182985523ac3f0885178483baa88fd2ec0ed9b02cfe336428b5ac272cbe7d448_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

182985523ac3f0885178483baa88fd2ec0ed9b02cfe336428b5ac272cbe7d448_NeikiAnalytics.exe
Size

25KB
MD5

b3d7a5b473e9c83703b0cd103a5a7bf0
SHA1

540587b701942201ae68a6ef19b0bc6cdd71dfe4
SHA256

182985523ac3f0885178483baa88fd2ec0ed9b02cfe336428b5ac272cbe7d448
SHA512

ddc7856bd1d31818d84d49daa5b573d0bce9b59c9a090dc53f13f4459f5db7ec2b2dbb542f74756ae91e80d7a6b926fbb3b09e13177c78ad279cf30d50bce028
SSDEEP

384:FtbOJ6X2JzxkpDSi8yvDVLoINqegOld6ZRzTDaUYJLca6j8NXOeMB:aUCxkp2i7D1omHgOlkzT25LFm9

Score

1^/10

Malware Config

Signatures

Files

182985523ac3f0885178483baa88fd2ec0ed9b02cfe336428b5ac272cbe7d448_NeikiAnalytics.exe
.dll windows:5 windows x64 arch:x64

1660d1a8425eef8993d6732ca97312cd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:0e:7d:5a:0a:03:86:85:1a:33:ef:a6:5f:5b:56:45
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08/11/2010, 00:00

Not After

29/11/2012, 23:59

Subject

CN=Gesellschaft fuer Optische Messtechnik mbH,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Gesellschaft fuer Optische Messtechnik mbH,L=Braunschweig,ST=Niedersachsen,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:0d:8e:b5:3d:7a:c6:7d:e6:8c:fb:09:30:f7:06:8b:dc:26:02:72
Signer

Actual PE Digest

6b:0d:8e:b5:3d:7a:c6:7d:e6:8c:fb:09:30:f7:06:8b:dc:26:02:72

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\dev\v7.2\lib-win64\libTomMExpression.pdb

Imports

qtcore4

?staticMetaObject@QObject@@2UQMetaObject@@B
?connect@QObject@@SA_NPEBV1@PEBD01W4ConnectionType@Qt@@@Z
?qFlagLocation@@YAPEBDPEBD@Z
??0QObject@@QEAA@PEAV0@@Z
?event@QObject@@UEAA_NPEAVQEvent@@@Z
?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z
?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z
?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z
?customEvent@QObject@@MEAAXPEAVQEvent@@@Z
?connectNotify@QObject@@MEAAXPEBD@Z
?disconnectNotify@QObject@@MEAAXPEBD@Z
?qt_metacast@QObject@@UEAAPEAXPEBD@Z
??1QObject@@UEAA@XZ
?qt_metacall@QObject@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z

libtomgl

?getMainViewWidget@ViewWidget@GL@Tom@@SAPEAV123@XZ

libtomfigure2

?increaseModifiedCounter@FigureTokenInterface@Fig2@Tom@@SAXXZ

libtomexpression

?getViewDependentObjects@ExpressionCache@Expression@Tom@@QEBAAEBV?$set@PEBVTObject@Tom@@U?$less@PEBVTObject@Tom@@@std@@V?$allocator@PEBVTObject@Tom@@@4@@std@@XZ
?clearValues@ExpressionCache@Expression@Tom@@QEAA_NPEBVValueFilter@123@@Z
?getExpressionCache@ExpressionCache@Expression@Tom@@SAPEAV123@XZ
??0ValueFilter@ExpressionCache@Expression@Tom@@QEAA@XZ
??1ValueFilter@ExpressionCache@Expression@Tom@@UEAA@XZ

libtom

?installTranslator@Tom@@YAXPEBD@Z

msvcr90

_onexit
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__CppXcptFilter
_amsg_exit
_decode_pointer
_encoded_null
free
_initterm_e
_initterm
_malloc_crt
_encode_pointer
__C_specific_handler
?terminate@@YAXXZ
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z
??2@YAPEAX_K@Z

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
Sleep

Exports

Exports

?CloseLibrary@MExpression@Tom@@YAXXZ
?InitLibrary@MExpression@Tom@@YAXPEAVAppStatusManager@GApp@2@PEAVCfgNode@2@@Z
?clearExpressionCache@MExpression@Tom@@YAXXZ

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 504B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1660d1a8425eef8993d6732ca97312cd

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

75:0e:7d:5a:0a:03:86:85:1a:33:ef:a6:5f:5b:56:45Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

6b:0d:8e:b5:3d:7a:c6:7d:e6:8c:fb:09:30:f7:06:8b:dc:26:02:72Signer

Headers

File Characteristics

PDB Paths

Imports

qtcore4

libtomgl

libtomfigure2

libtomexpression

libtom

msvcr90

kernel32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 696B

.pdata Size: 512B - Virtual size: 504B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 260B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

75:0e:7d:5a:0a:03:86:85:1a:33:ef:a6:5f:5b:56:45
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

6b:0d:8e:b5:3d:7a:c6:7d:e6:8c:fb:09:30:f7:06:8b:dc:26:02:72
Signer

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 696B

.pdata
Size: 512B - Virtual size: 504B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 260B