a2a4296095f3920b0407913b35b4c8c0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a2a4296095f3920b0407913b35b4c8c0_NeikiAnalytics.exe
Size

92KB
MD5

a2a4296095f3920b0407913b35b4c8c0
SHA1

188a86304a0abc19d9d27c1174f92112b3bd7894
SHA256

c382e00985f62a6e75dd706ef8b8ba3e2ee56e304399625aa65ffaef3ec4cd19
SHA512

0b0faf141d5e79eb128ba3b293071af43c894395878ad6e2d081387c8a59b6de89a64f2c8cd1b8f7a9b9f9fbc5343beb8a6861221ff859ad5f86535adb93407b
SSDEEP

1536:GIpgihO10TYMf+joqJc3XislUJueL/3KDmpXbL11y6Pss7sGsId+9nWx+FEibEin:jWiU10TYMYo3QDL/B5L11y6Pss7sGsIU

Score

1^/10

Malware Config

Signatures

Files

a2a4296095f3920b0407913b35b4c8c0_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

1f525dd455f83c7c45e1f813b723ce56

Code Sign

06:b8:ee:e3:50:7a:0d:24:c1:87:d2:93:bd:13:57:c5
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

26/07/2018, 00:00

Not After

26/07/2019, 23:59

Subject

CN=RAGUNATHAN LIMITED,O=RAGUNATHAN LIMITED,POSTALCODE=N9 7ER,STREET=221a Hertford Road,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:b8:ee:e3:50:7a:0d:24:c1:87:d2:93:bd:13:57:c5
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

26/07/2018, 00:00

Not After

26/07/2019, 23:59

Subject

CN=RAGUNATHAN LIMITED,O=RAGUNATHAN LIMITED,POSTALCODE=N9 7ER,STREET=221a Hertford Road,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:2a:fd:6e:20:02:f8:ce:5a:1e:19:0c:89:f3:b8:20:09:47:8e:ed:aa:7a:f9:83:85:55:2d:ee:26:9c:c2:2b
Signer

Actual PE Digest

c6:2a:fd:6e:20:02:f8:ce:5a:1e:19:0c:89:f3:b8:20:09:47:8e:ed:aa:7a:f9:83:85:55:2d:ee:26:9c:c2:2b

Digest Algorithm

sha256

PE Digest Matches

true

aa:93:a6:1a:c0:6d:e5:c9:75:d1:c6:29:f1:7d:0d:60:93:10:21:8b
Signer

Actual PE Digest

aa:93:a6:1a:c0:6d:e5:c9:75:d1:c6:29:f1:7d:0d:60:93:10:21:8b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetModuleFileNameA
SetEvent
CreateEventA
ResetEvent
CloseHandle
GetCurrentProcessId
WTSGetActiveConsoleSessionId
CopyFileA
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent

shell32

SHGetFolderPathA

libav

ord44323
ord44333
ord44314
ord44315
ord44264
ord44346
ord44306
ord44305
ord44304
ord44313
ord44300
ord44301
ord44310
ord44271
ord44312
ord2
ord1003
ord44208
ord19
ord44206
ord20
ord44207
ord3
ord44337
ord44221
ord44311
ord14
ord10
ord44308
ord26
ord44318
ord44309
ord25
ord44303
ord15
ord44344
ord44299
ord44219
ord44307
ord16
ord44214
ord24
ord44342
ord44220
ord44334
ord44204
ord44321
ord44316
ord44328
ord44347
ord44324
ord44317
ord27
ord44319
ord44339
ord44340
ord44326
ord30
ord44276
ord44335
ord44218
ord7
ord32
ord44325
ord44329
ord44348
ord44297
ord44298
ord44217
ord44330
ord44338
ord49
ord9
ord11
ord44209
ord46
ord18
ord12
ord70
ord6
ord34
ord44331
ord44283
ord17
ord33
ord13
ord44284
ord8
ord42
ord44285
ord44286
ord44341
ord21
ord44302

msvcr110

_write
_close
_lseek
_unlink
_umask
_strdup
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_except_handler4_common
_controlfp_s
_invoke_watson
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__crtSetUnhandledExceptionFilter
?terminate@@YAXXZ
_commode
_fmode
__initenv
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_vsnprintf
fflush
fgets
fputs
_ctime64
_chsize
strncmp
fclose
fopen
memchr
memmove
strncpy
_fstat64i32
calloc
_errno
malloc
exit
_time64
strcat_s
realloc
_setmode
strrchr
_fileno
strcpy_s
fprintf
printf
__iob_func
free
sprintf
memset

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1f525dd455f83c7c45e1f813b723ce56

Code Sign

06:b8:ee:e3:50:7a:0d:24:c1:87:d2:93:bd:13:57:c5Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

06:b8:ee:e3:50:7a:0d:24:c1:87:d2:93:bd:13:57:c5Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

c6:2a:fd:6e:20:02:f8:ce:5a:1e:19:0c:89:f3:b8:20:09:47:8e:ed:aa:7a:f9:83:85:55:2d:ee:26:9c:c2:2bSigner

aa:93:a6:1a:c0:6d:e5:c9:75:d1:c6:29:f1:7d:0d:60:93:10:21:8bSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

libav

msvcr110

Sections

.text Size: 32KB - Virtual size: 32KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 32KB - Virtual size: 38KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

06:b8:ee:e3:50:7a:0d:24:c1:87:d2:93:bd:13:57:c5
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

06:b8:ee:e3:50:7a:0d:24:c1:87:d2:93:bd:13:57:c5
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

c6:2a:fd:6e:20:02:f8:ce:5a:1e:19:0c:89:f3:b8:20:09:47:8e:ed:aa:7a:f9:83:85:55:2d:ee:26:9c:c2:2b
Signer

aa:93:a6:1a:c0:6d:e5:c9:75:d1:c6:29:f1:7d:0d:60:93:10:21:8b
Signer

.text
Size: 32KB - Virtual size: 32KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 32KB - Virtual size: 38KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB