7258357259a0ef7e53983b2382dc8090353094b2b23f5aace41b0d8eed4c618f_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7258357259a0ef7e53983b2382dc8090353094b2b23f5aace41b0d8eed4c618f_NeikiAnalytics.exe
Size

1.1MB
MD5

e6322c1d8cdc0fddcbdfcd097bf2c670
SHA1

2b5f85285c5e45f68159242312f36f2ec72d380a
SHA256

7258357259a0ef7e53983b2382dc8090353094b2b23f5aace41b0d8eed4c618f
SHA512

dc42c05aced634f8ee1fcdff0ffec4f36b347f01afa332872b9a90876aff863539617d08a6b4d217fb4426081f5c5f0440b63673e766aadd362f7786561f21f5
SSDEEP

24576:vQ0wcrfgVRWzdsHIEbi2tUMAxxjZSf1nd:vQ0wcrCRWzdIjbi2t5Axxj

Score

1^/10

Malware Config

Signatures

Files

7258357259a0ef7e53983b2382dc8090353094b2b23f5aace41b0d8eed4c618f_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

75c7c2a62cedc63d5e3b596666f77356

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

23/08/2013, 00:00

Not After

23/09/2024, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5e:47:75:35:c6:83:43:ba:71:c7:4d:70:b9:e9:7d:5b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06/09/2014, 00:00

Not After

07/09/2015, 23:59

Subject

CN=NVIDIA Corporation,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f7:1c:73:40:2a:7c:5c:0a:32:75:65:2b:a1:a4:a1:09:a4:37:18:70
Signer

Actual PE Digest

f7:1c:73:40:2a:7c:5c:0a:32:75:65:2b:a1:a4:a1:09:a4:37:18:70

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\dvs\p4\build\sw\rel\gfclient\rel\GfExperienceService\Build\X64\release\GfExperienceService.pdb

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus

shlwapi

PathRemoveFileSpecW
PathFindFileNameW
PathAppendW

kernel32

SetEnvironmentVariableA
ReadConsoleW
WriteConsoleW
SetStdHandle
GetSystemTimeAsFileTime
GetProcessTimes
GetCurrentProcess
QueryPerformanceCounter
QueryPerformanceFrequency
CreateMutexW
CreateFileW
GetModuleFileNameW
ExpandEnvironmentStringsW
WriteFile
WideCharToMultiByte
GetFileSizeEx
ReleaseMutex
OutputDebugStringW
CloseHandle
CreateEventA
SetEvent
WaitForSingleObject
GetCurrentThreadId
HeapFree
GetProcessHeap
GetLastError
FreeLibrary
LoadLibraryW
GetProcAddress
DuplicateHandle
GetCurrentThread
GetExitCodeThread
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FormatMessageA
CreateDirectoryW
DeleteFileW
GetFileAttributesW
RemoveDirectoryW
SetFilePointerEx
SetLastError
DeviceIoControl
GetModuleHandleA
MoveFileExW
AreFileApisANSI
RtlPcToFileHeader
HeapAlloc
LoadLibraryExW
GetThreadTimes
FreeLibraryAndExitThread
CreateTimerQueue
IsProcessorFeaturePresent
WaitForSingleObjectEx
Sleep
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetModuleHandleW
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
GetCommandLineW
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
CreateEventW
TerminateProcess
GetStartupInfoW
GetTickCount
CreateSemaphoreW
ExitThread
GetCPInfo
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent
ExitProcess
GetModuleHandleExW
HeapSize
ReleaseSemaphore
InitializeSListHead
UnregisterWaitEx
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
GetFileType
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile

Sections

.text
Size: 667KB - Virtual size: 667KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75c7c2a62cedc63d5e3b596666f77356

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45Certificate

Extended Key Usages

Key Usages

5e:47:75:35:c6:83:43:ba:71:c7:4d:70:b9:e9:7d:5bCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

f7:1c:73:40:2a:7c:5c:0a:32:75:65:2b:a1:a4:a1:09:a4:37:18:70Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

shlwapi

kernel32

Sections

.text Size: 667KB - Virtual size: 667KB

.rdata Size: 221KB - Virtual size: 220KB

.data Size: 33KB - Virtual size: 61KB

.pdata Size: 37KB - Virtual size: 37KB

.rsrc Size: 147KB - Virtual size: 146KB

.reloc Size: 7KB - Virtual size: 6KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

5e:47:75:35:c6:83:43:ba:71:c7:4d:70:b9:e9:7d:5b
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f7:1c:73:40:2a:7c:5c:0a:32:75:65:2b:a1:a4:a1:09:a4:37:18:70
Signer

.text
Size: 667KB - Virtual size: 667KB

.rdata
Size: 221KB - Virtual size: 220KB

.data
Size: 33KB - Virtual size: 61KB

.pdata
Size: 37KB - Virtual size: 37KB

.rsrc
Size: 147KB - Virtual size: 146KB

.reloc
Size: 7KB - Virtual size: 6KB