4186d176f3def1daa7e5ef980bb8bf25de2cf2beaadfbeaff6741e049d977fea_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4186d176f3def1daa7e5ef980bb8bf25de2cf2beaadfbeaff6741e049d977fea_NeikiAnalytics.exe
Size

117KB
MD5

39265b4663ac95b1834bfb1d834a5b70
SHA1

06734edf97646746f9547c7b8e16c380c7e5624b
SHA256

4186d176f3def1daa7e5ef980bb8bf25de2cf2beaadfbeaff6741e049d977fea
SHA512

548e2f6a03898aeecdf0db08f23017f4dc3f640d07a47aa048d88d62c49fa80d278a6dcae19507f019482163e0fbb6abe49e61b3e8a32872669ec3bcf9930e50
SSDEEP

1536:oIQ2rgAGTVJwwTv7cKJQpP2FFyo0XkFSzi7EyOzYgrUsAEe3Gax3EZw5Jr8dUy/L:ZgAGcgB+pP2y3eyiEyn3Gax3QGr8dwI

Score

1^/10

Malware Config

Signatures

Files

4186d176f3def1daa7e5ef980bb8bf25de2cf2beaadfbeaff6741e049d977fea_NeikiAnalytics.exe
.dll windows:4 windows x64 arch:x64

72f9cd090d740a32176decdce9733484

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:cc:62:f6:d6:47:5e:bb:af:a9:09:c9:f8:79:46:15
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/05/2021, 00:00

Not After

05/06/2024, 23:59

Subject

CN=AXOSOFT\, LLC,OU=Axosoft,O=AXOSOFT\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:27:d4:16:7b:a8:9d:bf:1d:c6:af:c2:d6:73:8c:18:92:c8:22:53:f0:a6:66:19:ee:c7:c1:09:7b:e8:98:4f
Signer

Actual PE Digest

4a:27:d4:16:7b:a8:9d:bf:1d:c6:af:c2:d6:73:8c:18:92:c8:22:53:f0:a6:66:19:ee:c7:c1:09:7b:e8:98:4f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

PDB Paths

Imports

msys-iconv-2

libiconv
libiconv_open
libiconv_set_relocation_prefix

msys-2.0

__cxa_atexit
__errno
__fsetlocking
__locale_ctype_ptr
__locale_mb_cur_max
_impure_ptr
abort
bsearch
calloc
close
cygwin_internal
dll_dllcrt0
fclose
fgets_unlocked
fopen
free
freelocale
frexp
fstat
fwrite
getcwd
getegid
getenv
geteuid
getgid
getuid
ldexp
malloc
mbrlen
mbrtowc
memcpy
memset
mmap
msys_detach_dll
munmap
newlocale
nl_langinfo
open
posix_memalign
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_init
pthread_mutexattr_settype
pthread_once
pthread_rwlock_destroy
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
putc
qsort
read
realloc
setlocale
snprintf
sprintf
stpcpy
strcasecmp
strchr
strcmp
strcpy
strcspn
strdup
strlen
strncmp
strstr
strtoul
swprintf
tfind
tolower
tsearch
uselocale
wcslen
wcsnlen
wmemcpy
wmemset

kernel32

GetACP
GetModuleHandleA

Exports

Exports

__gcc_deregister_frame
__gcc_register_frame
__imp_libintl_version
_libintl_asnprintf
_libintl_asnwprintf
_libintl_explode_name
_libintl_find_domain
_libintl_find_msg
_libintl_free
_libintl_frexpl
_libintl_gettext_extract_plural
_libintl_gettext_free_exp
_libintl_gettext_germanic_plural
_libintl_gettextparse
_libintl_hard_locale
_libintl_language_preferences_default
_libintl_load_domain
_libintl_locale_name
_libintl_locale_name_default
_libintl_locale_name_environ
_libintl_locale_name_posix
_libintl_locale_name_thread
_libintl_locale_name_thread_unsafe
_libintl_log_untranslated
_libintl_make_l10nflist
_libintl_mbrtowc
_libintl_mbszero
_libintl_normalize_codeset
_libintl_once_multithreaded
_libintl_once_singlethreaded
_libintl_printf_fetchargs
_libintl_printf_frexp
_libintl_printf_frexpl
_libintl_printf_parse
_libintl_recursive_lock_init_multithreaded
_libintl_relocate
_libintl_relocate2
_libintl_setlocale_null
_libintl_setlocale_null_r
_libintl_state_lock
_libintl_vasnprintf
_libintl_vasnwprintf
_libintl_wprintf_parse
_libintl_xmax
_libintl_xsum
_libintl_xsum3
_libintl_xsum4
_nl_expand_alias
_nl_msg_cat_cntr
bind_textdomain_codeset
bindtextdomain
dcgettext
dcngettext
dgettext
dngettext
gettext
libintl_bind_textdomain_codeset
libintl_bindtextdomain
libintl_dcgettext
libintl_dcigettext
libintl_dcngettext
libintl_dgettext
libintl_dngettext
libintl_gettext
libintl_hash_string
libintl_newlocale
libintl_ngettext
libintl_nl_current_default_domain
libintl_nl_default_default_domain
libintl_nl_default_dirname
libintl_nl_domain_bindings
libintl_set_relocation_prefix
libintl_setlocale
libintl_textdomain
libintl_version
locale_charset
ngettext
textdomain

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72f9cd090d740a32176decdce9733484

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:cc:62:f6:d6:47:5e:bb:af:a9:09:c9:f8:79:46:15Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

4a:27:d4:16:7b:a8:9d:bf:1d:c6:af:c2:d6:73:8c:18:92:c8:22:53:f0:a6:66:19:ee:c7:c1:09:7b:e8:98:4fSigner

Headers

File Characteristics

PDB Paths

Imports

msys-iconv-2

msys-2.0

kernel32

Exports

Exports

Sections

.text Size: 83KB - Virtual size: 82KB

.data Size: 512B - Virtual size: 224B

.rdata Size: 9KB - Virtual size: 8KB

.buildid Size: 512B - Virtual size: 53B

.pdata Size: 1KB - Virtual size: 1KB

.xdata Size: 2KB - Virtual size: 1KB

.bss Size: - Virtual size: 2KB

.edata Size: 2KB - Virtual size: 2KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 60B

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:cc:62:f6:d6:47:5e:bb:af:a9:09:c9:f8:79:46:15
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

4a:27:d4:16:7b:a8:9d:bf:1d:c6:af:c2:d6:73:8c:18:92:c8:22:53:f0:a6:66:19:ee:c7:c1:09:7b:e8:98:4f
Signer

.text
Size: 83KB - Virtual size: 82KB

.data
Size: 512B - Virtual size: 224B

.rdata
Size: 9KB - Virtual size: 8KB

.buildid
Size: 512B - Virtual size: 53B

.pdata
Size: 1KB - Virtual size: 1KB

.xdata
Size: 2KB - Virtual size: 1KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 2KB - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 60B