3f1b43efa98e63c7edb14481b820dc20_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3f1b43efa98e63c7edb14481b820dc20_NeikiAnalytics.exe
Size

241KB
MD5

3f1b43efa98e63c7edb14481b820dc20
SHA1

ba1a947929d44ddba3e92d815481b9341fc29669
SHA256

a982cc037b2d915cd699526428d9519642fd3c0664e6840adbbfa8c57912762f
SHA512

b368004722ea07049ae8a5c07a0c51e080772985e234c5e952ec19a20702ab51f6d7f42012d25677f56adbc3c2c8be4df82a44dab9b375f5cb56e8e542f074c0
SSDEEP

3072:3V4bsjtt19ioKluglwbNcYBtpgaPEnF9cgv9zO+kb3N1/pQuVjjL2m1Is:j9ioKlLiGnncgv9zO+kbriuVjPlus

Score

1^/10

Malware Config

Signatures

Files

3f1b43efa98e63c7edb14481b820dc20_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

d1f6f245eddcf03b1c9d6e71091a5502

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:32

Not After

01/09/2022, 18:32

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fa:d6:af:34:06:bc:83:b6:b1:67:cb:43:41:32:a5:32:8c:c6:3f:db:6b:1c:a7:e5:b0:22:85:4e:21:47:e2:7b
Signer

Actual PE Digest

fa:d6:af:34:06:bc:83:b6:b1:67:cb:43:41:32:a5:32:8c:c6:3f:db:6b:1c:a7:e5:b0:22:85:4e:21:47:e2:7b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\a01\_work\14\s\\binaries\x86ret\bin\i386\cpfecl.iOS.x64.pdb

Imports

advapi32

CryptGenRandom
EventWriteTransfer

kernel32

FindFirstFileW
GetCurrentProcess
GetModuleFileNameW
GetEnvironmentVariableW
InitializeCriticalSectionEx
FindClose
GetCurrentThreadId
GetLastError
CloseHandle
RaiseException
GetSystemInfo
DecodePointer
GetProcAddress
DeleteCriticalSection
GetModuleHandleW
FreeLibrary
VirtualQuery
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetConsoleOutputCP
WriteFile
GetACP
GetConsoleMode
LoadResource
FindResourceW
WideCharToMultiByte
GetFileType
QueryPerformanceCounter
VirtualFree
VirtualAlloc
UnmapViewOfFile
MapViewOfFileEx
GetCurrentProcessId
HeapFree
FindNextFileW
GetUserDefaultUILanguage
EncodePointer
HeapAlloc
GetProcessHeap
CreateEventW
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
OutputDebugStringW
UnhandledExceptionFilter

vcruntime140

__std_exception_copy
__std_exception_destroy
memmove
wcschr
wcsstr
wcsrchr
_except_handler4_common
__CxxFrameHandler3
memcpy
memset
__std_type_info_destroy_list
_CxxThrowException

api-ms-win-crt-string-l1-1-0

towlower
wcsspn
_wcsupr_s
wcsncpy_s
_wcsdup
wcscat_s
wcscpy_s
iswdigit
wcsncat_s
iswspace
_wcsicmp
wcsncmp

api-ms-win-crt-runtime-l1-1-0

__doserrno
exit
_invalid_parameter_noinfo_noreturn
_errno
_invalid_parameter_noinfo
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll

api-ms-win-crt-filesystem-l1-1-0

_wfullpath
_wmakepath_s
_waccess_s
_wsplitpath_s
_wunlink

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf
_wfsopen
_write
_get_osfhandle
puts
__stdio_common_vswscanf
fgetws
fclose
feof
__stdio_common_vfwprintf

api-ms-win-crt-convert-l1-1-0

_itow_s
wcstoul
_wtoi

api-ms-win-crt-environment-l1-1-0

_wgetenv_s
_wdupenv_s

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc

api-ms-win-crt-conio-l1-1-0

_cputws

msvcp140

?_Xlength_error@std@@YAXPBD@Z

api-ms-win-crt-math-l1-1-0

ceil

Exports

Exports

get_integer_kind
get_ptr_to_member_sizing_kind
get_supports_arm32
get_supports_arm64
get_supports_x86_64
get_target_sizes
translate_cpfe_args

Sections

.text
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d1f6f245eddcf03b1c9d6e71091a5502

Code Sign

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

fa:d6:af:34:06:bc:83:b6:b1:67:cb:43:41:32:a5:32:8c:c6:3f:db:6b:1c:a7:e5:b0:22:85:4e:21:47:e2:7bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-conio-l1-1-0

msvcp140

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 213KB - Virtual size: 213KB

.data Size: 5KB - Virtual size: 20KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 1024B - Virtual size: 984B

.reloc Size: 7KB - Virtual size: 7KB

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

fa:d6:af:34:06:bc:83:b6:b1:67:cb:43:41:32:a5:32:8c:c6:3f:db:6b:1c:a7:e5:b0:22:85:4e:21:47:e2:7b
Signer

.text
Size: 213KB - Virtual size: 213KB

.data
Size: 5KB - Virtual size: 20KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1024B - Virtual size: 984B

.reloc
Size: 7KB - Virtual size: 7KB