2a925275b6c789d39a960ac71c294572fb2a68f80accf118c141d2d6e0b565e6_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2a925275b6c789d39a960ac71c294572fb2a68f80accf118c141d2d6e0b565e6_NeikiAnalytics.exe
Size

353KB
MD5

ddca52219f8a9e594a58e087c85c5770
SHA1

18b76495bf6e05d2d51234be2ad7b2676c526d89
SHA256

2a925275b6c789d39a960ac71c294572fb2a68f80accf118c141d2d6e0b565e6
SHA512

d4bfcf839033cc140bcbfca83d39d593ad0f95e292d4a63fa6b68330da4079abd50167d0fc23886612c552d2d94685af2cf61e4e7535aabd8fc25acb5a255ca3
SSDEEP

6144:mNcyPxUQMfMxiMSkJeOzcRJPCl+xNdlYaXBixqTBwW8XKIcwKAMk:m6QMkIa7zcRJPC03dlYyAxqTGXXyPk

Score

1^/10

Malware Config

Signatures

Files

2a925275b6c789d39a960ac71c294572fb2a68f80accf118c141d2d6e0b565e6_NeikiAnalytics.exe
.dll regsvr32 windows:4 windows x86 arch:x86

fd132705bb11b9fe928caadbd409a2dc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExW
GetModuleHandleW
OpenProcess
GetSystemWindowsDirectoryW
QueryDosDeviceW
GetLongPathNameW
OpenThread
GetSystemInfo
ReadProcessMemory
LocalAlloc
LocalFree
GetFileAttributesW
SearchPathW
lstrlenA
DebugBreak
OutputDebugStringW
InterlockedDecrement
GetLastError
GetFileAttributesExW
GetModuleFileNameW
GetPrivateProfileIntW
InterlockedIncrement
ReadFile
SetFilePointer
GetFileSize
SetLastError
WriteFile
DisableThreadLibraryCalls
InterlockedCompareExchange
WaitForSingleObject
WaitForMultipleObjects
ResumeThread
CreateThread
DeleteFileW
GetExitCodeThread
CopyFileW
GetTempPathW
MultiByteToWideChar
GetCurrentDirectoryW
GetTickCount
GetSystemDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
DeviceIoControl
SetCurrentDirectoryW
Thread32Next
Thread32First
CreateFileW
Module32NextW
Module32FirstW
GetCurrentProcessId
MoveFileExW
LeaveCriticalSection
CreateSemaphoreW
ReleaseSemaphore
GetLocalTime
CreateEventW
SetEvent
GlobalUnlock
GlobalLock
GlobalSize
FileTimeToLocalFileTime
SystemTimeToFileTime
FlushFileBuffers
FindClose
FindNextFileW
FindFirstFileW
LockFileEx
UnlockFileEx
FileTimeToDosDateTime
GetSystemTime
GetFileType
MapViewOfFile
CreateFileMappingW
DuplicateHandle
GetCurrentProcess
UnmapViewOfFile
Sleep
ResetEvent
lstrcmpA
VirtualFree
FileTimeToSystemTime
VirtualAlloc
CreateMutexW
ReleaseMutex
FormatMessageW
GetCurrentThreadId
GetFileSizeEx
CloseHandle
GetFileInformationByHandle
lstrlenW
WideCharToMultiByte
TerminateProcess
EnterCriticalSection
SetFilePointerEx
GetACP
HeapFree
TlsFree
SetEnvironmentVariableW
TlsAlloc
HeapAlloc
GetProcessHeap
GetEnvironmentVariableW
TlsSetValue
TlsGetValue
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryW
GetProcAddress
SetFileAttributesW
FreeLibrary

user32

GetWindow
wvsprintfW
CharNextW
LoadStringW
GetWindowThreadProcessId
GetAncestor
WindowFromPoint
GetWindowRect
GetShellWindow
GetSystemMetrics
FindWindowW
PostMessageW
CharUpperW
GetForegroundWindow
GetWindowInfo
GetDesktopWindow

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW

ole32

CreateStreamOnHGlobal
GetHGlobalFromStream

oleaut32

SysFreeString
VariantCopy
VariantClear
SysAllocStringLen
SysStringLen
SysAllocString
SysStringByteLen
SysAllocStringByteLen

atl

ord16
ord21
ord23
ord32
ord15

msvcrt

_wmkdir
localtime
_wcsicmp
wcscmp
strlen
_wcsnicmp
fwrite
fclose
fread
fseek
_wfopen
__dllonexit
_onexit
?terminate@@YAXXZ
_initterm
_adjust_fdiv
wcsncpy
wcscpy
wcscat
strncpy
mktime
_CxxThrowException
qsort
_except_handler3
memcmp
_purecall
memmove
realloc
_vsnwprintf
_wtoi
iswdigit
malloc
free
wcslen
??2@YAPAXI@Z
time
__CxxFrameHandler
memset
memcpy
wcsrchr
wcsncmp
_errno
wcstok
_snwprintf
wcschr
swprintf
memchr
_wcslwr
swscanf
tolower
??1type_info@@UAE@XZ
_tzset
strerror

psapi

GetModuleFileNameExW
GetModuleInformation
EnumProcessModules
EnumProcesses

ntdll

_stricmp
_wcsupr
NtQueryVirtualMemory
NtQueryInformationThread
NtQueryInformationProcess
RtlInitUnicodeString
NtCreateFile

netapi32

Netbios

shlwapi

PathCombineW
StrCmpNW
PathRemoveBackslashW
StrCmpNIW
PathIsDirectoryW
PathFileExistsW
StrDupW
PathFindFileNameW
StrCmpIW
StrStrIW
PathAppendW
PathAddBackslashW
PathFindExtensionW
PathStripPathW
StrRChrW
StrCpyNW
PathStripToRootW
StrStrW
StrCmpW
PathUnquoteSpacesW
SHGetValueW
PathRemoveExtensionW
StrChrW

iphlpapi

GetAdaptersInfo

wininet

HttpQueryInfoA
HttpOpenRequestA
InternetSetStatusCallbackA
HttpAddRequestHeadersA
InternetQueryOptionW
InternetCrackUrlW
InternetGetConnectedState
HttpSendRequestExA
HttpEndRequestA
InternetWriteFile
InternetErrorDlg
InternetOpenW
InternetCloseHandle
InternetSetOptionA
InternetOpenA
InternetConnectA
InternetReadFileExA

wintrust

WinVerifyTrust

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

ws2_32

getpeername
WSAStartup
ntohl
inet_ntoa
WSACleanup

winmm

timeGetTime

advapi32

AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid

Exports

Exports

CreateTrayClient
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fd132705bb11b9fe928caadbd409a2dc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

atl

msvcrt

psapi

ntdll

netapi32

shlwapi

iphlpapi

wininet

wintrust

version

ws2_32

winmm

advapi32

Exports

Exports

Sections

.text Size: 236KB - Virtual size: 235KB

.rdata Size: 56KB - Virtual size: 54KB

.data Size: 28KB - Virtual size: 34KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 18KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

.text
Size: 236KB - Virtual size: 235KB

.rdata
Size: 56KB - Virtual size: 54KB

.data
Size: 28KB - Virtual size: 34KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 18KB