3c76cce133652e91920caf923026d01020ca3212d97eb5e2a262844df91992dd_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3c76cce133652e91920caf923026d01020ca3212d97eb5e2a262844df91992dd_NeikiAnalytics.exe
Size

41KB
MD5

e5c46a0f50d207e90fc421431bc5a020
SHA1

e0a1da831dc3b28cf23776b9bc34eaf12a7a2950
SHA256

3c76cce133652e91920caf923026d01020ca3212d97eb5e2a262844df91992dd
SHA512

8d3d2a7ab48926635919b412a1facb77048ada4838d9b421d444bf1f94094874fdd477434c8477274911114fbffcc165c1c804cdf0c69afd5c406fd3f99522e7
SSDEEP

768:BpztZiSAxn0dSldUnDP0NgfCVDb+NPBp23+zjZi:7z6YMUnj0efCINPK0Zi

Score

1^/10

Malware Config

Signatures

Files

3c76cce133652e91920caf923026d01020ca3212d97eb5e2a262844df91992dd_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

02cc0b91645bcf158ad1fa700a3efb8b

Code Sign

39:9d:cc:ba:df:3c:2c:fe:42:e1:f9:79:c6:a2:d4:f1
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

01/02/2018, 00:00

Not After

01/04/2020, 23:59

Subject

CN=Siemens AG,O=Siemens AG,L=Karlsruhe,ST=Baden-Württemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ba:80:57:7f:6b:6b:1c:fc:05:af:4c:fd:2f:88:c8:50:6a:05:54:a8:f6:11:c4:2a:28:1e:fa:2a:39:9d:f8:36
Signer

Actual PE Digest

ba:80:57:7f:6b:6b:1c:fc:05:af:4c:fd:2f:88:c8:50:6a:05:54:a8:f6:11:c4:2a:28:1e:fa:2a:39:9d:f8:36

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

vcruntime140

__telemetry_main_invoke_trigger
__std_type_info_destroy_list
__C_specific_handler
__telemetry_main_return_trigger
memset

api-ms-win-crt-runtime-l1-1-0

_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_seh_filter_dll
_initterm_e
_initterm

kernel32

GetCurrentProcessId
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCurrentThreadId

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02cc0b91645bcf158ad1fa700a3efb8b

Code Sign

39:9d:cc:ba:df:3c:2c:fe:42:e1:f9:79:c6:a2:d4:f1Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

ba:80:57:7f:6b:6b:1c:fc:05:af:4c:fd:2f:88:c8:50:6a:05:54:a8:f6:11:c4:2a:28:1e:fa:2a:39:9d:f8:36Signer

Headers

DLL Characteristics

File Characteristics

Imports

vcruntime140

api-ms-win-crt-runtime-l1-1-0

kernel32

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 192B

.pdata Size: 512B - Virtual size: 384B

.gfids Size: 512B - Virtual size: 16B

.rsrc Size: 25KB - Virtual size: 24KB

.reloc Size: 512B - Virtual size: 20B

39:9d:cc:ba:df:3c:2c:fe:42:e1:f9:79:c6:a2:d4:f1
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

ba:80:57:7f:6b:6b:1c:fc:05:af:4c:fd:2f:88:c8:50:6a:05:54:a8:f6:11:c4:2a:28:1e:fa:2a:39:9d:f8:36
Signer

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 192B

.pdata
Size: 512B - Virtual size: 384B

.gfids
Size: 512B - Virtual size: 16B

.rsrc
Size: 25KB - Virtual size: 24KB

.reloc
Size: 512B - Virtual size: 20B