8e0b3c067a3b68051bb7008d313df900a389244d47849b5cbcc89b9eb1adcabb_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8e0b3c067a3b68051bb7008d313df900a389244d47849b5cbcc89b9eb1adcabb_NeikiAnalytics.exe
Size

166KB
MD5

5884041956edbb55adf23e4a4563af50
SHA1

6b2e25bc04738d2863f2c34df2079b5107cb7383
SHA256

8e0b3c067a3b68051bb7008d313df900a389244d47849b5cbcc89b9eb1adcabb
SHA512

9901013a336478ca3b50261c9995a0ffb5a14223988b686eec63b31d6c208de9e612e91d784be51727ff0290dd6628dd01c3848df9ae385e64185d5c25fc11f8
SSDEEP

3072:bHLugVHw7+5p7bwhBwJeYJWtyqE+5sGzYGV:bHLJHwq/7b8BiehE+1zYI

Score

1^/10

Malware Config

Signatures

Files

8e0b3c067a3b68051bb7008d313df900a389244d47849b5cbcc89b9eb1adcabb_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

1e4657ead504e3f44e9f1a511d912d3c

Code Sign

77:77:de:77:d5:ca:c3:da:be:3b:af:76:07:c9:aa:f7
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/01/2012, 00:00

Not After

17/01/2014, 23:59

Subject

CN=Ongame Network Ltd,OU=Secure Application Development,O=Ongame Network Ltd,L=Gibraltar,ST=Gibraltar,C=GI

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ee:a2:bf:87:32:b1:ef:19:12:bc:f8:d4:aa:ca:1e:ce:d6:41:c1:8c
Signer

Actual PE Digest

ee:a2:bf:87:32:b1:ef:19:12:bc:f8:d4:aa:ca:1e:ce:d6:41:c1:8c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

UpdateWindow
ShowWindow
SetForegroundWindow
CreateWindowExW
SetWindowLongW
PeekMessageW
IsWindow
GetWindowLongW
IsWindowUnicode
SendMessageW
GetCursorPos
PostMessageW
LoadStringW
LoadAcceleratorsW
GetMessageW
TranslateMessage
DispatchMessageW
TranslateAcceleratorW
SetWindowTextW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
LoadIconW
LoadCursorW
RegisterClassExW
PostQuitMessage
DefWindowProcW
DestroyWindow
SetWindowPos
GetDesktopWindow
GetClientRect
GetSystemMetrics

ole32

CoCreateInstance
CoTaskMemAlloc
OleInitialize
OleUninitialize

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

kernel32

HeapFree
FlushFileBuffers
CloseHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
LoadLibraryA
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameW
GetModuleFileNameA
GetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
HeapSize
HeapReAlloc
OutputDebugStringW
InterlockedIncrement
GlobalFree
InterlockedDecrement
GlobalAlloc
WideCharToMultiByte
lstrcmpW
MultiByteToWideChar
Sleep
GetTickCount
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetLastError
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc

Sections

.text
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e4657ead504e3f44e9f1a511d912d3c

Code Sign

77:77:de:77:d5:ca:c3:da:be:3b:af:76:07:c9:aa:f7Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

ee:a2:bf:87:32:b1:ef:19:12:bc:f8:d4:aa:ca:1e:ce:d6:41:c1:8cSigner

Headers

File Characteristics

Imports

user32

ole32

oleaut32

kernel32

Sections

.text Size: 108KB - Virtual size: 106KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 8KB - Virtual size: 14KB

.rsrc Size: 20KB - Virtual size: 19KB

77:77:de:77:d5:ca:c3:da:be:3b:af:76:07:c9:aa:f7
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

ee:a2:bf:87:32:b1:ef:19:12:bc:f8:d4:aa:ca:1e:ce:d6:41:c1:8c
Signer

.text
Size: 108KB - Virtual size: 106KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 8KB - Virtual size: 14KB

.rsrc
Size: 20KB - Virtual size: 19KB