4794ca3fd1badf07a11073b838ae7f06696fa0e4f0813ffc7954b71e496ea54c_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4794ca3fd1badf07a11073b838ae7f06696fa0e4f0813ffc7954b71e496ea54c_NeikiAnalytics.exe
Size

32KB
MD5

ee52ef0a8d37adcd9c8dc4dac9db9560
SHA1

a4c1c8d505f004955380c300d7f3c393bb930688
SHA256

4794ca3fd1badf07a11073b838ae7f06696fa0e4f0813ffc7954b71e496ea54c
SHA512

85aab97a82406fc948c73836d4ef48fd3a50bc2e5526c86da5b65965e8ac5c0279db941107ab38013b30971f7f5c78ea0d13f0308f32cf42d7c10e9901394904
SSDEEP

768:JbOIuxf91C4QtL4ZOzZVYi2BdvAMxkEzVU:JbOIIVXpOzb72XxdU

Score

1^/10

Malware Config

Signatures

Files

4794ca3fd1badf07a11073b838ae7f06696fa0e4f0813ffc7954b71e496ea54c_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

fb898e629330aafde30e9d221a8ba93d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:33:54:9a:f0:50:83:85:cd:10:ea:27:7f:83:78:80
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

29/08/2023, 00:00

Not After

28/08/2024, 23:59

Subject

CN=Autodesk\, Inc.,O=Autodesk\, Inc.,L=San Rafael,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6c:9f:2f:c6:54:25:c4:85:f8:40:d3:44:9b:b8:22:43:e7:e2:a9:1f:c9:31:8c:d3:24:38:58:37:d2:9a:94:da
Signer

Actual PE Digest

6c:9f:2f:c6:54:25:c4:85:f8:40:d3:44:9b:b8:22:43:e7:e2:a9:1f:c9:31:8c:d3:24:38:58:37:d2:9a:94:da

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\Build\Output\Bin\Map\Release64\AcMapGWSeTransmitPlugin.pdb

Imports

acdb24

?acrxLoadModule@@YA_NPEB_W_N1@Z

acetransmit

?removeReactor@DwgDepends@AcDwgDepends@@SA_NPEAVDwgDependsReactor@2@@Z
?addReactor@DwgDepends@AcDwgDepends@@SA_NPEAVDwgDependsReactor@2@@Z
?addFile@DwgDepends@AcDwgDepends@@QEAA_NPEB_WW4FileType@2@PEBVDwgFile@2@@Z
?removeReactor@DwgRepath@AcDwgDepends@@SA_NPEAVDwgRepathReactor@2@@Z
?addReactor@DwgRepath@AcDwgDepends@@SA_NPEAVDwgRepathReactor@2@@Z
?sourceDwgFile@DwgRepathFile@AcDwgDepends@@QEBAPEAVDwgFile@2@XZ
?getDependents@DwgRepathFile@AcDwgDepends@@QEBA_NAEAV?$vector@PEAVDwgRepathFile@AcDwgDepends@@V?$allocator@PEAVDwgRepathFile@AcDwgDepends@@@std@@@std@@@Z
?database@File@AcDwgDepends@@QEBAPEBVAcDbDatabase@@XZ
?filename@File@AcDwgDepends@@QEBAPEB_WXZ
?fileType@File@AcDwgDepends@@QEBA?AW4FileType@2@XZ

shlwapi

PathFileExistsW

kernel32

GetLastError
DisableThreadLibraryCalls
LoadLibraryW
GetProcAddress
GetCurrentThreadId
GetEnvironmentVariableW
SetEnvironmentVariableW
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
InitializeSListHead
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime

advapi32

RegEnumKeyW
RegOpenKeyExW
RegGetValueW
RegCloseKey

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
memset
memmove
__std_exception_copy
__std_exception_destroy
__std_type_info_destroy_list
__C_specific_handler
__std_terminate
memcpy

api-ms-win-crt-string-l1-1-0

_wcsdup

api-ms-win-crt-convert-l1-1-0

_wtof

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_crt_atexit
_invalid_parameter_noinfo_noreturn
_initterm
_register_onexit_function
_cexit

Exports

Exports

eTransmitEntryPoint

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fb898e629330aafde30e9d221a8ba93d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

07:33:54:9a:f0:50:83:85:cd:10:ea:27:7f:83:78:80Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

6c:9f:2f:c6:54:25:c4:85:f8:40:d3:44:9b:b8:22:43:e7:e2:a9:1f:c9:31:8c:d3:24:38:58:37:d2:9a:94:daSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

acdb24

acetransmit

shlwapi

kernel32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 792B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 108B

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

07:33:54:9a:f0:50:83:85:cd:10:ea:27:7f:83:78:80
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

6c:9f:2f:c6:54:25:c4:85:f8:40:d3:44:9b:b8:22:43:e7:e2:a9:1f:c9:31:8c:d3:24:38:58:37:d2:9a:94:da
Signer

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 792B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 108B