9f1f40ec296cf7fec148c87ea51e26ac83c21b2f68b8d0071aa09f59eebdcb24_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

9f1f40ec296cf7fec148c87ea51e26ac83c21b2f68b8d0071aa09f59eebdcb24_NeikiAnalytics.exe
Size

60KB
MD5

31f0152b29254525b4ad5a86aa8df6b0
SHA1

5ab64e684f9154d2a345ce850549d3f60890fe85
SHA256

9f1f40ec296cf7fec148c87ea51e26ac83c21b2f68b8d0071aa09f59eebdcb24
SHA512

07b91ec3778505ba7a6b27bc12c0d8ea7fdc863ccc9b62fb61d21159f376ee25187ac59940f274e12cb8ef027ae02b4c5bbae00125ac21d4f4497c800d97490a
SSDEEP

1536:PRt/WI/7o9+UzsJCy4vBnjUL56VQP1oIqsunrq7P:eePofdjS56VQP17qXgP

Score

1^/10

Malware Config

Signatures

Files

9f1f40ec296cf7fec148c87ea51e26ac83c21b2f68b8d0071aa09f59eebdcb24_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

3e0e62603a6158ae7e43f4870a2fa20a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

02-08-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

11:21:ba:9a:03:41:19:2b:0a:83:73:29:26:4c:55:20:03:d5
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

13-05-2014 12:43

Not After

13-05-2017 12:43

Subject

CN=VisualSVN Ltd.,O=VisualSVN Ltd.,L=Road Town,ST=Tortola,C=VG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ac:e2:c6:c2:72:3c:a3:9d:b9:0e:25:bb:34:fe:f7:fa:f7:2c:b0:77
Signer

Actual PE Digest

ac:e2:c6:c2:72:3c:a3:9d:b9:0e:25:bb:34:fe:f7:fa:f7:2c:b0:77

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\builder\server\Externals\svn-httpd\x64\httpd\modules\mappers\Release\mod_rewrite.pdb

Imports

libapr-1

apr_strftime
apr_stat
apr_filepath_root
apr_filepath_merge
apr_file_open
apr_file_close
apr_file_read
apr_file_write
apr_file_writev
apr_file_gets
apr_time_exp_lt
apr_procattr_io_set
apr_procattr_dir_set
apr_procattr_cmdtype_set
apr_procattr_child_errfn_set
apr_procattr_error_check_set
apr_proc_create
apr_pool_note_subprocess
apr_month_snames
apr_day_snames
apr_time_exp_gmt
apr_time_now
apr_table_addn
apr_table_merge
apr_table_unset
apr_table_setn
apr_table_set
apr_table_get
apr_array_append
apr_array_push
apr_array_make
apr_proc_mutex_destroy
apr_proc_mutex_unlock
apr_thread_mutex_create
apr_proc_mutex_lock
apr_proc_mutex_child_init
apr_proc_mutex_create
apr_gid_name_get
apr_uid_homepath_get
apr_uid_name_get
apr_hash_overlay
apr_hash_this
apr_hash_next
apr_hash_first
apr_hash_get
apr_hash_set
apr_hash_make
apr_itoa
apr_snprintf
apr_strtok
apr_tokenize_to_argv
apr_psprintf
apr_pvsprintf
apr_pstrcat
apr_pstrndup
apr_pstrmemdup
apr_pstrdup
apr_pool_cleanup_null
apr_pool_cleanup_register
apr_pool_userdata_get
apr_pool_userdata_set
apr_palloc
apr_pool_clear
apr_pool_create_ex
apr_thread_mutex_unlock
apr_thread_mutex_lock
apr_procattr_create

libaprutil-1

apr_dbm_open_ex
apr_dbm_fetch
apr_dbm_get_usednames_ex
apr_dynamic_fn_register
apr_dynamic_fn_retrieve
apr_dbm_close

libhttpd

ap_log_rerror
ap_log_error
ap_core_translate
ap_get_server_port
ap_get_server_name_for_url
ap_get_server_name
ap_get_remote_logname
ap_get_remote_host
ap_document_root
ap_allow_options
ap_hook_fixups
ap_hook_translate_name
ap_internal_redirect
ap_destroy_sub_req
ap_sub_req_lookup_file
ap_sub_req_lookup_uri
ap_open_piped_log
ap_hook_child_init
ap_hook_post_config
ap_hook_pre_config
ap_check_cmd_context
ap_find_linked_module
ap_server_root_relative
ap_log_assert
ap_str_tolower
ap_pregcomp
ap_os_is_path_absolute
ap_escape_logitem
ap_os_escape_path
ap_unescape_url
ap_getword_conf
ap_get_server_banner
ap_regexec
ap_set_content_type
ap_index_of_response
ap_run_http_scheme
ap_run_default_port
ap_matches_request_vhost
ap_hook_handler
ap_make_dirstr_parent

msvcr120

getenv
rand
srand
memcpy
strcmp
__CppXcptFilter
_amsg_exit
free
_malloc_crt
_initterm
_initterm_e
atol
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCapturePreviousContext
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__clean_type_info_names_internal
atoi
strncpy
strncmp
strcspn
strchr
toupper
isalnum
isspace
__C_specific_handler
_getpid
_stricmp
_strnicmp
isdigit

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
DisableThreadLibraryCalls

Exports

Exports

rewrite_module

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e0e62603a6158ae7e43f4870a2fa20a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:37:e8Certificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

11:21:ba:9a:03:41:19:2b:0a:83:73:29:26:4c:55:20:03:d5Certificate

Extended Key Usages

Key Usages

ac:e2:c6:c2:72:3c:a3:9d:b9:0e:25:bb:34:fe:f7:fa:f7:2c:b0:77Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libapr-1

libaprutil-1

libhttpd

msvcr120

kernel32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 32KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 108B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

11:21:ba:9a:03:41:19:2b:0a:83:73:29:26:4c:55:20:03:d5
Certificate

ac:e2:c6:c2:72:3c:a3:9d:b9:0e:25:bb:34:fe:f7:fa:f7:2c:b0:77
Signer

.text
Size: 32KB - Virtual size: 32KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 108B