3c28fcf34fed50fe88c6e14ad99d4d70_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3c28fcf34fed50fe88c6e14ad99d4d70_NeikiAnalytics.exe
Size

6.3MB
MD5

3c28fcf34fed50fe88c6e14ad99d4d70
SHA1

29527041cb8cdf77fe299ab295de921524e15b08
SHA256

e2e1a82706204dd9540c376207c9314855933821fda7115acc7eb861461e9e8a
SHA512

0698cf616aa2472416a829a8972c30b537dab7d731e1b9c5cf0fe4a49a4c265b2fa3ac6ba0a1a946ce8d639751b8e96f9b7ed9320ec74da65a09e6ed5f3b9fd1
SSDEEP

196608:IgyDaxsTu/4O+QkPZICmouIDJJZl/fJbu2bY:WaEuB+QkPZICmoxQF

Score

1^/10

Malware Config

Signatures

Files

3c28fcf34fed50fe88c6e14ad99d4d70_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

3b14e5b8becc31595cbf70d9c1652862

Code Sign

11:21:35:2e:0b:20:23:d1:a7:51:88:6d:cb:e9:7d:37:79:5e
Certificate

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

21/02/2014, 16:58

Not After

30/05/2015, 17:52

Subject

CN=Disc Soft Ltd,O=Disc Soft Ltd,L=Belize city,ST=Belize,C=BZ,1.2.840.113549.1.9.1=#0c1366696e707240646973632d736f66742e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

13/04/2019, 10:00

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9d:de:1e:6e:dd:af:31:c8:98:50:cd:23:17:02:6a:84:b5:76:18:47
Signer

Actual PE Digest

9d:de:1e:6e:dd:af:31:c8:98:50:cd:23:17:02:6a:84:b5:76:18:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\Projects\DTNetWorking\ui\NetworkManager\Release\DTNetMgr.pdb

Imports

netapi32

NetApiBufferFree
NetServerEnum

dtcommonres

_AboutDialogShow@8

kernel32

GetThreadPriority
GetPriorityClass
SetPriorityClass
IsBadReadPtr
IsBadWritePtr
SetEnvironmentVariableA
GetModuleHandleA
GetCurrencyFormatW
GetUserDefaultLangID
GetVersionExA
InterlockedPopEntrySList
VirtualFree
InterlockedPushEntrySList
InterlockedCompareExchange
WriteConsoleW
EnumSystemLocalesA
LockResource
GetConsoleMode
LoadResource
GetConsoleCP
GetTimeZoneInformation
LCMapStringW
GetStringTypeW
FindResourceW
IsValidCodePage
GetOEMCP
GetACP
SizeofResource
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
HeapDestroy
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
GetFileType
SetStdHandle
VirtualQuery
VirtualAlloc
HeapQueryInformation
HeapSize
ExitProcess
HeapReAlloc
RtlUnwind
GetDateFormatW
GetTimeFormatW
ExitThread
EncodePointer
DecodePointer
GetStartupInfoW
HeapSetInformation
GetCommandLineW
VirtualProtect
SearchPathW
GetProfileIntW
GetFileTime
GetFileSizeEx
GetFileAttributesW
FileTimeToLocalFileTime
GetFileAttributesExW
SetErrorMode
GetNumberFormatW
GetWindowsDirectoryW
GetFullPathNameW
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
lstrcmpiW
GetCurrentDirectoryW
SystemTimeToFileTime
GetComputerNameW
GetProcessId
GetCurrentProcess
FileTimeToSystemTime
GetThreadLocale
lstrcpyW
GetSystemDirectoryW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GlobalFlags
GetPrivateProfileIntW
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
InterlockedExchange
GlobalGetAtomNameW
lstrcmpA
ResumeThread
SetThreadPriority
CopyFileW
GlobalSize
InterlockedDecrement
ReleaseActCtx
CreateActCtxW
FreeResource
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
lstrcmpW
ActivateActCtx
DeactivateActCtx
SetLastError
GlobalMemoryStatus
GetThreadTimes
GetProcessTimes
GetProcessWorkingSetSize
GetStartupInfoA
QueryPerformanceCounter
VirtualLock
VirtualUnlock
GetPrivateProfileStringW
WritePrivateProfileStringW
GetVolumeInformationW
DeleteFileW
GetSystemInfo
FindClose
OpenMutexW
FormatMessageW
GetSystemTimeAsFileTime
GetModuleHandleW
GetUserDefaultLCID
FindResourceExW
GetLocaleInfoA
lstrlenA
FindFirstFileW
GlobalAddAtomW
DeleteAtom
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
RaiseException
HeapFree
FlushInstructionCache
HeapAlloc
GetProcessHeap
GetCurrentProcessId
LocalFree
GetCurrentThread
MulDiv
lstrlenW
GetVersionExW
LoadLibraryExW
MoveFileExW
GetTickCount
GetTempFileNameW
GetTempPathW
DisconnectNamedPipe
CreateFileW
GetModuleFileNameW
ReadFile
WriteFile
WaitNamedPipeW
CreateProcessW
InitializeCriticalSection
InterlockedIncrement
EnterCriticalSection
WideCharToMultiByte
Sleep
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
ReleaseMutex
GetCurrentThreadId
OpenEventW
CreateMutexW
GetProcAddress
GetLastError
LoadLibraryW
CreateThread
WaitForSingleObject
SetEvent
WaitForMultipleObjects
CreateEventW
CloseHandle
MultiByteToWideChar
LeaveCriticalSection
DeleteCriticalSection
IsValidLocale
WinExec

user32

WinHelpW
IsChild
GetClassLongW
GetClassNameW
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
DestroyWindow
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
ValidateRect
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetMenuState
CheckMenuItem
GetDlgCtrlID
IsDialogMessageW
SendDlgItemMessageW
MapVirtualKeyW
GetKeyNameTextW
GetCapture
GetClipboardOwner
GetClipboardViewer
GetDesktopWindow
GetInputState
GetMessagePos
GetMessageTime
GetOpenClipboardWindow
GetProcessWindowStation
GetQueueStatus
GetCaretPos
GetWindowRgn
WindowFromDC
DestroyCursor
IsCharAlphaNumericW
IsRectEmpty
SetParent
SetRectEmpty
SetRect
RedrawWindow
SetCursor
RemovePropW
SetCapture
LoadCursorW
PtInRect
SetPropW
ReleaseCapture
GetPropW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
UnhookWindowsHookEx
UpdateWindow
SetFocus
CheckDlgButton
SetWindowsHookExW
CallNextHookEx
IsWindow
MessageBeep
LoadImageW
DialogBoxIndirectParamW
GetDialogBaseUnits
InflateRect
DrawFocusRect
SystemParametersInfoW
DrawIconEx
CallWindowProcW
DefWindowProcW
IsWindowEnabled
GetDlgItemTextW
GetWindowTextLengthW
GetCursorPos
MonitorFromWindow
GetMonitorInfoW
CreateWindowExW
ShowWindow
DialogBoxParamW
EndPaint
GetSysColorBrush
SendDlgItemMessageA
GetMenuItemInfoW
DestroyMenu
GetMenuStringW
RemoveMenu
InsertMenuW
AppendMenuW
GetNextDlgTabItem
CreateDialogIndirectParamW
TranslateMessage
GetMessageW
TranslateAcceleratorW
BringWindowToTop
IntersectRect
CreatePopupMenu
InsertMenuItemW
IsIconic
LoadAcceleratorsW
FrameRect
BeginPaint
EndDialog
GetActiveWindow
SetDlgItemTextW
EnableMenuItem
GetSystemMenu
GetDlgItem
IsWindowVisible
ReleaseDC
DestroyIcon
ReuseDDElParam
UnpackDDElParam
WindowFromPoint
TabbedTextOutW
DrawTextExW
GrayStringW
ClientToScreen
GetWindowDC
SubtractRect
MapVirtualKeyExW
IsCharLowerW
GetDoubleClickTime
CharUpperBuffW
SendMessageW
LoadMenuW
SetMenuDefaultItem
GetSubMenu
EnableWindow
GetWindowRect
ScreenToClient
LoadMenuIndirectW
GetCursor
SystemParametersInfoA
CreateIconIndirect
GetClipboardData
UnregisterClassA
OffsetRect
MoveWindow
GetSystemMetrics
GetMenuItemCount
GetMenuItemID
ModifyMenuW
GetTopWindow
GetWindow
GetWindowTextW
SetWindowTextW
GetSysColor
PostMessageW
GetFocus
RegisterWindowMessageW
LoadIconW
DeleteMenu
SetForegroundWindow
GetAsyncKeyState
GetWindowLongW
GetClientRect
InvalidateRect
SetTimer
KillTimer
GetParent
CopyRect
DrawTextW
SetWindowPos
MessageBoxW
GetWindowThreadProcessId
AllowSetForegroundWindow
GetForegroundWindow
AttachThreadInput
FillRect
DrawIcon
SetWindowLongW
GetIconInfo
LoadBitmapW
GetDC
CopyIcon
GetUpdateRect
IsClipboardFormatAvailable
WaitMessage
CreateMenu
IsMenu
UpdateLayeredWindow
MonitorFromPoint
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
EnableScrollBar
HideCaret
InvertRect
GetMenuDefaultItem
SetCursorPos
IsZoomed
PostQuitMessage
RegisterClipboardFormatW
MapDialogRect
SetWindowContextHelpId
ShowOwnedPopups
RealChildWindowFromPoint
CopyImage
EnumDisplayMonitors
SetLayeredWindowAttributes
UnregisterClassW
UnionRect
GetDCEx
LockWindowUpdate
PostThreadMessageW
CharNextW
CopyAcceleratorTableW
InvalidateRgn
GetNextDlgGroupItem
CharUpperW
SetWindowRgn
DestroyAcceleratorTable
NotifyWinEvent
SetClassLongW
DrawStateW
DrawEdge
DrawFrameControl
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW

gdi32

SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
SelectPalette
GetObjectType
ExtCreatePen
CreateHatchBrush
SetRectRgn
CombineRgn
GetMapMode
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
StretchDIBits
GetBkColor
GetTextColor
GetRgnBox
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
OffsetViewportOrgEx
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
GetDIBits
StretchBlt
SetPixel
Rectangle
EnumFontFamiliesExW
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetNearestColor
GetBkMode
GetStretchBltMode
OffsetWindowOrgEx
SetPixelV
SetViewportExtEx
SetWindowOrgEx
SetViewportOrgEx
Escape
TextOutW
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
RestoreDC
SaveDC
CreateCompatibleBitmap
CopyMetaFileW
BitBlt
CreateCompatibleDC
CreateBitmap
CreateRectRgnIndirect
SetDIBits
CreateDIBSection
GetBitmapBits
PatBlt
CreateRectRgn
DPtoLP
CreatePen
CreateSolidBrush
DeleteDC
CreateDCW
RoundRect
SetBkMode
SetBkColor
ExtTextOutW
GetStockObject
SelectObject
GetDeviceCaps
DeleteObject
ScaleViewportExtEx
GetTextExtentPoint32W
SetTextColor
GetTextMetricsW
GetTextFaceW
CreateFontIndirectW
GetTextCharset
CreatePalette
GetObjectW
CreateEllipticRgnIndirect
GetDCOrgEx
ExtCreateRegion

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

RegQueryInfoKeyW
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
OpenThreadToken
GetTokenInformation
IsValidSid
ConvertSidToStringSidW
RegCreateKeyExW
RegQueryValueExW
RegDeleteKeyW
AllocateAndInitializeSid
FreeSid
RegOpenKeyExW
CheckTokenMembership
RegCloseKey
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegOpenKeyExA
RegQueryValueExA
CryptGenRandom
RegEnumKeyExW
RegDeleteValueW
QueryServiceStatusEx
StartServiceW
ChangeServiceConfig2W
CreateServiceW
OpenServiceW
InitializeSecurityDescriptor

shell32

SHGetPathFromIDListW
ShellExecuteExW
DuplicateIcon
ord680
DragFinish
SHBrowseForFolderW
SHGetMalloc
SHAppBarMessage
SHGetSpecialFolderLocation
ShellExecuteW
SHGetDesktopFolder
SHGetFileInfoW
DragQueryFileW

comctl32

ImageList_GetIconSize
_TrackMouseEvent
InitCommonControlsEx
ImageList_Duplicate

shlwapi

PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW

ole32

OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleSaveToStream
WriteClassStm
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleCreateMenuDescriptor
CoInitializeEx
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoGetClassObject
CoUninitialize
CoInitialize
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoCreateGuid
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
OleLoadFromStream
CoTaskMemFree
OleDestroyMenuDescriptor

oleaut32

VarBstrFromR8
VarDiv
OleCreatePictureIndirect
VarI4FromStr
VarR8FromStr
VarMul
OleCreateFontIndirect
VarBstrFromDate
VarCyFromStr
VarDateFromStr
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysStringLen
SysAllocString
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysFreeString

oledlg

OleUIBusyW

ws2_32

WSAGetLastError
WSAStartup
WSASetLastError
gethostbyaddr
getservbyport
ntohs
inet_ntoa
htonl
inet_addr
gethostbyname
htons
getservbyname

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

gdiplus

GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipFree
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 712KB - Virtual size: 711KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 95KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b14e5b8becc31595cbf70d9c1652862

Code Sign

11:21:35:2e:0b:20:23:d1:a7:51:88:6d:cb:e9:7d:37:79:5eCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:2f:4e:e1:35:5cCertificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

9d:de:1e:6e:dd:af:31:c8:98:50:cd:23:17:02:6a:84:b5:76:18:47Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

netapi32

dtcommonres

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

ws2_32

oleacc

gdiplus

imm32

winmm

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

.rdata Size: 712KB - Virtual size: 711KB

.data Size: 95KB - Virtual size: 135KB

.rsrc Size: 1.5MB - Virtual size: 1.5MB

.reloc Size: 392KB - Virtual size: 391KB

11:21:35:2e:0b:20:23:d1:a7:51:88:6d:cb:e9:7d:37:79:5e
Certificate

04:00:00:00:00:01:2f:4e:e1:35:5c
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

9d:de:1e:6e:dd:af:31:c8:98:50:cd:23:17:02:6a:84:b5:76:18:47
Signer

.text
Size: 3.6MB - Virtual size: 3.6MB

.rdata
Size: 712KB - Virtual size: 711KB

.data
Size: 95KB - Virtual size: 135KB

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

.reloc
Size: 392KB - Virtual size: 391KB