872673821f4c449c6ecd260ad5eb712f14822558e966c4dd3dc9de1fdb62c77f_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

872673821f4c449c6ecd260ad5eb712f14822558e966c4dd3dc9de1fdb62c77f_NeikiAnalytics.exe
Size

759KB
MD5

79b7855a8f14a4ea424955e9d2e8e7e0
SHA1

0f78d7c6ed4b0eb01b9b9b1a4ae3c9646bc57f0c
SHA256

872673821f4c449c6ecd260ad5eb712f14822558e966c4dd3dc9de1fdb62c77f
SHA512

43ac35f2a6f7b709a0fa53e247d1367d85963afdc1b9609df5365e75912a59ed1cc12415bc3891bf47e58d0f03f7564519b3eabb42f7542bbe31ee98e9ec1dae
SSDEEP

12288:6YPFgeUIpl8jpoWxUw2OLq3fywVIHyLWELFev2r2r4A5yNoOwtQyDIeV:6YPJexy36cIHyL5L8Or2r4A5yNXw7IeV

Score

1^/10

Malware Config

Signatures

Files

872673821f4c449c6ecd260ad5eb712f14822558e966c4dd3dc9de1fdb62c77f_NeikiAnalytics.exe
.dll regsvr32 windows:5 windows x64 arch:x64

ed832c5b0682efbd49b1b036acd958a4

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:bf:13:33:8d:f6:00:73:b3:c3:ec:a6:50:57:97:2b
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

19-07-2022 00:00

Not After

19-07-2023 23:59

Subject

CN=Solveig Multimedia Germany GmbH,O=Solveig Multimedia Germany GmbH,ST=Hamburg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11-05-2022 00:00

Not After

10-08-2033 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:03:14:72:4f:b1:7b:5b:e4:f9:d2:9a:19:c1:af:6f:8a:91:cc:9d
Signer

Actual PE Digest

78:03:14:72:4f:b1:7b:5b:e4:f9:d2:9a:19:c1:af:6f:8a:91:cc:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
lstrlenW
lstrlenA
GetModuleFileNameA
GetProcAddress
SizeofResource
WriteFile
FlushFileBuffers
GetModuleFileNameW
CreateFileW
FindClose
GetCurrentDirectoryW
CreateDirectoryW
GetCurrentProcessId
ReadFile
GetACP
OutputDebugStringA
SetLastError
GetModuleHandleExW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
FindActCtxSectionStringW
QueryActCtxW
GlobalAlloc
GlobalLock
GetModuleHandleW
GlobalFree
LocalFree
FormatMessageW
EncodePointer
GetSystemDirectoryW
LoadLibraryExW
GlobalDeleteAtom
GlobalAddAtomW
GlobalFindAtomW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
lstrcmpA
GetLocaleInfoW
GlobalFlags
SetEndOfFile
GetUserDefaultLCID
WaitForSingleObjectEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
LCMapStringW
GetStringTypeW
GetCPInfo
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
HeapQueryInformation
GetCommandLineA
GetCommandLineW
ExitProcess
GetConsoleMode
ReadConsoleW
GetStdHandle
GetFileType
IsValidLocale
EnumSystemLocalesW
GetConsoleCP
SetFilePointerEx
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
WriteConsoleW
GetVersionExW
CreateSemaphoreW
lstrcmpW
VirtualFree
VirtualAlloc
GetSystemInfo
GetCurrentProcess
CreateEventW
ReleaseSemaphore
LoadLibraryW
FreeLibrary
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DecodePointer
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
WideCharToMultiByte
Sleep
CloseHandle
WaitForSingleObject
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentThreadId
CreateThread
GlobalUnlock

user32

SetMenuItemInfoW
LoadBitmapW
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
ClientToScreen
RealChildWindowFromPoint
DestroyMenu
PostQuitMessage
GetMonitorInfoW
MonitorFromWindow
WinHelpW
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongPtrW
PtInRect
GetMenuCheckMarkDimensions
CopyRect
GetSysColor
GetSystemMetrics
ScreenToClient
AdjustWindowRectEx
RemovePropW
GetPropW
SetPropW
RedrawWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetMenu
GetMenu
GetCapture
GetKeyState
GetDlgCtrlID
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
PostMessageW
GetMessageTime
GetMessagePos
GetWindow
GetWindowTextW
GetScrollPos
IsWindowEnabled
EnableWindow
GetFocus
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetParent
OffsetRect
SetRectEmpty
GetClientRect
MessageBoxW
SendMessageW
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
LoadCursorW
GetSysColorBrush
ReleaseDC
GetDC
GetDesktopWindow
LoadStringW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowThreadProcessId
MapWindowPoints
GetWindowLongW
InvalidateRect
CreateDialogParamW
ShowWindow
DestroyWindow
DefWindowProcW
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
GetWindowRect
SetWindowTextW
GetDlgItem
MoveWindow
IsWindow

advapi32

RegOpenKeyW
RegCreateKeyExW
RegSetValueExW
RegSetValueW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyW
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW

ole32

StringFromGUID2
CoInitialize
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc

oleaut32

SysAllocStringLen
SysFreeString
SysAllocString
VariantChangeType
VarCmp
VariantCopy
VariantClear
VariantInit
SafeArrayCreateVector
SafeArrayDestroy
SysStringLen

oleacc

CreateStdAccessibleObject
LresultFromObject

gdi32

SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
SetMapMode
SetBkColor
SetTextColor
CreateBitmap
DeleteDC
DeleteObject
Escape
GetClipBox
ExtTextOutW
TextOutW
GetDeviceCaps
GetStockObject
PtVisible
RectVisible
RestoreDC
SaveDC
SelectObject

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 383KB - Virtual size: 383KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ed832c5b0682efbd49b1b036acd958a4

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

1f:bf:13:33:8d:f6:00:73:b3:c3:ec:a6:50:57:97:2bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43Certificate

Extended Key Usages

Key Usages

78:03:14:72:4f:b1:7b:5b:e4:f9:d2:9a:19:c1:af:6f:8a:91:cc:9dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

oleacc

gdi32

winspool.drv

Exports

Exports

Sections

.text Size: 383KB - Virtual size: 383KB

.rdata Size: 184KB - Virtual size: 184KB

.data Size: 32KB - Virtual size: 53KB

.pdata Size: 22KB - Virtual size: 21KB

.gfids Size: 2KB - Virtual size: 2KB

.giats Size: 512B - Virtual size: 4B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 111KB - Virtual size: 110KB

.reloc Size: 11KB - Virtual size: 11KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

1f:bf:13:33:8d:f6:00:73:b3:c3:ec:a6:50:57:97:2b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

78:03:14:72:4f:b1:7b:5b:e4:f9:d2:9a:19:c1:af:6f:8a:91:cc:9d
Signer

.text
Size: 383KB - Virtual size: 383KB

.rdata
Size: 184KB - Virtual size: 184KB

.data
Size: 32KB - Virtual size: 53KB

.pdata
Size: 22KB - Virtual size: 21KB

.gfids
Size: 2KB - Virtual size: 2KB

.giats
Size: 512B - Virtual size: 4B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 111KB - Virtual size: 110KB

.reloc
Size: 11KB - Virtual size: 11KB