486e30f154b2cef0f740b1f6cdbb0edd93498f0c5187123140e3eab5f63a1adc_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

486e30f154b2cef0f740b1f6cdbb0edd93498f0c5187123140e3eab5f63a1adc_NeikiAnalytics.exe
Size

1.1MB
MD5

2269e7666bb5adcaa09803f9fdc91380
SHA1

aaed0f938d383293ead933559d69afa28adbc454
SHA256

486e30f154b2cef0f740b1f6cdbb0edd93498f0c5187123140e3eab5f63a1adc
SHA512

4bb0521f3e92c02d689cc362fe38d3c3b43d46930d0c514cc5fb380007a368037e7247dcf4f0b8963985e09b4a90c49841fd20e794939c17d1b5d38607a65453
SSDEEP

24576:RnR1ougwQFJCJECt9yRhYycwVCBFE6Kenrc3l9IH0rEH7w:z3loJCWCLyRNcLEPenrc3l9Ik

Score

1^/10

Malware Config

Signatures

Files

486e30f154b2cef0f740b1f6cdbb0edd93498f0c5187123140e3eab5f63a1adc_NeikiAnalytics.exe
.dll windows:6 windows x86 arch:x86

Code Sign

33:00:00:05:57:cf:90:dd:c7:d1:c0:88:8c:00:00:00:00:05:57
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:51

Not After

16/10/2024, 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:51

Not After

16/10/2024, 19:51

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

93:4a:b9:89:81:98:e9:b7:6a:26:4f:15:60:d9:ce:1e:dd:81:b9:19:7e:cc:44:26:90:71:4e:f1:7f:64:6f:96
Signer

Actual PE Digest

93:4a:b9:89:81:98:e9:b7:6a:26:4f:15:60:d9:ce:1e:dd:81:b9:19:7e:cc:44:26:90:71:4e:f1:7f:64:6f:96

Digest Algorithm

sha256

PE Digest Matches

false

93:4a:b9:89:81:98:e9:b7:6a:26:4f:15:60:d9:ce:1e:dd:81:b9:19:7e:cc:44:26:90:71:4e:f1:7f:64:6f:96
Signer

Actual PE Digest

93:4a:b9:89:81:98:e9:b7:6a:26:4f:15:60:d9:ce:1e:dd:81:b9:19:7e:cc:44:26:90:71:4e:f1:7f:64:6f:96

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\dbs\el\omr\build\x86\ship\appvisv\subsystems\composite\dll_isv\obj\i386\AppVISVSubsystems32.pdb

Exports

Exports

APIExportForDetours
CurrentThreadIsVirtualized
RequestUnhookedFunctionList
VirtualizeCurrentProcess
VirtualizeCurrentThread
_IsProcessHooked@0

Sections

.text
Size: 589KB - Virtual size: 588KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mrdata
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.c2r
Size: 512B - Virtual size: 406B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

33:00:00:05:57:cf:90:dd:c7:d1:c0:88:8c:00:00:00:00:05:57Certificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

93:4a:b9:89:81:98:e9:b7:6a:26:4f:15:60:d9:ce:1e:dd:81:b9:19:7e:cc:44:26:90:71:4e:f1:7f:64:6f:96Signer

93:4a:b9:89:81:98:e9:b7:6a:26:4f:15:60:d9:ce:1e:dd:81:b9:19:7e:cc:44:26:90:71:4e:f1:7f:64:6f:96Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Exports

Exports

Sections

.text Size: 589KB - Virtual size: 588KB

.rdata Size: 289KB - Virtual size: 289KB

.data Size: 47KB - Virtual size: 53KB

.mrdata Size: 512B - Virtual size: 16B

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.c2r Size: 512B - Virtual size: 406B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 60KB - Virtual size: 60KB

33:00:00:05:57:cf:90:dd:c7:d1:c0:88:8c:00:00:00:00:05:57
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

93:4a:b9:89:81:98:e9:b7:6a:26:4f:15:60:d9:ce:1e:dd:81:b9:19:7e:cc:44:26:90:71:4e:f1:7f:64:6f:96
Signer

93:4a:b9:89:81:98:e9:b7:6a:26:4f:15:60:d9:ce:1e:dd:81:b9:19:7e:cc:44:26:90:71:4e:f1:7f:64:6f:96
Signer

.text
Size: 589KB - Virtual size: 588KB

.rdata
Size: 289KB - Virtual size: 289KB

.data
Size: 47KB - Virtual size: 53KB

.mrdata
Size: 512B - Virtual size: 16B

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.c2r
Size: 512B - Virtual size: 406B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 60KB - Virtual size: 60KB