196b04ef6ba09056c56b6dddd08fb32263d09b527d283e41d47497773acd5c8c_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

196b04ef6ba09056c56b6dddd08fb32263d09b527d283e41d47497773acd5c8c_NeikiAnalytics.exe
Size

1.7MB
MD5

27c441d3095f1793fc7cb7e43a95f240
SHA1

2fdab1940c4aa3996450218a65d30affac1e74cb
SHA256

196b04ef6ba09056c56b6dddd08fb32263d09b527d283e41d47497773acd5c8c
SHA512

067c914ccda79124e876ab0ebf3d047235fec8ae5ef6e384d513b40d74aa82228b52a28bea5fb54d345389f45e2e59bea2ef1eb24e3845abfcd532e03434cf21
SSDEEP

49152:8llBv5Nub5Nxg6+NFMHZEnTizVQFEdxz1OeO0FRO/OEZ8mCXmpF+TBZ5v+E:eDupg6+NFGZuizVYEdxz1Oeo/OEqmCXn

Score

1^/10

Malware Config

Signatures

Files

196b04ef6ba09056c56b6dddd08fb32263d09b527d283e41d47497773acd5c8c_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

d17d618645d6e77f548205a0ce442ef6

Code Sign

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:0d:8e:7b:88:93:ab
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

04/04/2014, 09:08

Not After

04/04/2017, 09:08

Subject

CN=Parallels International GmbH,O=Parallels International GmbH,L=Schaffhausen,ST=Schaffhausen,C=CH

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ec:3d:72:7c:39:05:75:91:be:ae:c9:79:ca:29:94:08:6f:c9:85:45
Signer

Actual PE Digest

ec:3d:72:7c:39:05:75:91:be:ae:c9:79:ca:29:94:08:6f:c9:85:45

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Projects\2X\Bin\Release-Unicode\AppServer\Binaries\2XPCAgent.pdb

Imports

kernel32

GlobalSize
DeactivateActCtx
ActivateActCtx
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetVolumeInformationW
GetFullPathNameW
lstrcmpW
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
ReleaseActCtx
SetThreadPriority
ResumeThread
lstrcmpA
GlobalGetAtomNameW
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetFileAttributesExW
GetFileSizeEx
GetFileTime
GlobalFlags
InterlockedExchange
GetLocaleInfoW
GetUserDefaultUILanguage
lstrcpyW
GetWindowsDirectoryW
GetNumberFormatW
InitializeCriticalSectionAndSpinCount
GetProfileIntW
SearchPathW
VirtualProtect
FindResourceExW
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetSystemTimeAsFileTime
GetDriveTypeW
FindFirstFileExW
RtlUnwind
RaiseException
HeapReAlloc
GetTimeFormatW
GetDateFormatW
ExitThread
CreateThread
HeapQueryInformation
HeapSize
ExitProcess
VirtualAlloc
GetSystemInfo
VirtualQuery
SetStdHandle
GetFileType
UnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetStdHandle
SetHandleCount
GetStartupInfoW
QueryPerformanceCounter
MulDiv
GetConsoleCP
GetConsoleMode
GetFileInformationByHandle
PeekNamedPipe
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
IsProcessorFeaturePresent
LCMapStringW
WriteConsoleW
SetEnvironmentVariableA
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
CreateSemaphoreW
TerminateThread
ReleaseSemaphore
InterlockedDecrement
GetSystemDefaultLangID
SetThreadLocale
GetThreadLocale
GetTimeZoneInformation
GetExitCodeProcess
TerminateProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
lstrcmpiW
GetCurrentDirectoryW
GetFileSize
GetComputerNameW
HeapFree
GetProcessHeap
HeapAlloc
FreeLibrary
GlobalAlloc
SetLastError
GlobalFree
GlobalUnlock
GlobalLock
LocalAlloc
CreateEventW
Sleep
lstrlenA
CopyFileW
FindClose
FindFirstFileW
MoveFileExW
GetTempFileNameW
GetTempPathW
ReleaseMutex
WaitForSingleObjectEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile
CreateFileMappingW
GetVersionExA
GetVersionExW
GetFileAttributesW
InterlockedCompareExchange
MoveFileW
DeleteFileW
GetSystemTime
WritePrivateProfileStringW
GetPrivateProfileStringW
SetEvent
OpenEventW
LocalFree
CreateMutexW
FormatMessageW
WaitForMultipleObjects
FileTimeToLocalFileTime
FileTimeToSystemTime
SetPriorityClass
InterlockedIncrement
VerSetConditionMask
VerifyVersionInfoW
GetLastError
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetTickCount
GetModuleHandleW
WaitForSingleObject
DuplicateHandle
SetConsoleCtrlHandler
SetUnhandledExceptionFilter
GetLocalTime
LoadLibraryA
CreateDirectoryW
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
CreateProcessW
GetModuleFileNameW
GetCurrentThread
CloseHandle
GetCurrentProcess
GetProcAddress
LoadLibraryW
FindResourceW
LoadResource
LockResource
SizeofResource

user32

GetDoubleClickTime
SubtractRect
MapDialogRect
DrawIcon
DestroyCursor
GetWindowRgn
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
IsWindowEnabled
GetNextDlgTabItem
EndDialog
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
UpdateWindow
GetClientRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
GetWindow
NotifyWinEvent
GetParent
InvalidateRect
DrawFocusRect
FillRect
LoadBitmapW
CopyRect
CharUpperW
GetMenuState
GetMenuStringW
AppendMenuW
CharUpperBuffW
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
KillTimer
SetTimer
DeleteMenu
LoadIconW
LoadCursorW
SetCursor
PtInRect
GetWindowRect
GetWindowLongW
GetSysColor
DestroyIcon
SendDlgItemMessageW
GetLastActivePopup
MessageBoxW
IsWindowVisible
IsWindow
SendMessageW
PostMessageW
EnumWindows
GetClassNameW
GetWindowThreadProcessId
ReleaseDC
GetDC
EnableWindow
GetDlgItem
BringWindowToTop
SetForegroundWindow
SetWindowPos
GetSystemMetrics
IsClipboardFormatAvailable
SetMenuDefaultItem
CreateMenu
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
WaitMessage
PostThreadMessageW
IsMenu
MonitorFromPoint
UpdateLayeredWindow
UnionRect
MapVirtualKeyExW
IsCharLowerW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
LockWindowUpdate
SetCursorPos
CreateAcceleratorTableW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
CopyAcceleratorTableW
DrawFrameControl
DrawEdge
DrawStateW
GetCursorPos
GetSystemMenu
CopyIcon
wsprintfW
SetClassLongW
DestroyAcceleratorTable
SetParent
SetWindowRgn
IsZoomed
WindowFromPoint
SetRect
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
TranslateAcceleratorW
IsIconic
DrawIconEx
GetNextDlgGroupItem
LoadImageW
RegisterClipboardFormatW
GetUpdateRect
GetMenuItemID
FrameRect
CopyImage
GetIconInfo
OffsetRect
MessageBeep
EnableScrollBar
HideCaret
InvertRect
ReleaseCapture
GetAsyncKeyState
SetCapture
IsRectEmpty
CreatePopupMenu
GetMenuDefaultItem
RedrawWindow
SetLayeredWindowAttributes
EnumDisplayMonitors
ShowOwnedPopups
SetRectEmpty
IntersectRect
PostQuitMessage
RealChildWindowFromPoint
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
GetSysColorBrush
LoadMenuW
MapVirtualKeyW
GetKeyNameTextW
EndPaint
BeginPaint
ValidateRect
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
GetMessageW
TranslateMessage
ScreenToClient
GetWindowDC

advapi32

GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegOpenKeyExW
RegFlushKey
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
OpenSCManagerW
CreateServiceW
ChangeServiceConfig2W
StartServiceW
CloseServiceHandle
OpenServiceW
ControlService
DeleteService
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegSetValueExW
GetLengthSid
CopySid
IsValidSid
GetSidSubAuthority
InitializeSid
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
AddAce
InitializeAcl
GetAclInformation
MakeAbsoluteSD
LookupAccountNameW
GetSidLengthRequired
RegOpenKeyW
RegQueryValueExA
SetSecurityDescriptorOwner
GetUserNameW
ConvertSidToStringSidW
RegDeleteKeyW
RegDeleteValueW
ConvertStringSidToSidW

oleaut32

SysFreeString
VarBstrFromDate
SysAllocString
VariantInit
VariantClear
SysAllocStringLen
VariantChangeType
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen

msimg32

AlphaBlend
TransparentBlt

comctl32

ImageList_GetIconSize

shlwapi

StrCpyW
SHDeleteKeyW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
PathRemoveFileSpecW
PathAppendW

gdiplus

GdipAlloc
GdipFree
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipDeleteGraphics
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipDrawImageRectI
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup

ws2_32

WSASetLastError
WSAIoctl
WSAStartup
socket
inet_addr
htonl
htons
bind
getsockname
ntohs
closesocket
listen
setsockopt
WSAGetLastError
accept
getpeername
select
getaddrinfo
freeaddrinfo
shutdown
recv
send
sendto
recvfrom
ioctlsocket
inet_ntoa
getnameinfo
WSAStringToAddressW
__WSAFDIsSet
connect
gethostbyname

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo

iphlpapi

GetAdaptersInfo

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory
WTSQuerySessionInformationW

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundW

gdi32

LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
MoveToEx
SaveDC
CreateBitmap
GetTextMetricsW
BitBlt
GetObjectW
CreateDCW
CopyMetaFileW
GetDeviceCaps
SetBkColor
SetTextColor
CreateSolidBrush
DeleteObject
RestoreDC
SetTextAlign
SelectObject
CreateDIBSection
CreateCompatibleDC
GetTextFaceW
SetPixelV
SetPaletteEntries
ExtFloodFill
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
LPtoDP
EnumFontFamiliesExW
GetRgnBox
OffsetRgn
Rectangle
SetPixel
StretchBlt
GetLayout
SetLayout
SetDIBColorTable
Polygon
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
CreateRectRgnIndirect
PatBlt
CreateFontIndirectW
GetTextExtentPoint32W
SetRectRgn
CombineRgn
DPtoLP
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetBkColor
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
CreateRoundRectRgn
CreatePolygonRgn
GetTextColor
CreateEllipticRgn
Polyline
Ellipse

winspool.drv

EnumPortsW
XcvDataW
GetPrinterDataExW
AddPrinterW
DeletePrinterDriverW
AddPrinterDriverW
GetPrinterDriverDirectoryW
DocumentPropertiesW
GetPrinterW
OpenPrinterW
SetPrinterW
DeletePrinter
ClosePrinter
EnumPrintersW
EnumPrinterDriversW

comdlg32

GetFileTitleW

shell32

ShellExecuteW
SHGetPathFromIDListW
SHGetFileInfoW
SHAppBarMessage
SHBrowseForFolderW
SHGetDesktopFolder
SHGetSpecialFolderLocation
DragFinish
DragQueryFileW

ole32

RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateStreamOnHGlobal
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoInitialize
CoCreateInstance

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 348KB - Virtual size: 348KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d17d618645d6e77f548205a0ce442ef6

Code Sign

07Certificate

Key Usages

04:0d:8e:7b:88:93:abCertificate

Extended Key Usages

Key Usages

ec:3d:72:7c:39:05:75:91:be:ae:c9:79:ca:29:94:08:6f:c9:85:45Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

oleaut32

msimg32

comctl32

shlwapi

gdiplus

ws2_32

version

setupapi

iphlpapi

wtsapi32

oleacc

imm32

winmm

gdi32

winspool.drv

comdlg32

shell32

ole32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 348KB - Virtual size: 348KB

.data Size: 28KB - Virtual size: 62KB

.rsrc Size: 2KB - Virtual size: 1KB

07
Certificate

04:0d:8e:7b:88:93:ab
Certificate

ec:3d:72:7c:39:05:75:91:be:ae:c9:79:ca:29:94:08:6f:c9:85:45
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 348KB - Virtual size: 348KB

.data
Size: 28KB - Virtual size: 62KB

.rsrc
Size: 2KB - Virtual size: 1KB