a3f3ae393dadc27b4ffbd3d510e8a479f1a5fbf81c6505f9146e209b4129be32_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

a3f3ae393dadc27b4ffbd3d510e8a479f1a5fbf81c6505f9146e209b4129be32_NeikiAnalytics.exe
Size

1.2MB
MD5

4b4f16d8e1e3e74683296a8cee31b9a0
SHA1

df914fce7b4ffae93d27820fa8edc7d45328eff2
SHA256

a3f3ae393dadc27b4ffbd3d510e8a479f1a5fbf81c6505f9146e209b4129be32
SHA512

c20036d04625b1661eb3fcbc4fe0a949764529ff8f11a6c3c967b67431f9983bae855211ee08a5cdb1ae04208519b653510b4b4cc21fed72960535cb7992dd69
SSDEEP

12288:SWZem3xHEqYFk1HSGC3G8fe2nKVHFWs7V:Siem9EXi

Score

1^/10

Malware Config

Signatures

Files

a3f3ae393dadc27b4ffbd3d510e8a479f1a5fbf81c6505f9146e209b4129be32_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

2ae408da1b9813680c82173c9fbbe953

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13-01-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28-07-2021 00:00

Not After

27-07-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22-02-2024 00:00

Not After

17-07-2024 23:59

Subject

SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13-01-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28-07-2021 00:00

Not After

27-07-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

22-02-2024 00:00

Not After

17-07-2024 23:59

Subject

SERIALNUMBER=4969967,CN=Zoom Video Communications\, Inc.,O=Zoom Video Communications\, Inc.,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:59:73:44:6b:7e:e0:e0:f9:c9:65:02:f4:6a:ff:74:89:24:5e:4b
Signer

Actual PE Digest

4e:59:73:44:6b:7e:e0:e0:f9:c9:65:02:f4:6a:ff:74:89:24:5e:4b

Digest Algorithm

sha1

PE Digest Matches

true

29:3e:1c:e6:da:8e:f8:3b:01:c0:48:93:cc:70:50:5b:74:6a:6e:14:6d:f9:10:17:0f:1c:2d:bd:bb:f6:1a:d2
Signer

Actual PE Digest

29:3e:1c:e6:da:8e:f8:3b:01:c0:48:93:cc:70:50:5b:74:6a:6e:14:6d:f9:10:17:0f:1c:2d:bd:bb:f6:1a:d2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\jenkins\workspace\Client\Client\DMT\windows\release\libjpeg-turbo\build_x86_64\RelWithDebInfo\turbojpeg.pdb

Imports

vcruntime140

__current_exception
__std_type_info_destroy_list
__C_specific_handler
__intrinsic_setjmp
longjmp
strrchr
memset
__current_exception_context
memcpy

api-ms-win-crt-heap-l1-1-0

free
malloc

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fclose
fopen_s
feof
ferror
__stdio_common_vsscanf
getc
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
ungetc
putc
fread
fwrite
fflush

api-ms-win-crt-runtime-l1-1-0

_initterm
_seh_filter_dll
_configure_narrow_argv
strerror_s
_initialize_onexit_table
exit
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
terminate
_errno
_register_onexit_function
_initialize_narrow_environment
_initterm_e

api-ms-win-crt-environment-l1-1-0

getenv_s
_putenv_s

api-ms-win-crt-string-l1-1-0

isdigit
strcmp
_stricmp

kernel32

DisableThreadLibraryCalls
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId

Exports

Exports

TJBUFSIZE
TJBUFSIZEYUV
tj3Alloc
tj3Compress12
tj3Compress16
tj3Compress8
tj3CompressFromYUV8
tj3CompressFromYUVPlanes8
tj3DecodeYUV8
tj3DecodeYUVPlanes8
tj3Decompress12
tj3Decompress16
tj3Decompress8
tj3DecompressHeader
tj3DecompressToYUV8
tj3DecompressToYUVPlanes8
tj3Destroy
tj3EncodeYUV8
tj3EncodeYUVPlanes8
tj3Free
tj3Get
tj3GetErrorCode
tj3GetErrorStr
tj3GetScalingFactors
tj3Init
tj3JPEGBufSize
tj3LoadImage12
tj3LoadImage16
tj3LoadImage8
tj3SaveImage12
tj3SaveImage16
tj3SaveImage8
tj3Set
tj3SetCroppingRegion
tj3SetScalingFactor
tj3Transform
tj3YUVBufSize
tj3YUVPlaneHeight
tj3YUVPlaneSize
tj3YUVPlaneWidth
tjAlloc
tjBufSize
tjBufSizeYUV
tjBufSizeYUV2
tjCompress
tjCompress2
tjCompressFromYUV
tjCompressFromYUVPlanes
tjDecodeYUV
tjDecodeYUVPlanes
tjDecompress
tjDecompress2
tjDecompressHeader
tjDecompressHeader2
tjDecompressHeader3
tjDecompressToYUV
tjDecompressToYUV2
tjDecompressToYUVPlanes
tjDestroy
tjEncodeYUV
tjEncodeYUV2
tjEncodeYUV3
tjEncodeYUVPlanes
tjFree
tjGetErrorCode
tjGetErrorStr
tjGetErrorStr2
tjGetScalingFactors
tjInitCompress
tjInitDecompress
tjInitTransform
tjLoadImage
tjPlaneHeight
tjPlaneSizeYUV
tjPlaneWidth
tjSaveImage
tjTransform

Sections

.text
Size: 798KB - Virtual size: 798KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 346KB - Virtual size: 345KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gljmp
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 337B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ae408da1b9813680c82173c9fbbe953

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8fCertificate

Extended Key Usages

Key Usages

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8fCertificate

Extended Key Usages

Key Usages

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

4e:59:73:44:6b:7e:e0:e0:f9:c9:65:02:f4:6a:ff:74:89:24:5e:4bSigner

29:3e:1c:e6:da:8e:f8:3b:01:c0:48:93:cc:70:50:5b:74:6a:6e:14:6d:f9:10:17:0f:1c:2d:bd:bb:f6:1a:d2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 798KB - Virtual size: 798KB

.rdata Size: 346KB - Virtual size: 345KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 22KB - Virtual size: 21KB

.idata Size: 4KB - Virtual size: 4KB

.gfids Size: 5KB - Virtual size: 4KB

.gljmp Size: 512B - Virtual size: 472B

.tls Size: 1KB - Virtual size: 1KB

.00cfg Size: 512B - Virtual size: 337B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

0e:4d:67:f6:43:16:c9:2a:3b:7a:17:cc:46:97:6a:8f
Certificate

0c:91:39:39:16:23:33:2d:43:e3:98:d1:0d:0a:da:f9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

4e:59:73:44:6b:7e:e0:e0:f9:c9:65:02:f4:6a:ff:74:89:24:5e:4b
Signer

29:3e:1c:e6:da:8e:f8:3b:01:c0:48:93:cc:70:50:5b:74:6a:6e:14:6d:f9:10:17:0f:1c:2d:bd:bb:f6:1a:d2
Signer

.text
Size: 798KB - Virtual size: 798KB

.rdata
Size: 346KB - Virtual size: 345KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 22KB - Virtual size: 21KB

.idata
Size: 4KB - Virtual size: 4KB

.gfids
Size: 5KB - Virtual size: 4KB

.gljmp
Size: 512B - Virtual size: 472B

.tls
Size: 1KB - Virtual size: 1KB

.00cfg
Size: 512B - Virtual size: 337B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB