776a9c64529155f7c408292ba6fdb660_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
776a9c64529155f7c408292ba6fdb660_NeikiAnalytics.exe
Size 901KB
Sample240608-q489gada85
SHA256 b915706a3f5ba4818bc0d0e4e507c075066383a09cc8356f583ce16332c82fab
MD5 776a9c64529155f7c408292ba6fdb660
SHA1 aced5a4eda0300c7df4b4e40fa81a038f1ee76d1
SHA512 e2a8096ae9a5a4585ed0b9341db06faed02cb40c46452626aa60c3dd328499347e263ba71798411a743fcec5092efa54e91db39f7cf602e63f3c5dfa53030767
SSDEEP 12288:0r9shsglMJF15Yj43MNB2Yot0q3+ZeW45+6/rcxJ9RmlJDs9GvNBjvrEH7L:E9VRJF15Yc3SgJb+4z/UYkiDrEH7L
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

776a9c64529155f7c408292ba6fdb660_NeikiAnalytics.exe

.dll 901KB

776a9c64529155f7c408292ba6fdb660_NeikiAnalytics.exe

IMPHASH f79ae1492c9d2acb7252931fd0164382
SHA256 b915706a3f5ba4818bc0d0e4e507c075066383a09cc8356f583ce16332c82fab
MD5 776a9c64529155f7c408292ba6fdb660
SHA1 aced5a4eda0300c7df4b4e40fa81a038f1ee76d1
SHA512 e2a8096ae9a5a4585ed0b9341db06faed02cb40c46452626aa60c3dd328499347e263ba71798411a743fcec5092efa54e91db39f7cf602e63f3c5dfa53030767
SSDEEP 12288:0r9shsglMJF15Yj43MNB2Yot0q3+ZeW45+6/rcxJ9RmlJDs9GvNBjvrEH7L:E9VRJF15Yc3SgJb+4z/UYkiDrEH7L
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

3b:53:6d:43:30:0d:84:84:d7:b7:ed:94:2f:1e:d5:bf:ab:70:fd:58:58:d6:96:1b:bf:90:de:06:b2:32:a2:eb

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=709505-8,CN=Lavasoft Software Canada Inc.,O=Lavasoft Software Canada Inc.,L=Saint-Laurent,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

Jan 12, 2023

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

Serial Number

6d:a0:e6:f8:3a:7c:ae:b1:58:d4:35:2b:4f:32:43:91

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 2, 2022 - Mar 19, 2023

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

9718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dev\sqlite\dotnet\bin\2008\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

kernel32

SetEndOfFile FreeLibrary HeapAlloc SystemTimeToFileTime QueryPerformanceCounter HeapFree WaitForSingleObject InterlockedCompareExchange UnlockFile LockFile OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap GetSystemTimeAsFileTime FormatMessageA WriteFile InitializeCriticalSection WideCharToMultiByte LoadLibraryW Sleep FormatMessageW GetVersionExW HeapDestroy LeaveCriticalSection GetFileAttributesA HeapCreate HeapValidate GetFileAttributesW UnmapViewOfFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW GetLastError GetProcAddress HeapSize LockFileEx EnterCriticalSection GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA CreateFileMappingW GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW DeleteCriticalSection OutputDebugStringA GetVersionExA CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA LocalFree GetSystemTime AreFileApisANSI DeleteFileA MapViewOfFile GetFullPathNameW SetFilePointer HeapCompact CreateMutexW GetFileSize CreateFileA HeapReAlloc GetFullPathNameA ReadFile GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree VirtualAlloc GetTimeZoneInformation GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW RaiseException InitializeCriticalSectionAndSpinCount RtlUnwind GetStringTypeA GetStringTypeW GetLocaleInfoA GetModuleHandleA GetConsoleCP GetConsoleMode CompareStringA CompareStringW SetEnvironmentVariableA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle

advapi32

CryptDeriveKey CryptHashData CryptDestroyHash CryptDecrypt CryptDestroyKey CryptCreateHash CryptEncrypt CryptDuplicateKey CryptAcquireContextW

_interop_compileoption_get@4 _interop_compileoption_used@4 _interop_libversion@0 _interop_sourceid@0 _sqlite3_backup_finish_interop@4 _sqlite3_bind_double_interop@12 _sqlite3_bind_int64_interop@12 _sqlite3_bind_parameter_name_interop@12 _sqlite3_changes_interop@4 _sqlite3_close_interop@4 _sqlite3_column_database_name16_interop@12 _sqlite3_column_database_name_interop@12 _sqlite3_column_decltype16_interop@12 _sqlite3_column_decltype_interop@12 _sqlite3_column_double_interop@12 _sqlite3_column_int64_interop@12 _sqlite3_column_name16_interop@12 _sqlite3_column_name_interop@12 _sqlite3_column_origin_name16_interop@12 _sqlite3_column_origin_name_interop@12 _sqlite3_column_table_name16_interop@12 _sqlite3_column_table_name_interop@12 _sqlite3_column_text16_interop@12 _sqlite3_column_text_interop@12 _sqlite3_context_collcompare_interop@20 _sqlite3_context_collseq_interop@16 _sqlite3_create_disposable_module_interop@112 _sqlite3_create_function_interop@36 _sqlite3_cursor_rowid_interop@12 _sqlite3_errmsg_interop@8 _sqlite3_finalize_interop@4 _sqlite3_index_column_info_interop@32 _sqlite3_last_insert_rowid_interop@8 _sqlite3_malloc_size_interop@4 _sqlite3_memory_highwater_interop@8 _sqlite3_memory_used_interop@4 _sqlite3_open16_interop@12 _sqlite3_open_interop@12 _sqlite3_prepare16_interop@24 _sqlite3_prepare_interop@24 _sqlite3_reset_interop@4 _sqlite3_result_double_interop@8 _sqlite3_result_int64_interop@8 _sqlite3_table_column_metadata_interop@44 _sqlite3_table_cursor_interop@12 _sqlite3_value_double_interop@8 _sqlite3_value_int64_interop@8 _sqlite3_value_text16_interop@8 _sqlite3_value_text_interop@8 sqlite3_activate_see sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_cancel_auto_extension sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_disposable_module sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_data_directory sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_dispose_module sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errstr sqlite3_exec sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_key sqlite3_key_v2 sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_percentile_init sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_regexp_init sqlite3_rekey sqlite3_rekey_v2 sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_value sqlite3_result_zeroblob sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_step sqlite3_stmt_busy sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strglob sqlite3_stricmp sqlite3_strnicmp sqlite3_table_column_metadata sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_totype_init sqlite3_trace sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_config sqlite3_vtab_on_conflict sqlite3_vtshim_init sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_compact_heap sqlite3_win32_mbcs_to_utf8 sqlite3_win32_reset_heap sqlite3_win32_set_directory sqlite3_win32_sleep sqlite3_win32_utf8_to_mbcs sqlite3_win32_write_debug

Sharing

General

Malware Config

Signatures

File Explorer

776a9c64529155f7c408292ba6fdb660_NeikiAnalytics.exe

PE Signature issue

kernel32

advapi32

generic