3dd2f268b32754e73e3bbbc5f74f1ea3b9a032b54d035b6dcb36df97da02b0f0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3dd2f268b32754e73e3bbbc5f74f1ea3b9a032b54d035b6dcb36df97da02b0f0_NeikiAnalytics.exe
Size

2.4MB
MD5

abb362c80f8b8312e5e26ab4802cf940
SHA1

7be7f68c514d1a79fbd4b10442ebf04264825d3e
SHA256

3dd2f268b32754e73e3bbbc5f74f1ea3b9a032b54d035b6dcb36df97da02b0f0
SHA512

d0f828149de8c4b092c19d9df7621f9f459ad4a3cfb376830f5b5b55e6cdf0c2449ed11988f62b3d090b535a05eb00e2249327bdf18b7f3bf150650d58e136c1
SSDEEP

49152:7onwVOlO06ahnkRBiggsOhtPibgqlrB4hpukAIh:lIO01nkRIgwhAbg9N

Score

1^/10

Malware Config

Signatures

Files

3dd2f268b32754e73e3bbbc5f74f1ea3b9a032b54d035b6dcb36df97da02b0f0_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

b45b4771e2e1152be2a65cfdfc45d285

Code Sign

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2
Certificate

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Not Before

23/03/2022, 00:00

Not After

16/03/2025, 23:59

Subject

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

01/02/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

25/05/2021, 00:00

Not After

24/05/2036, 23:59

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19/11/2020, 20:32

Not After

19/11/2035, 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3b:8a:69:59:be:14:05:64:71:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

15/02/2024, 20:36

Not After

15/02/2025, 20:36

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16/04/2020, 18:36

Not After

16/04/2045, 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:f8:3c:a4:49:ea:d7:ba:d1:a8:d9:00:00:00:00:f8:3c
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Not Before

10/05/2024, 02:23

Not After

13/05/2024, 02:23

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:f8:3c:a4:49:ea:d7:ba:d1:a8:d9:00:00:00:00:f8:3c
Certificate

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Not Before

10/05/2024, 02:23

Not After

13/05/2024, 02:23

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13/04/2021, 17:31

Not After

13/04/2026, 17:31

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01/04/2021, 20:05

Not After

01/04/2036, 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19/11/2020, 20:32

Not After

19/11/2035, 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:37:02:4b:c5:2a:40:7a:35:4b:00:00:00:00:00:37
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

15/02/2024, 20:35

Not After

15/02/2025, 20:35

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=Thales TSS ESN:BB73-96FD-77EF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7d:61:bd:0e:e3:af:40:2c:ec:60:70:cc:74:33:2e:ab:00:b8:55:e7:48:94:46:92:19:9c:f8:87:57:d7:46:45
Signer

Actual PE Digest

7d:61:bd:0e:e3:af:40:2c:ec:60:70:cc:74:33:2e:ab:00:b8:55:e7:48:94:46:92:19:9c:f8:87:57:d7:46:45

Digest Algorithm

sha256

PE Digest Matches

true

7d:61:bd:0e:e3:af:40:2c:ec:60:70:cc:74:33:2e:ab:00:b8:55:e7:48:94:46:92:19:9c:f8:87:57:d7:46:45
Signer

Actual PE Digest

7d:61:bd:0e:e3:af:40:2c:ec:60:70:cc:74:33:2e:ab:00:b8:55:e7:48:94:46:92:19:9c:f8:87:57:d7:46:45

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\actions-runner\_work\galaxy-mbamsi\galaxy-mbamsi\bin\Win32\Release\mbamsi32.pdb

Imports

crypt32

CertDuplicateCertificateContext
CertOpenStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CryptDecodeObject
CryptDecodeObjectEx
CryptMsgGetParam
CertGetNameStringW
CertFindCertificateInStore
CryptQueryObject
CertCloseStore
CryptMsgClose
CertFreeCertificateContext

iphlpapi

GetAdaptersInfo

kernel32

GetTimeZoneInformation
FreeLibrary
FormatMessageW
GlobalAlloc
GlobalFree
GetFileAttributesExW
SetFileAttributesW
GetLongPathNameW
GetWindowsDirectoryW
GetModuleFileNameW
GetFileAttributesW
CreateDirectoryW
GetVolumePathNameW
RemoveDirectoryW
DeleteFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
OpenThread
SetThreadPriority
SetFilePointer
GetFileSizeEx
Wow64GetThreadContext
GetThreadContext
SuspendThread
ResumeThread
GetFileSize
SetEndOfFile
GetStdHandle
GetModuleHandleA
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
TerminateProcess
GetStartupInfoW
ReleaseMutex
CreateMutexW
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetEnvironmentVariableW
SetEnvironmentVariableW
GetFileType
DeleteFiber
QueryPerformanceCounter
ConvertFiberToThread
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
SetEvent
OutputDebugStringW
GetCurrentThread
LoadLibraryW
GetExitCodeProcess
CreateProcessW
QueryDosDeviceW
Module32NextW
Module32FirstW
OpenProcess
CreateToolhelp32Snapshot
GetNativeSystemInfo
IsWow64Process
GetLocalTime
GetSystemWindowsDirectoryW
GetDriveTypeW
GetLogicalDriveStringsW
CopyFileW
MoveFileExW
GetSystemDirectoryW
GetCurrentProcess
GetSystemInfo
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
WideCharToMultiByte
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
FlushFileBuffers
ConnectNamedPipe
WaitNamedPipeW
TransactNamedPipe
GetNamedPipeServerProcessId
GetOverlappedResult
ResetEvent
CancelIoEx
DisconnectNamedPipe
WaitForSingleObject
PeekNamedPipe
GetNamedPipeClientProcessId
WaitForMultipleObjects
CreateNamedPipeW
WriteFile
SetLastError
SetNamedPipeHandleState
ReadFile
LocalFree
CreateEventW
LocalAlloc
GetCurrentProcessId
SwitchToThread
Sleep
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
SystemTimeToTzSpecificLocalTime
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
CloseHandle
HeapReAlloc
FileTimeToSystemTime
GetLastError
HeapSize
CreateFileW
FindClose
InitializeCriticalSectionEx
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
SetStdHandle
GetConsoleOutputCP
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
SetConsoleCtrlHandler
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RaiseException
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
GetCPInfo
LCMapStringEx
EncodePointer
SleepConditionVariableSRW
WakeAllConditionVariable
ExpandEnvironmentStringsW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FindNextFileW
HeapFree
FindFirstFileW
lstrcmpA
GetTickCount
GetStringTypeW
QueryPerformanceFrequency

user32

MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation

advapi32

GetNamedSecurityInfoW
SetEntriesInAclW
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegDeleteTreeW
RegSetKeyValueW
SetSecurityDescriptorDacl
IsTextUnicode
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
OpenThreadToken
OpenProcessToken
LsaNtStatusToWinError
GetExplicitEntriesFromAclW
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptDestroyHash
CryptReleaseContext
CryptCreateHash
CryptAcquireContextW
ImpersonateLoggedOnUser
CreateWellKnownSid
GetSidSubAuthority
GetSidSubAuthorityCount
AreAllAccessesGranted
MapGenericMask
ConvertStringSidToSidW
ConvertSidToStringSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegQueryInfoKeyW
RegLoadAppKeyW
RegLoadKeyW
RegEnumValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
TreeSetNamedSecurityInfoW
SetSecurityInfo
GetSecurityInfo
SetNamedSecurityInfoW
DeleteAce
FreeSid

shell32

SHGetFolderPathW

oleaut32

VariantClear

mpr

WNetGetConnectionW

netapi32

NetApiBufferFree
NetWkstaGetInfo

wintrust

WinVerifyTrust
CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext

psapi

EnumProcessModulesEx
GetProcessImageFileNameW
GetModuleFileNameExW
GetMappedFileNameW

authz

AuthzFreeResourceManager
AuthzInitializeResourceManager
AuthzInitializeContextFromSid
AuthzAccessCheck
AuthzFreeContext

sfc

SfcIsFileProtected

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCreateHash
BCryptDestroyKey
BCryptImportKeyPair
BCryptGenRandom
BCryptVerifySignature
BCryptGetProperty

ws2_32

recv
send
closesocket
WSASetLastError
WSAGetLastError
WSACleanup
WSAStartup

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 709KB - Virtual size: 709KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b45b4771e2e1152be2a65cfdfc45d285

Code Sign

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2Certificate

Extended Key Usages

Key Usages

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2dCertificate

Key Usages

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:dbCertificate

Extended Key Usages

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:3b:8a:69:59:be:14:05:64:71:00:00:00:00:00:3bCertificate

Extended Key Usages

Key Usages

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99Certificate

Key Usages

33:00:00:f8:3c:a4:49:ea:d7:ba:d1:a8:d9:00:00:00:00:f8:3cCertificate

Extended Key Usages

Key Usages

33:00:00:f8:3c:a4:49:ea:d7:ba:d1:a8:d9:00:00:00:00:f8:3cCertificate

Extended Key Usages

Key Usages

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07Certificate

Key Usages

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07Certificate

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:37:02:4b:c5:2a:40:7a:35:4b:00:00:00:00:00:37Certificate

Extended Key Usages

Key Usages

7d:61:bd:0e:e3:af:40:2c:ec:60:70:cc:74:33:2e:ab:00:b8:55:e7:48:94:46:92:19:9c:f8:87:57:d7:46:45Signer

7d:61:bd:0e:e3:af:40:2c:ec:60:70:cc:74:33:2e:ab:00:b8:55:e7:48:94:46:92:19:9c:f8:87:57:d7:46:45Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

iphlpapi

kernel32

user32

advapi32

shell32

oleaut32

mpr

netapi32

wintrust

psapi

authz

sfc

version

bcrypt

ws2_32

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 709KB - Virtual size: 709KB

.data Size: 32KB - Virtual size: 49KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 83KB - Virtual size: 82KB

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2
Certificate

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d
Certificate

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:3b:8a:69:59:be:14:05:64:71:00:00:00:00:00:3b
Certificate

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

33:00:00:f8:3c:a4:49:ea:d7:ba:d1:a8:d9:00:00:00:00:f8:3c
Certificate

33:00:00:f8:3c:a4:49:ea:d7:ba:d1:a8:d9:00:00:00:00:f8:3c
Certificate

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07
Certificate

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:37:02:4b:c5:2a:40:7a:35:4b:00:00:00:00:00:37
Certificate

7d:61:bd:0e:e3:af:40:2c:ec:60:70:cc:74:33:2e:ab:00:b8:55:e7:48:94:46:92:19:9c:f8:87:57:d7:46:45
Signer

7d:61:bd:0e:e3:af:40:2c:ec:60:70:cc:74:33:2e:ab:00:b8:55:e7:48:94:46:92:19:9c:f8:87:57:d7:46:45
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 709KB - Virtual size: 709KB

.data
Size: 32KB - Virtual size: 49KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 83KB - Virtual size: 82KB