18380fd5be67b26a66f63e484df4240cac788a3cfddf0209fe141782c031e77d_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

18380fd5be67b26a66f63e484df4240cac788a3cfddf0209fe141782c031e77d_NeikiAnalytics.exe
Size

89KB
MD5

5b810894c6c280d7e07daa0959195d40
SHA1

d3dd971f33a905a6c44fec886fbf6c312be87050
SHA256

18380fd5be67b26a66f63e484df4240cac788a3cfddf0209fe141782c031e77d
SHA512

8f42f9cf8876226acba768092248459fc7b42ef40d47aef9ca445b5b6f9b49a1ab8cef3a1baa8d32e1813d77b76a2f4c9f28006fa5bdc1fcca0a33c6e7c98c54
SSDEEP

1536:CmMF03K0F/v1Sz+352Won3FFfAE30OoLqMIBoPT5jvy:CmYPi6+Je3FFfMOoSuNby

Score

1^/10

Malware Config

Signatures

Files

18380fd5be67b26a66f63e484df4240cac788a3cfddf0209fe141782c031e77d_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

bb821270349bd57311cb7a0c4fc15c7e

Code Sign

0b:b4:e9:c7:98:d8:3f:29:6f:f0:51:aa:04:b7:59:00
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

15/04/2020, 00:00

Not After

19/06/2023, 12:00

Subject

SERIALNUMBER=HE 359200,CN=VisualSVN Software Ltd,O=VisualSVN Software Ltd,L=Mesa Geitonia,C=CY,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024359

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c5:a8:ca:8e:9e:2e:08:4b:ca:f9:44:4e:e1:e5:c7:b1:f5:e7:e7:bb
Signer

Actual PE Digest

c5:a8:ca:8e:9e:2e:08:4b:ca:f9:44:4e:e1:e5:c7:b1:f5:e7:e7:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

libsvn_diff-1.pdb

Imports

msvcr120

_malloc_crt
_initterm
_initterm_e
_lock
_unlock
_calloc_crt
__dllonexit
free
__clean_type_info_names_internal
_except_handler4_common
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
memcpy
memset
_amsg_exit
__CppXcptFilter
abort
strncpy
strrchr
strchr
strstr
strncmp
_onexit
memmove

libapr-1

_apr_hash_set@16
_apr_hash_make@4
_apr_array_make@12
_apr_array_push@4
_apr_time_exp_lt@12
apr_psprintf
_apr_strftime@20
_apr_mmap_delete@4
_apr_pvsprintf@12
_apr_getopt_long@16
_apr_getopt_init@16
_apr_array_cat@8
_apr_mmap_create@28
_apr_file_eof@4
_apr_palloc@8
_apr_pstrdup@8
_apr_hash_next@4
_apr_hash_first@8
_apr_array_copy@8
_apr_hash_count@4
_apr_pool_clear@4
_apr_hash_this_val@4
_apr_pool_destroy@4
_apr_hash_this_key@4
_apr_hash_get@12

kernel32

EncodePointer
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
IsDebuggerPresent
IsProcessorFeaturePresent
DecodePointer

libsvn_subr-1

svn_stringbuf_appendcstr
svn_pool_create_ex
svn_rangelist_to_string
svn_string_create_empty
svn_ctype_table
svn_mergeinfo_parse
svn_error_clear
svn_sort__array
svn_string_compare
svn_mergeinfo_diff2
svn_relpath_join
svn_prop_diffs
svn_relpath_skip_ancestor
svn_error__malfunction
svn_io_files_contents_same_p
svn_stringbuf_appendbytes
svn_stringbuf_dup
svn_stringbuf_setempty
svn_stream_read_full
svn_stream_set_close
svn_stringbuf_strip_whitespace
svn_io_file_close
svn_cstring_strtoui64
svn_utf_cstring_from_utf8_ex2
svn_error_create
svn_stringbuf_create_ensure
svn_stringbuf_first_non_whitespace
svn_io_file_read_full2
svn_io_open_unique_file3
svn_dirent_canonicalize
svn_stream_close
svn_mergeinfo_merge2
svn_io_file_readline
svn_stream_create
svn_stringbuf_create
svn_io_file_seek
svn_io_file_write_full
svn_stringbuf_create_empty
svn_io_file_open
svn_stream_compressed
svn_io_file_get_offset
svn_utf_cstring_to_utf8
svn_stream_set_read2
svn_prop_name_is_valid
svn_io_stat
svn_utf__last_valid
svn_stringbuf_isempty
svn_error_createf
svn_io_file_size_get
svn_eol__detect_eol
svn_cstring_match_glob_list
svn_dirent_is_child
svn_stream_set_baton
svn_stream_puts
svn_stream_set_write
svn_stream_write
svn_stream_empty
svn_stream_printf
svn_cstring_atoi
svn_error_wrap_apr
svn_utf_cstring_from_utf8
svn_io_file_read
svn__adler32
svn_io_file_info_get
svn_eol__find_eol_start
svn_dirent_local_style
svn_string_ncreate
svn_stream_from_aprfile2
svn_stream_seek
svn_io_open_uniquely_named
svn_stringbuf_appendbyte
svn_stream_printf_from_utf8

Exports

Exports

svn_diff__display_prop_diffs
svn_diff__source_create
svn_diff__tree_processor_copy_as_changed_create
svn_diff__tree_processor_create
svn_diff__tree_processor_filter_create
svn_diff__tree_processor_reverse_create
svn_diff__tree_processor_tee_create
svn_diff__unidiff_write_header
svn_diff_close_patch_file
svn_diff_contains_conflicts
svn_diff_contains_diffs
svn_diff_diff
svn_diff_diff3
svn_diff_diff3_2
svn_diff_diff4
svn_diff_diff4_2
svn_diff_diff_2
svn_diff_file_diff
svn_diff_file_diff3
svn_diff_file_diff3_2
svn_diff_file_diff4
svn_diff_file_diff4_2
svn_diff_file_diff_2
svn_diff_file_options_create
svn_diff_file_options_parse
svn_diff_file_output_merge
svn_diff_file_output_merge2
svn_diff_file_output_merge3
svn_diff_file_output_unified
svn_diff_file_output_unified2
svn_diff_file_output_unified3
svn_diff_file_output_unified4
svn_diff_get_binary_diff_original_stream
svn_diff_get_binary_diff_result_stream
svn_diff_hunk__create_adds_single_line
svn_diff_hunk__create_deletes_single_line
svn_diff_hunk__get_fuzz_penalty
svn_diff_hunk_get_leading_context
svn_diff_hunk_get_modified_length
svn_diff_hunk_get_modified_start
svn_diff_hunk_get_original_length
svn_diff_hunk_get_original_start
svn_diff_hunk_get_trailing_context
svn_diff_hunk_readline_diff_text
svn_diff_hunk_readline_modified_text
svn_diff_hunk_readline_original_text
svn_diff_hunk_reset_diff_text
svn_diff_hunk_reset_modified_text
svn_diff_hunk_reset_original_text
svn_diff_mem_string_diff
svn_diff_mem_string_diff3
svn_diff_mem_string_diff4
svn_diff_mem_string_output_merge
svn_diff_mem_string_output_merge2
svn_diff_mem_string_output_merge3
svn_diff_mem_string_output_unified
svn_diff_mem_string_output_unified2
svn_diff_mem_string_output_unified3
svn_diff_open_patch_file
svn_diff_output
svn_diff_output2
svn_diff_output_binary
svn_diff_parse_next_patch
svn_diff_version

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bb821270349bd57311cb7a0c4fc15c7e

Code Sign

0b:b4:e9:c7:98:d8:3f:29:6f:f0:51:aa:04:b7:59:00Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

c5:a8:ca:8e:9e:2e:08:4b:ca:f9:44:4e:e1:e5:c7:b1:f5:e7:e7:bbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr120

libapr-1

kernel32

libsvn_subr-1

Exports

Exports

Sections

.text Size: 56KB - Virtual size: 55KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 4KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 3KB - Virtual size: 2KB

0b:b4:e9:c7:98:d8:3f:29:6f:f0:51:aa:04:b7:59:00
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

c5:a8:ca:8e:9e:2e:08:4b:ca:f9:44:4e:e1:e5:c7:b1:f5:e7:e7:bb
Signer

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 3KB - Virtual size: 2KB