458cf3dc427e702ede15bd495c001eb0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

458cf3dc427e702ede15bd495c001eb0_NeikiAnalytics.exe
Size

20KB
MD5

458cf3dc427e702ede15bd495c001eb0
SHA1

66d3b49274ba393d967887f8da805fa564471174
SHA256

16a219e70ed378af43200f749e06bd5512fc0f047f7b71b9b99722e2a392d525
SHA512

14b0272d65a3d7987bc40f67a7101354170141c79892842691fd897eb565740ece2178764c6e6795cdcf2d099a84963ba4ffd519ae9925d30385841eeebaac8f
SSDEEP

384:xPHEzV1PNqsHK1LXci2jXHUIG652iqis9QlcffyqGe+:xPkzLFvKpMi2jXHUN65kisKl4qp

Score

1^/10

Malware Config

Signatures

Files

458cf3dc427e702ede15bd495c001eb0_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

13f40932178d5ec2f8cfffdc5fa85c7b

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

44:65:37:57:7b:12:35:bc:8f:40:d2:cf:98:8b:a4:5c:64:b0:48:4d
Signer

Actual PE Digest

44:65:37:57:7b:12:35:bc:8f:40:d2:cf:98:8b:a4:5c:64:b0:48:4d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

t:\licensing\x86\ship\0\ospprearm.pdb

Imports

msvcr90

_except_handler4_common
_decode_pointer
_controlfp_s
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_invoke_watson
printf

ole32

CLSIDFromString

kernel32

RaiseException
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GetLastError
LoadLibraryA
FreeLibrary

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

13f40932178d5ec2f8cfffdc5fa85c7b

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:cf:3e:00:00:00:00:00:0fCertificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:05:a2:30:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

44:65:37:57:7b:12:35:bc:8f:40:d2:cf:98:8b:a4:5c:64:b0:48:4dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr90

ole32

kernel32

Sections

.text Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 924B

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 12KB - Virtual size: 12KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

44:65:37:57:7b:12:35:bc:8f:40:d2:cf:98:8b:a4:5c:64:b0:48:4d
Signer

.text
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 924B

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 12KB - Virtual size: 12KB