4ba02543080d14399e043902bbc27931c610acc15c4ee5259af3de9634ea81a0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4ba02543080d14399e043902bbc27931c610acc15c4ee5259af3de9634ea81a0_NeikiAnalytics.exe
Size

160KB
MD5

c361f17bf5d325cfc301f3889d0166d0
SHA1

5f91864bda7c0b25bbd1bf6fb599d2e5cf6d6ba7
SHA256

4ba02543080d14399e043902bbc27931c610acc15c4ee5259af3de9634ea81a0
SHA512

1735de9379d360365498abcf75f706996674be0d35c133f1e7b7a57fa9809232e3e901734bb96c308529eb6671f0b5271fbf55716c3d0aa3d42874e235975c9d
SSDEEP

3072:vqnLyap2naIr/BoYJUTBqOsqTk/Iqf3GSknQ5r:s7/IWQPOk/I8WSkn2r

Score

1^/10

Malware Config

Signatures

Files

4ba02543080d14399e043902bbc27931c610acc15c4ee5259af3de9634ea81a0_NeikiAnalytics.exe
.exe windows:4 windows x64 arch:x64

43cf2e49e58d09bada82bbc5861c7088

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:cc:62:f6:d6:47:5e:bb:af:a9:09:c9:f8:79:46:15
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/05/2021, 00:00

Not After

05/06/2024, 23:59

Subject

CN=AXOSOFT\, LLC,OU=Axosoft,O=AXOSOFT\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2b:60:fa:f3:42:bd:34:f2:47:ca:ff:94:31:80:a6:73:fe:ba:0e:e8:d1:de:7c:98:1d:54:cc:e0:a5:0f:32:42
Signer

Actual PE Digest

2b:60:fa:f3:42:bd:34:f2:47:ca:ff:94:31:80:a6:73:fe:ba:0e:e8:d1:de:7c:98:1d:54:cc:e0:a5:0f:32:42

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

PDB Paths

Imports

msys-gcrypt-20

gcry_calloc
gcry_check_version
gcry_control
gcry_create_nonce
gcry_free
gcry_malloc
gcry_malloc_secure
gcry_md_close
gcry_md_hash_buffer
gcry_md_open
gcry_md_read
gcry_md_write
gcry_mpi_get_flag
gcry_mpi_get_opaque
gcry_mpi_set_opaque
gcry_pk_get_curve
gcry_pk_get_keygrip
gcry_realloc
gcry_set_log_handler
gcry_sexp_build
gcry_sexp_canon_len
gcry_sexp_release
gcry_sexp_sscan
gcry_strdup
gcry_xcalloc
gcry_xmalloc
gcry_xrealloc
gcry_xstrdup

msys-gpg-error-0

_gpgrt_get_std_stream
_gpgrt_log_assert
gpg_err_code_from_errno
gpg_err_code_from_syserror
gpg_err_code_to_errno
gpg_err_init
gpg_err_set_errno
gpg_strerror
gpgrt_access
gpgrt_argparse
gpgrt_chdir
gpgrt_clearerr
gpgrt_fclose
gpgrt_ferror
gpgrt_fflush
gpgrt_fgetc
gpgrt_fileno
gpgrt_fopen
gpgrt_fputc
gpgrt_fputs
gpgrt_fread
gpgrt_fseek
gpgrt_fseeko
gpgrt_ftello
gpgrt_fwrite
gpgrt_get_errorcount
gpgrt_getcwd
gpgrt_log
gpgrt_log_bug
gpgrt_log_debug
gpgrt_log_error
gpgrt_log_fatal
gpgrt_log_get_prefix
gpgrt_log_info
gpgrt_log_printf
gpgrt_log_set_prefix
gpgrt_log_set_socket_dir_cb
gpgrt_logv
gpgrt_mkdir
gpgrt_opaque_get
gpgrt_opaque_set
gpgrt_read
gpgrt_read_line
gpgrt_set_alloc_func
gpgrt_set_fixed_string_mapper
gpgrt_set_strusage
gpgrt_set_usage_outfnc
gpgrt_setvbuf
gpgrt_snprintf
gpgrt_vasprintf
gpgrt_write

msys-ksba-8

ksba_cert_get_image
ksba_cert_get_issuer
ksba_cert_get_public_key
ksba_cert_get_serial
ksba_cert_get_subject
ksba_cert_new
ksba_cert_read_der
ksba_cert_release
ksba_reader_new
ksba_reader_release
ksba_reader_set_mem
ksba_set_malloc_hooks

msys-2.0

__assert_func
__cxa_atexit
__errno
__getreent
__locale_ctype_ptr
__main
_dll_crt0
_impure_ptr
abort
atoi
calloc
chmod
close
closedir
cygwin_internal
difftime
dll_dllcrt0
dup
exit
explicit_bzero
fcntl
fprintf
free
fstat
fsync
fwrite
getenv
getpid
getppid
getpwnam
getpwuid
getrlimit
getsockname
getuid
gmtime
gmtime_r
initgroups
kill
link
localtime
lseek
malloc
memchr
memcmp
memcpy
memmove
memset
mktime
msys_detach_dll
nanosleep
nl_langinfo
open
opendir
posix_memalign
printf
putc
putchar
qsort
raise
read
readdir
readlink
realloc
remove
rename
rmdir
select
setenv
setrlimit
setuid
sigaction
sigemptyset
sigfillset
sigprocmask
sleep
sprintf
stat
stpcpy
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strstr
strtoul
sys_siglist
time
timegm
tmpfile
toupper
uname
uname_x
unlink
unsetenv
write

msys-iconv-2

libiconv
libiconv_close
libiconv_open

msys-intl-8

libintl_bind_textdomain_codeset
libintl_bindtextdomain
libintl_gettext
libintl_setlocale
libintl_textdomain

kernel32

GetModuleHandleA
GetModuleHandleW

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.buildid
Size: 512B - Virtual size: 53B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43cf2e49e58d09bada82bbc5861c7088

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:cc:62:f6:d6:47:5e:bb:af:a9:09:c9:f8:79:46:15Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

2b:60:fa:f3:42:bd:34:f2:47:ca:ff:94:31:80:a6:73:fe:ba:0e:e8:d1:de:7c:98:1d:54:cc:e0:a5:0f:32:42Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msys-gcrypt-20

msys-gpg-error-0

msys-ksba-8

msys-2.0

msys-iconv-2

msys-intl-8

kernel32

Sections

.text Size: 105KB - Virtual size: 104KB

.data Size: 1024B - Virtual size: 608B

.rdata Size: 17KB - Virtual size: 17KB

.buildid Size: 512B - Virtual size: 53B

.pdata Size: 4KB - Virtual size: 4KB

.xdata Size: 4KB - Virtual size: 4KB

.bss Size: - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 228B

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:cc:62:f6:d6:47:5e:bb:af:a9:09:c9:f8:79:46:15
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

2b:60:fa:f3:42:bd:34:f2:47:ca:ff:94:31:80:a6:73:fe:ba:0e:e8:d1:de:7c:98:1d:54:cc:e0:a5:0f:32:42
Signer

.text
Size: 105KB - Virtual size: 104KB

.data
Size: 1024B - Virtual size: 608B

.rdata
Size: 17KB - Virtual size: 17KB

.buildid
Size: 512B - Virtual size: 53B

.pdata
Size: 4KB - Virtual size: 4KB

.xdata
Size: 4KB - Virtual size: 4KB

.bss
Size: - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 228B