84e6ce0201e7d2635a4c57f182006158b0c3ac74cc912322796ac056bf691450_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

84e6ce0201e7d2635a4c57f182006158b0c3ac74cc912322796ac056bf691450_NeikiAnalytics.exe
Size

1.0MB
MD5

a29946553120b9597a870e953dc2b9f0
SHA1

87176fbc4e1b95e405fd8b79c13f571ea6cbac3f
SHA256

84e6ce0201e7d2635a4c57f182006158b0c3ac74cc912322796ac056bf691450
SHA512

a926273fa4dd4fe1854a58befff9dc730dbb69c5add8b2e01ea84422b8d9bae1128b1292f2e529ad11d0da1b5cdadb6f2f8855f8532a94a1da893f1b429b8441
SSDEEP

12288:UqAGEjjQS32j3YVMpxyw+jGIHYQg3ieJph0lhSMXl+RTCSBU:yQdAY7h0lhSMXljSBU

Score

1^/10

Malware Config

Signatures

Files

84e6ce0201e7d2635a4c57f182006158b0c3ac74cc912322796ac056bf691450_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

86b9e11f54b5b52a61c709abc8c235a0

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

64:33:51:d3:c7:38:9f:08
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

24/06/2016, 20:44

Not After

24/06/2031, 20:44

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

36:84:35:28:97:ff:77:d7:4e:62:4d:10:e2:c8:4e:b6
Certificate

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

09/03/2022, 20:57

Not After

08/03/2025, 20:57

Subject

CN=Frederick Emmott,O=Frederick Emmott,L=Austin,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6c:e2:c4:d6:b7:bc:3b:cc:75:24:ba:fc:25:9f:d9:e6:08:25:50:93:0c:92:cc:fc:b3:95:8a:bb:52:0c:3b:0f
Signer

Actual PE Digest

6c:e2:c4:d6:b7:bc:3b:cc:75:24:ba:fc:25:9f:d9:e6:08:25:50:93:0c:92:cc:fc:b3:95:8a:bb:52:0c:3b:0f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\OpenKneeboard\OpenKneeboard\build\src\utilities\RelWithDebInfo\OpenKneeboard-RemoteControl-TOGGLE_FORCE_ZOOM.pdb

Imports

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetCurrentDirectoryW
SetCurrentDirectoryW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister
EventActivityIdControl
EventSetInformation

api-ms-win-core-file-l1-1-0

GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFileAttributesW
GetDiskFreeSpaceExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
WriteFile
CreateFileW
GetFullPathNameW
SetFileAttributesW
SetFileInformationByHandle
SetFileTime
GetFileAttributesExW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
GetLastError
SetUnhandledExceptionFilter
RaiseException
UnhandledExceptionFilter

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-synch-l1-1-0

SetEvent
ResetEvent
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
CreateMutexW
OpenMutexW
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObject
CreateEventExW
CreateSemaphoreExW
CreateEventW
OpenEventW
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
SwitchToThread
TlsFree
GetStartupInfoW
TerminateProcess
GetCurrentProcess
FlushProcessWriteBuffers
GetExitCodeThread
TlsSetValue
GetCurrentThreadId
TlsAlloc
TlsGetValue

api-ms-win-core-memory-l1-1-0

FlushViewOfFile
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetProcAddress
GetModuleFileNameW
FreeLibrary
GetModuleHandleW

api-ms-win-core-console-l1-1-0

AllocConsole

api-ms-win-core-console-l1-2-0

AttachConsole

api-ms-win-core-registry-l1-1-0

RegGetValueW

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment
_beginthreadex
_endthreadex
_get_wide_winmain_command_line
_initterm
_set_app_type
_seh_filter_exe
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_invalid_parameter_noinfo_noreturn
_errno
__p__pgmptr
abort
__p__wpgmptr
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_configure_wide_argv
exit

api-ms-win-crt-convert-l1-1-0

strtof
atol
wcstol
strtod

api-ms-win-crt-math-l1-1-0

_fdclass
_ldclass
_fdsign
frexp
_dsign
__setusermatherr
_ldsign
_dclass

api-ms-win-crt-stdio-l1-1-0

fgetwc
fputwc
__p__commode
fputs
fputc
__stdio_common_vsprintf_s
__stdio_common_vsprintf
_set_fmode
freopen_s
fclose
fflush
__acrt_iob_func
ungetc
ungetwc
setvbuf
fwrite
_fseeki64
fsetpos
fgetpos
fgetc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func
localeconv
_configthreadlocale
_unlock_locales
___lc_collate_cp_func
_lock_locales
___lc_codepage_func
__pctype_func
___lc_locale_name_func
setlocale

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_set_new_mode
calloc
free
realloc

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-file-l2-1-0

MoveFileExW
CreateSymbolicLinkW
CreateDirectoryExW
CreateHardLinkW
GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringEx
GetStringTypeW
MultiByteToWideChar

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

FormatMessageA
GetCPInfo
GetLocaleInfoEx
LCMapStringEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
InitOnceExecuteOnce
WakeConditionVariable

api-ms-win-core-processthreads-l1-1-1

GetCurrentProcessorNumber
IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWait
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
SetThreadpoolWait
FreeLibraryWhenCallbackReturns
CloseThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWait

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlPcToFileHeader
RtlVirtualUnwind
RtlUnwindEx

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedFlushSList
InitializeSListHead

api-ms-win-crt-string-l1-1-0

strcspn
strcpy_s
islower
_wcsdup
isupper
isspace
tolower
strncmp
wcsncmp
wcsnlen
__strncnt

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

api-ms-win-crt-time-l1-1-0

_Gettnames
_Wcsftime
_W_Gettnames
_W_Getmonths
_W_Getdays
_Getmonths
_Getdays
_Strftime

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

Sections

.text
Size: 681KB - Virtual size: 681KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 273KB - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1024B - Virtual size: 863B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86b9e11f54b5b52a61c709abc8c235a0

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

64:33:51:d3:c7:38:9f:08Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

36:84:35:28:97:ff:77:d7:4e:62:4d:10:e2:c8:4e:b6Certificate

Extended Key Usages

Key Usages

6c:e2:c4:d6:b7:bc:3b:cc:75:24:ba:fc:25:9f:d9:e6:08:25:50:93:0c:92:cc:fc:b3:95:8a:bb:52:0c:3b:0fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-core-heap-l1-1-0

Sections

.text Size: 681KB - Virtual size: 681KB

.rdata Size: 273KB - Virtual size: 273KB

.data Size: 9KB - Virtual size: 55KB

.pdata Size: 29KB - Virtual size: 28KB

.idata Size: 18KB - Virtual size: 18KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 373B

_RDATA Size: 1024B - Virtual size: 863B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 5KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

64:33:51:d3:c7:38:9f:08
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

36:84:35:28:97:ff:77:d7:4e:62:4d:10:e2:c8:4e:b6
Certificate

6c:e2:c4:d6:b7:bc:3b:cc:75:24:ba:fc:25:9f:d9:e6:08:25:50:93:0c:92:cc:fc:b3:95:8a:bb:52:0c:3b:0f
Signer

.text
Size: 681KB - Virtual size: 681KB

.rdata
Size: 273KB - Virtual size: 273KB

.data
Size: 9KB - Virtual size: 55KB

.pdata
Size: 29KB - Virtual size: 28KB

.idata
Size: 18KB - Virtual size: 18KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 373B

_RDATA
Size: 1024B - Virtual size: 863B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 5KB