9058dbc11d1b6c18dc96d77b70678c20_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
9058dbc11d1b6c18dc96d77b70678c20_NeikiAnalytics.exe
Size 1.9MB
Sample240617-py47wsvgrq
SHA256 94f7663820bfd71987b5084a70ce0289102f9114eb398c0a3e2532991767ee5b
MD5 9058dbc11d1b6c18dc96d77b70678c20
SHA1 85d788f18e610fbab4dbc4b6df035aab51cca410
SHA512 258d6bf9c10843e321f33cbecc735ff3832b1f0a91795cf97faa3714760c530e00b8af6f2fa375f9ddc92d25c5d96c023efb4abe6b95c4f685fb2db0482c4503
SSDEEP 49152:Tg3mCtjGk4R9dSSFF4DUexww8V90vyRbOr0l1u:TgTJGkC98uSx6e6E
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

9058dbc11d1b6c18dc96d77b70678c20_NeikiAnalytics.exe

.dll 1.9MB

9058dbc11d1b6c18dc96d77b70678c20_NeikiAnalytics.exe

IMPHASH 5ac9118a0baa3519053b06debeea1817
SHA256 94f7663820bfd71987b5084a70ce0289102f9114eb398c0a3e2532991767ee5b
MD5 9058dbc11d1b6c18dc96d77b70678c20
SHA1 85d788f18e610fbab4dbc4b6df035aab51cca410
SHA512 258d6bf9c10843e321f33cbecc735ff3832b1f0a91795cf97faa3714760c530e00b8af6f2fa375f9ddc92d25c5d96c023efb4abe6b95c4f685fb2db0482c4503
SSDEEP 49152:Tg3mCtjGk4R9dSSFF4DUexww8V90vyRbOr0l1u:TgTJGkC98uSx6e6E
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

0f:17:f9:36:d4:c8:a8:35:53:7e:7b:c1:0f:aa:d3:78:29:e2:52:2c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu (China) Co.\, Ltd.,O=Baidu (China) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Chains

Jul 15, 2014

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:2f:4e:e1:35:5c

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 13, 2011 - Apr 13, 2019

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Baidu (China) Co.\, Ltd.,O=Baidu (China) Co.\, Ltd.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

11:21:df:76:75:aa:a0:8d:1b:49:a8:3a:48:0f:14:85:5d:24

Issuer

CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 22, 2012 - Feb 22, 2015

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Minor OS version

Major OS version

Entry point

57238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\code\bdkv_bind_v1092\basic\Tools\NSIS\Plugins\bind.pdb

wininet

InternetCloseHandle InternetReadFile HttpQueryInfoW InternetOpenUrlW InternetOpenW

kernel32

CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateFileA Sleep WaitForSingleObject GetSystemDirectoryW GetWindowsDirectoryW LoadLibraryW WideCharToMultiByte MultiByteToWideChar ExpandEnvironmentStringsW FindResourceExW CreateDirectoryW GetProcAddress GetModuleHandleW FindResourceW GetCurrentProcess SizeofResource LoadResource LockResource GetLastError FreeResource GetModuleFileNameW GetCurrentThreadId GetCommandLineW FreeLibrary SetEvent GetTickCount CreateEventW ResetEvent DeleteFileW GetFileAttributesW FindClose FindFirstFileW FindNextFileW GetConsoleOutputCP WriteConsoleA SetFilePointer Process32NextW lstrcmpiW Process32FirstW CreateToolhelp32Snapshot CloseHandle ReadFile GetFileSize CreateFileW WriteConsoleW WriteFile SetStdHandle GetStringTypeW LoadLibraryA InterlockedIncrement InterlockedDecrement InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection RaiseException GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread GetSystemTimeAsFileTime GetCommandLineA RtlUnwind LCMapStringA LCMapStringW GetCPInfo GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree VirtualAlloc GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetLocaleInfoA GetStringTypeA

user32

wsprintfW UnregisterClassA

advapi32

RegDeleteValueW RegFlushKey RegDeleteKeyW RegCreateKeyExW RegSetValueExW QueryServiceStatus StartServiceW ChangeServiceConfig2W CreateServiceW CloseServiceHandle OpenServiceW OpenSCManagerW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

ShellExecuteExW

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

9058dbc11d1b6c18dc96d77b70678c20_NeikiAnalytics.exe

PE Signature issue

wininet

kernel32

user32

advapi32

shell32

shlwapi

generic