68bfeba2bccdc0dc1a88ad61fb3e29e092dfe034d4a2c89e6804c02542cebd78_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

68bfeba2bccdc0dc1a88ad61fb3e29e092dfe034d4a2c89e6804c02542cebd78_NeikiAnalytics.exe
Size

429KB
MD5

08630f045949eb7741428c53daf8ab20
SHA1

b1bc503716d3bd582774911f8db498b6381acd1f
SHA256

68bfeba2bccdc0dc1a88ad61fb3e29e092dfe034d4a2c89e6804c02542cebd78
SHA512

a22e5b222589f24b02f9c7345b6d3369db6fbdd2490390db0507c885364bb08305961483a68924ce8771df7fda2598268f61ca4dad1c45e3980bad907a5e6752
SSDEEP

6144:UmzN29vaLjIGYDTZ/JKEY00HT5KNOWFsmyyTuFKOySEqW3wg6AzaQZDct5o:UmzNoEjAUT5KNOWHyyUKVHzascU

Score

1^/10

Malware Config

Signatures

Files

68bfeba2bccdc0dc1a88ad61fb3e29e092dfe034d4a2c89e6804c02542cebd78_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

20c0b74639614e4cb862bedaff6afffd

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:90:d1:26:9d:d0:af:07:b5:97:e2:f9
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

12/11/2019, 13:43

Not After

05/11/2022, 13:21

Subject

CN=Swyx Solutions GmbH,O=Swyx Solutions GmbH,L=Dortmund,ST=Nordrhein-Westfalen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

08/03/2016, 13:10

Not After

30/05/2027, 13:10

Subject

CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

90:22:f7:c9:45:53:53:ed:a4:56:20:13:db:9b:b6:b3:8b:c9:02:d3:01:e8:70:70:20:fc:b2:7e:fe:c5:4e:30
Signer

Actual PE Digest

90:22:f7:c9:45:53:53:ed:a4:56:20:13:db:9b:b6:b3:8b:c9:02:d3:01:e8:70:70:20:fc:b2:7e:fe:c5:4e:30

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\vsts-agent1\_work\1316\b\x64\Release\vfpmu64.pdb

Imports

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

kernel32

GetCurrentThread
GetLastError
SetLastError
CloseHandle
FormatMessageW
GetTempPathW
GetTempFileNameW
VerifyVersionInfoW
DisableThreadLibraryCalls
SetEndOfFile
HeapReAlloc
HeapSize
SetFilePointerEx
FlushFileBuffers
SetStdHandle
GetStringTypeW
CreateFileW
SetConsoleCtrlHandler
VerSetConditionMask
RtlZeroMemory
ReadConsoleW
WriteConsoleW
ReadFile
FreeLibrary
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetACP
GetStdHandle
GetFileType
WriteFile
GetConsoleCP
GetConsoleMode
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
OutputDebugStringA
OutputDebugStringW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap

user32

MessageBoxW
wsprintfW
LoadStringW

winspool.drv

GetJobW
SetJobW
ClosePrinter
OpenPrinterW

advapi32

RegCreateKeyExW
DuplicateTokenEx
CreateProcessAsUserW
OpenThreadToken
RegQueryValueExW

Exports

Exports

InitializePrintMonitor2
InitializePrintMonitorUI

Sections

.text
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20c0b74639614e4cb862bedaff6afffd

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

66:90:d1:26:9d:d0:af:07:b5:97:e2:f9Certificate

Extended Key Usages

Key Usages

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70Certificate

Extended Key Usages

Key Usages

90:22:f7:c9:45:53:53:ed:a4:56:20:13:db:9b:b6:b3:8b:c9:02:d3:01:e8:70:70:20:fc:b2:7e:fe:c5:4e:30Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

userenv

kernel32

user32

winspool.drv

advapi32

Exports

Exports

Sections

.text Size: 313KB - Virtual size: 312KB

.rdata Size: 68KB - Virtual size: 67KB

.data Size: 3KB - Virtual size: 12KB

.pdata Size: 18KB - Virtual size: 17KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 2KB - Virtual size: 1KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

66:90:d1:26:9d:d0:af:07:b5:97:e2:f9
Certificate

fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Certificate

90:22:f7:c9:45:53:53:ed:a4:56:20:13:db:9b:b6:b3:8b:c9:02:d3:01:e8:70:70:20:fc:b2:7e:fe:c5:4e:30
Signer

.text
Size: 313KB - Virtual size: 312KB

.rdata
Size: 68KB - Virtual size: 67KB

.data
Size: 3KB - Virtual size: 12KB

.pdata
Size: 18KB - Virtual size: 17KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 2KB - Virtual size: 1KB