750eeb529f4396081b6cc92fab1900070d6d658804170eed71
SHA512

2713c6a212282cd2d6beb706049c4319970be357d1ed559813e561fc995afc4dddc0d0731d901b9f07af3465a59ade1b3f5ee922be59d9f124817f4169ccfa40
SSDEEP

6144:BJUftjXuhDIHKneRLS6dxSs55FHNGzFyp3sqzpTZFCQOVimH7YGOZB0WoGAfDPV8:BJUMYKnkLS6d4sPGzFdoyQdo7W0fDnw

Score

1^/10

Malware Config

Signatures

Files

28f24f38e8916490ce254027b2174490_NeikiAnalytics.exe
.dll windows:5 windows x86 arch:x86

b66c3c68faa653f903afb3567c359ed9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3c:26:61:ea:77:4b:42:4b:97:ae:46:02:17:7b:75:f0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/02/2012, 00:00

Not After

14/03/2015, 23:59

Subject

CN=Infineon Technologies AG,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IFAG CCS TI SWT SW,O=Infineon Technologies AG,L=Augsburg,ST=Bavaria,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:c0:c8:22:66:8c:fa:75:1a:d4:87:27:e7:9a:bf:f1:fa:4e:7a:d6
Signer

Actual PE Digest

22:c0:c8:22:66:8c:fa:75:1a:d4:87:27:e7:9a:bf:f1:fa:4e:7a:d6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

V:\TPMCLIENT\Bin\Win32\Release\Psd.pdb

Imports

crypt32

CertGetEnhancedKeyUsage
CryptExportPublicKeyInfoEx
CertGetPublicKeyLength
CertDeleteCertificateFromStore
CertCreateCertificateContext
CertAddCertificateContextToStore
CertGetNameStringW
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore

netapi32

NetApiBufferFree
NetUserEnum

shlwapi

PathRenameExtensionW
PathRemoveFileSpecW
PathRemoveBackslashW
PathAddBackslashW
PathIsDirectoryW
PathFileExistsW

mpr

WNetGetConnectionW

mfc100u

ord3413
ord2068
ord1934
ord1298
ord4805
ord12951
ord7932
ord13392
ord12948
ord2407
ord9525
ord6711
ord948
ord11123
ord8179
ord10058
ord10412
ord3627
ord2981
ord2980
ord2756
ord5556
ord12606
ord2887
ord2884
ord7385
ord2417
ord14146
ord14148
ord14147
ord14145
ord14149
ord14132
ord14059
ord14060
ord8277
ord11081
ord3402
ord10937
ord13380
ord8112
ord1270
ord6247
ord10045
ord8393
ord2853
ord12724
ord11246
ord11244
ord1501
ord1508
ord1514
ord1512
ord1519
ord4388
ord4425
ord4396
ord4408
ord4404
ord4400
ord4430
ord4421
ord4392
ord4434
ord4413
ord4379
ord4383
ord4416
ord3999
ord290
ord3992
ord2136
ord13382
ord7109
ord13388
ord6156
ord2629
ord13127
ord285
ord5264
ord4512
ord7874
ord7524
ord11838
ord1233
ord13219
ord826
ord287
ord2528
ord7047
ord11333
ord320
ord869
ord13164
ord7914
ord2614
ord2077
ord12152
ord10725
ord12557
ord5276
ord2339
ord11116
ord3491
ord2952
ord2951
ord2852
ord11159
ord4642
ord4923
ord5115
ord8483
ord4901
ord5143
ord4645
ord4794
ord4623
ord6931
ord6932
ord6922
ord4792
ord7393
ord9333
ord8347
ord5828
ord381
ord4151
ord897
ord2195
ord4290
ord7357
ord11683
ord3846
ord1476
ord286
ord11330
ord2057
ord13396
ord2064
ord265
ord13415
ord11353
ord266
ord2062
ord6036
ord1450
ord5229
ord1310
ord4511
ord2620
ord280
ord902
ord296
ord1312
ord1300
ord1479
ord11801
ord12153
ord417
ord5852
ord4888
ord4890
ord11704
ord261
ord12800
ord11569
ord1285
ord7618
ord7619
ord1313
ord5231
ord7876
ord7227
ord2135
ord979
ord1440
ord1474
ord4478
ord14067
ord12147
ord409
ord1301
ord323
ord1873
ord1945
ord2088
ord2090
ord882
ord277
ord851
ord12802
ord12155
ord13253
ord1272
ord871
ord5813
ord12154
ord278
ord4519
ord981
ord4197
ord423
ord13168
ord4150
ord2151
ord14208
ord4959
ord4956
ord4216
ord2185
ord2665
ord11494
ord14203
ord421
ord11163
ord908
ord13605
ord2091
ord322
ord2055
ord2053
ord2080
ord1984
ord2045
ord408
ord1953
ord10960

msvcr100

memmove_s
wcsncpy_s
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_CRT_RTC_INITW
malloc
_gmtime64_s
wcsftime
wcstol
_snwprintf
toupper
strcmp
wcschr
_swprintf
wcscat_s
strcpy
wcscmp
wcscat
wcsrchr
rand
_itow
_recalloc
calloc
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memmove
_localtime64_s
_mktime64
_time64
iswdigit
_wtoi
free
memcmp
_purecall
wcsncpy
wcslen
memcpy_s
memcpy
wcscpy
memset
__CxxFrameHandler3
_CxxThrowException

kernel32

VirtualQuery
GetProcessHeap
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
QueryPerformanceCounter
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
WideCharToMultiByte
MulDiv
GetSystemTime
GetTempPathW
GetTempFileNameW
GetDiskFreeSpaceExW
GetStringTypeExW
GetFullPathNameW
VerSetConditionMask
VerifyVersionInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetComputerNameW
GetFileAttributesW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
CallNamedPipeW
SetLastError
LoadLibraryW
QueryDosDeviceW
GetDriveTypeW
DefineDosDeviceW
DeviceIoControl
GetWindowsDirectoryW
GetSystemDirectoryW
ReleaseMutex
CreateMutexW
CreateEventW
WaitForSingleObject
FindFirstFileW
FindNextFileW
FindClose
SetEndOfFile
GetVolumeInformationW
GetFileSizeEx
SetFilePointer
CreateFileW
ReadFile
DeleteFileW
SetFileAttributesW
MoveFileW
WriteFile
GetTickCount
LocalAlloc
InitializeCriticalSection
lstrlenA
MultiByteToWideChar
ExpandEnvironmentStringsW
SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
lstrlenW
GetModuleFileNameW
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleW
GetProcAddress
OpenEventW
SetEvent
Sleep
ResetEvent
FreeLibrary
LocalFree
GetLastError
GetCurrentProcess
GetCurrentThread
GlobalAlloc
CloseHandle
GlobalFree
LoadLibraryA

user32

LoadImageW
OpenInputDesktop
CloseDesktop
GetDC
ReleaseDC
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
DispatchMessageW
GetForegroundWindow
GetWindowThreadProcessId
SetFocus
SetForegroundWindow
BroadcastSystemMessageW
wsprintfW
PostMessageW
EnableWindow
SendMessageW
LoadIconW
LoadStringW
AttachThreadInput

gdi32

CreateFontW
GetDeviceCaps

advapi32

GetLengthSid
GetTokenInformation
OpenThreadToken
OpenProcessToken
FreeSid
CopySid
LookupAccountSidW
AllocateAndInitializeSid
GetAce
GetNamedSecurityInfoW
AddAccessAllowedAce
InitializeAcl
SetNamedSecurityInfoW
SetFileSecurityW
SetSecurityDescriptorDacl
FileEncryptionStatusW
DecryptFileW
RegLoadKeyW
RegUnLoadKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSidToSidW
CheckTokenMembership
CryptDecrypt
CryptEncrypt
CryptImportKey
CryptVerifySignatureW
CryptSignHashW
RegEnumKeyExW
RegDeleteKeyW
RegEnumValueW
RegDeleteValueW
RegOpenCurrentUser
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegCreateKeyExW
RegSetValueExW
CryptGetUserKey
CryptDestroyKey
IsValidSid
InitializeSecurityDescriptor
ConvertSidToStringSidW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
GetUserNameW
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorDacl
StartServiceW
QueryServiceStatusEx
QueryServiceConfigW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AddAccessDeniedAce
LookupAccountNameW

shell32

ord4
ord2
SHGetDesktopFolder
SHBrowseForFolderW
SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHGetMalloc
SHChangeNotify
SHFileOperationW
SHGetFolderPathW

ole32

CoCreateGuid
StringFromCLSID
CoCreateInstanceEx
CoSetProxyBlanket
CoCreateInstance
OleRun
CoTaskMemFree

oleaut32

SysStringByteLen
SysAllocStringByteLen
VariantChangeType
SafeArrayRedim
SafeArrayUnlock
SafeArrayLock
SafeArrayDestroy
SafeArrayCreate
VariantCopy
SysStringLen
GetErrorInfo
LoadRegTypeLi
SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SafeArrayGetVartype
SafeArrayCopy
VariantInit
SysFreeString
VariantCopyInd
VariantClear
SetErrorInfo
LoadTypeLi
CreateErrorInfo

msvcp100

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ

Exports

Exports

TestIntegrity
addRecoveryAgent
changeDriveImageGSX
checkDrive
createDriveImageGSX
createRecoveryAgent
deleteDriveImageGSX
driveImageFileOperation
enumDriveImagesGSX
enumDriveImagesShadow
enumMountedGSX
enumRecoveryAgents
exitGSX
getAllTpmUser
getDriveImageUserListGSX
getDriveOwner
getMountStatus
getMountStatusShadow
getTpmStatus
initGSX
isPrivateKeyAvailable
locateDrive
mountGSX
reLoadKeys
recover
refreshCert
removeRecoveryAgent
setDriveImageListGSX
setDriveImageUserListGSX
statusGSX
unmountAllGSX
unmountGSX
unrecover
upgradeDriveImage

Sections

.text
Size: 452KB - Virtual size: 452KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 109KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b66c3c68faa653f903afb3567c359ed9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

3c:26:61:ea:77:4b:42:4b:97:ae:46:02:17:7b:75:f0Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

22:c0:c8:22:66:8c:fa:75:1a:d4:87:27:e7:9a:bf:f1:fa:4e:7a:d6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

netapi32

shlwapi

mpr

mfc100u

msvcr100

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp100

Exports

Exports

Sections

.text Size: 452KB - Virtual size: 452KB

.rdata Size: 121KB - Virtual size: 120KB

.data Size: 109KB - Virtual size: 128KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 29KB - Virtual size: 29KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

3c:26:61:ea:77:4b:42:4b:97:ae:46:02:17:7b:75:f0
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

22:c0:c8:22:66:8c:fa:75:1a:d4:87:27:e7:9a:bf:f1:fa:4e:7a:d6
Signer

.text
Size: 452KB - Virtual size: 452KB

.rdata
Size: 121KB - Virtual size: 120KB

.data
Size: 109KB - Virtual size: 128KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 29KB - Virtual size: 29KB