31e107c8b608e45aa419bef4232676c15087f9ca3de2d5e52c696c9fa0fed242_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

31e107c8b608e45aa419bef4232676c15087f9ca3de2d5e52c696c9fa0fed242_NeikiAnalytics.exe
Size

4.6MB
MD5

2dc3e580e9eb31a05d818f261bc43a00
SHA1

6c8f233c937c23b238b970bf7a21f61f3a3d502b
SHA256

31e107c8b608e45aa419bef4232676c15087f9ca3de2d5e52c696c9fa0fed242
SHA512

71cc254a7c84f163d052806d684a677e9b04dc3d48652dfe8feca54ee824a42c9c822c0c37559caea69e2105b258e8317915b667ffe8a8c1bc11b8fb0738c62c
SSDEEP

49152:f791WxnPhuxF8lKyDUr+HGj/LsQiMdGgMuTkWATqAo3VAfSHZQw:f7TWFkEKyABTLsQXwugWAS3J

Score

1^/10

Malware Config

Signatures

Files

31e107c8b608e45aa419bef4232676c15087f9ca3de2d5e52c696c9fa0fed242_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

a4dec9cf1883689a9fa7ab66bc09e64e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0c:eb:51:2f:5d:e9:89:e3:76:1a:6d:e2:24:a9:47:1f
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

21/10/2021, 00:00

Not After

23/10/2024, 23:59

Subject

SERIALNUMBER=5307333,CN=RingCentral\, Inc.,O=RingCentral\, Inc.,L=Belmont,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

74:a3:ba:27:14:25:b0:21:be:2f:4e:40:a6:ec:3d:e5:a8:1b:38:ea:62:2d:8f:36:5c:89:93:83:3d:e2:25:a0
Signer

Actual PE Digest

74:a3:ba:27:14:25:b0:21:be:2f:4e:40:a6:ec:3d:e5:a8:1b:38:ea:62:2d:8f:36:5c:89:93:83:3d:e2:25:a0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\jenkins\workspace\RPM-DVC-Monorepo-Any-Branches\label\rcv-dsdk-win\dvc-monorepo\packages\rcv-desktop-test-app\node_modules\rcv-desktop-sdk\tools\build\bin\krisp-audio-bindings.pdb

Imports

kernel32

GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
RtlUnwind
GetModuleHandleW
GetSystemTimes
SetThreadPriority
WriteConsoleW
GetLastError
SetLastError
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
GetCommandLineW
GetEnvironmentVariableA
SetEnvironmentVariableA
ExpandEnvironmentStringsW
GetLongPathNameW
GetTempPathW
IsDebuggerPresent
DebugBreak
OutputDebugStringA
OutputDebugStringW
DecodePointer
CloseHandle
RaiseException
SetErrorMode
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
GetThreadId
GetTickCount
GetTickCount64
GetVersionExW
GetPhysicallyInstalledSystemMemory
FreeLibrary
GetProcAddress
LoadLibraryExW
LocalAlloc
LocalFree
FormatMessageW
VerifyVersionInfoW
LCMapStringW
LCMapStringA
AllocConsole
FreeConsole
AttachConsole
GetConsoleScreenBufferInfo
SetConsoleScreenBufferSize
GetConsoleProcessList
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Thread32First
Thread32Next
WaitForSingleObject
CreateThread
GetCurrentThread
TerminateThread
Sleep
GetModuleHandleA
FormatMessageA
GetConsoleTitleW
SetConsoleTitleW
SetUnhandledExceptionFilter
OpenProcess
ReadProcessMemory
QueryFullProcessImageNameW
CreateFileA
DisconnectNamedPipe
SetNamedPipeHandleState
SetEvent
CreateEventW
WaitForMultipleObjects
WaitNamedPipeA
SetThreadErrorMode
GetModuleHandleExW
ReadFile
GetOverlappedResult
WriteFile
GetSystemPowerStatus
GetEnvironmentVariableW
GetCurrentDirectoryA
GetFileAttributesW
SuspendThread
ResumeThread
GetThreadContext
GetVersionExA
GetModuleFileNameA
LoadLibraryW
CreateFileW
DeviceIoControl
TerminateProcess
GetExitCodeProcess
CreateProcessW
K32GetModuleFileNameExW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetEndOfFile
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
AreFileApisANSI
CreateDirectoryExW
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
GetStringTypeW
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
EncodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
CompareStringEx
GetCPInfo
GetLocaleInfoEx
InitializeCriticalSectionAndSpinCount
ResetEvent
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapValidate
SetConsoleCtrlHandler
GetDriveTypeW
ExitThread
FreeLibraryAndExitThread
ExitProcess
HeapAlloc
HeapFree
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
ReadConsoleW
HeapReAlloc
HeapSize
HeapQueryInformation
GetProcessHeap
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetTimeZoneInformation
GetCommandLineA
SetStdHandle

krisp-dynamic-lib

krispAudioNoiseDbCreateSession
krispAudioNcCleanAmbientNoiseFloat
krispAudioVadFrameFloatEx
krispAudioVadFrameFloat
krispAudioNoiseDbFrameFloat
krispAudioNoiseDbResetSession
krispAudioVadCloseSession
krispAudioVadCreateSession
krispAudioSetModel
krispAudioGlobalInit
krispAudioNcCloseSession
krispAudioNoiseDbCloseSession
krispAudioNcCreateSession

ntdll

RtlCaptureContext
VerSetConditionMask
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader
NtQueryInformationProcess

version

GetFileVersionInfoA
VerQueryValueW
GetFileVersionInfoSizeA

user32

ReleaseDC
EnumDisplayDevicesW
GetDisplayConfigBufferSizes
QueryDisplayConfig
DisplayConfigGetDeviceInfo
RegisterWindowMessageW
SendMessageW
PostMessageW
PostThreadMessageW
DefWindowProcW
CallWindowProcW
GetClassInfoW
RegisterClassExW
CreateWindowExW
DestroyWindow
GetWindowLongPtrW
SetWindowLongPtrW
SendMessageTimeoutW
AttachThreadInput
ShowWindowAsync
FlashWindowEx
SetWindowPos
SetFocus
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
GetTopWindow
GetWindowDC
IsRectEmpty
GetClassNameW
GetWindowThreadProcessId
PrivateExtractIconsW
DestroyIcon
SystemParametersInfoW
GetGUIThreadInfo
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
SendInput
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetTimer
KillTimer
ShowWindow
GetWindowDisplayAffinity
SetWindowDisplayAffinity
SetWinEventHook
UnhookWinEvent
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
EnumChildWindows
EnumWindows
FindWindowW
GetWindowLongW
GetWindowTextLengthW
GetWindowTextW
GetWindowRgn
IsIconic
IsWindowVisible
EqualRect
CopyRect
MessageBoxW
MessageBoxA
GetWindowRect
GetSystemMetrics
GetWindow
IsZoomed
IsWindow
UnregisterClassW
GetDC

gdi32

DeleteDC
RestoreDC
GetDeviceCaps
GetTextExtentPoint32W
CreateDCW
DeleteObject
CreateRectRgnIndirect
CreateRectRgn
CombineRgn
SaveDC
SelectObject

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetUserNameA
OpenProcessToken

shell32

ShellExecuteExW
SHGetKnownFolderPath
SHGetSpecialFolderPathW
CommandLineToArgvW

oleaut32

SysFreeString
SysStringByteLen
SysAllocStringByteLen
GetErrorInfo
VariantInit
VariantClear
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysStringLen

dxgi

CreateDXGIFactory2

dwmapi

DwmGetWindowAttribute

netapi32

NetApiBufferFree
NetWkstaGetInfo

ws2_32

inet_pton
getaddrinfo
htons
getsockname
connect
closesocket
freeaddrinfo
inet_ntop
socket

userenv

GetUserProfileDirectoryW

iphlpapi

GetAdaptersAddresses

gdiplus

GdipSetTextRenderingHint
GdipDeleteGraphics
GdipMeasureString
GdipCreateFromHWND
GdiplusShutdown
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdiplusStartup
GdipCreateFromHWNDICM
GdipCreateStringFormat

Exports

Exports

napi_register_module_v1
node_api_module_get_api_version_v1

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 142KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 793B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1024B - Virtual size: 546B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a4dec9cf1883689a9fa7ab66bc09e64e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0c:eb:51:2f:5d:e9:89:e3:76:1a:6d:e2:24:a9:47:1fCertificate

Extended Key Usages

Key Usages

74:a3:ba:27:14:25:b0:21:be:2f:4e:40:a6:ec:3d:e5:a8:1b:38:ea:62:2d:8f:36:5c:89:93:83:3d:e2:25:a0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

krisp-dynamic-lib

ntdll

version

user32

gdi32

advapi32

shell32

oleaut32

dxgi

dwmapi

netapi32

ws2_32

userenv

iphlpapi

gdiplus

Exports

Exports

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.data Size: 142KB - Virtual size: 166KB

.pdata Size: 130KB - Virtual size: 130KB

.idata Size: 18KB - Virtual size: 17KB

.didat Size: 4KB - Virtual size: 3KB

.tls Size: 1024B - Virtual size: 793B

.00cfg Size: 512B - Virtual size: 337B

_RDATA Size: 1024B - Virtual size: 546B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 31KB - Virtual size: 31KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0c:eb:51:2f:5d:e9:89:e3:76:1a:6d:e2:24:a9:47:1f
Certificate

74:a3:ba:27:14:25:b0:21:be:2f:4e:40:a6:ec:3d:e5:a8:1b:38:ea:62:2d:8f:36:5c:89:93:83:3d:e2:25:a0
Signer

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 142KB - Virtual size: 166KB

.pdata
Size: 130KB - Virtual size: 130KB

.idata
Size: 18KB - Virtual size: 17KB

.didat
Size: 4KB - Virtual size: 3KB

.tls
Size: 1024B - Virtual size: 793B

.00cfg
Size: 512B - Virtual size: 337B

_RDATA
Size: 1024B - Virtual size: 546B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 31KB - Virtual size: 31KB