96078b78f7adca1b395b53e1b52a75f0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

96078b78f7adca1b395b53e1b52a75f0_NeikiAnalytics.exe
Size

154KB
MD5

96078b78f7adca1b395b53e1b52a75f0
SHA1

0ac1702e074319faa6dbdb0d0e37c4bde1b54ca1
SHA256

4442fe2be6f500735c28e3193fe2e0b5dbbb3b70eedbbbd289ed89db40f57869
SHA512

f91514f1629d6de8cfc14d65ae0daa7055ce5fbcfe5d37f204aff434c6de164767df5c910500a1a63f017231c36e9d82e5b9631631f3511e695d009f3530eafe
SSDEEP

3072:FWytrU+GIRzSZpxvsxj2Qtdi0OQ7giWhc/IXAoyBFM2Vq6Y2fkv8/zGV:FDtHOZnQtRIX56Y2ceze

Score

1^/10

Malware Config

Signatures

Files

96078b78f7adca1b395b53e1b52a75f0_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

0b42ddaa7dbd124121cdb4b460061e99

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f7:00:2f:49:81:e5:47:c9:8c:39:eb:b0:b6:75:39:d9
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

05/11/2012, 00:00

Not After

05/11/2014, 23:59

Subject

CN=Hendrik Leppkes,O=Hendrik Leppkes,POSTALCODE=22419,STREET=Wulffsblöcken 35,L=Hamburg,ST=Hamburg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b9:a3:7b:b0:67:8a:2a:c7:0a:2f:ba:bb:12:ac:ed:99:40:ae:c8:7a
Signer

Actual PE Digest

b9:a3:7b:b0:67:8a:2a:c7:0a:2f:ba:bb:12:ac:ed:99:40:ae:c8:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryW
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__dllonexit
__setusermatherr
_amsg_exit
_errno
_initterm
_iob
_lock
_onexit
_unlock
abort
calloc
ceil
fprintf
free
fwrite
malloc
memcpy
memmove
memset
strlen
strncmp
vfprintf

avutil-lav-52

av_audio_fifo_alloc
av_audio_fifo_drain
av_audio_fifo_free
av_audio_fifo_read
av_audio_fifo_size
av_audio_fifo_write
av_default_item_name
av_free
av_freep
av_get_bytes_per_sample
av_get_channel_layout_nb_channels
av_get_channel_layout_string
av_get_cpu_flags
av_get_packed_sample_fmt
av_get_planar_sample_fmt
av_get_sample_fmt_name
av_log
av_malloc
av_mallocz
av_opt_free
av_opt_set_defaults
av_reduce
av_sample_fmt_is_planar
av_samples_alloc
av_samples_fill_arrays
av_samples_get_buffer_size
avpriv_snprintf

Exports

Exports

avresample_alloc_context
avresample_available
avresample_build_matrix
avresample_close
avresample_configuration
avresample_convert
avresample_free
avresample_get_class
avresample_get_delay
avresample_get_matrix
avresample_license
avresample_open
avresample_read
avresample_set_compensation
avresample_set_matrix
avresample_version

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 972B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 1024B - Virtual size: 677B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 512B - Virtual size: 77B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0b42ddaa7dbd124121cdb4b460061e99

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

f7:00:2f:49:81:e5:47:c9:8c:39:eb:b0:b6:75:39:d9Certificate

Extended Key Usages

Key Usages

b9:a3:7b:b0:67:8a:2a:c7:0a:2f:ba:bb:12:ac:ed:99:40:ae:c8:7aSigner

Headers

File Characteristics

Imports

kernel32

msvcrt

avutil-lav-52

Exports

Exports

Sections

.text Size: 91KB - Virtual size: 90KB

.data Size: 512B - Virtual size: 28B

.rdata Size: 5KB - Virtual size: 5KB

.rodata Size: 512B - Virtual size: 208B

.bss Size: - Virtual size: 972B

.edata Size: 1024B - Virtual size: 552B

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 32B

.reloc Size: 2KB - Virtual size: 2KB

/4 Size: 512B - Virtual size: 32B

/19 Size: 4KB - Virtual size: 3KB

/31 Size: 1024B - Virtual size: 848B

/45 Size: 1024B - Virtual size: 677B

/57 Size: 512B - Virtual size: 304B

/70 Size: 512B - Virtual size: 77B

/81 Size: 2KB - Virtual size: 1KB

/92 Size: 512B - Virtual size: 120B

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

f7:00:2f:49:81:e5:47:c9:8c:39:eb:b0:b6:75:39:d9
Certificate

b9:a3:7b:b0:67:8a:2a:c7:0a:2f:ba:bb:12:ac:ed:99:40:ae:c8:7a
Signer

.text
Size: 91KB - Virtual size: 90KB

.data
Size: 512B - Virtual size: 28B

.rdata
Size: 5KB - Virtual size: 5KB

.rodata
Size: 512B - Virtual size: 208B

.bss
Size: - Virtual size: 972B

.edata
Size: 1024B - Virtual size: 552B

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 32B

.reloc
Size: 2KB - Virtual size: 2KB

/4
Size: 512B - Virtual size: 32B

/19
Size: 4KB - Virtual size: 3KB

/31
Size: 1024B - Virtual size: 848B

/45
Size: 1024B - Virtual size: 677B

/57
Size: 512B - Virtual size: 304B

/70
Size: 512B - Virtual size: 77B

/81
Size: 2KB - Virtual size: 1KB

/92
Size: 512B - Virtual size: 120B