7a764278f9a8cd999b1a313bc8c81e3afba4ee93deed350ce06a059f9cfee757_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7a764278f9a8cd999b1a313bc8c81e3afba4ee93deed350ce06a059f9cfee757_NeikiAnalytics.exe
Size

3.0MB
MD5

a6b6cc2e7f45f68e06a126246f09ca40
SHA1

540e52b6bc0bc2693beedeeca88f5c6da210f428
SHA256

7a764278f9a8cd999b1a313bc8c81e3afba4ee93deed350ce06a059f9cfee757
SHA512

1483547913ee5c4fcdb51fb262bec331107c9b99d50f56b4857d897c49be2e475bdbdbe31315e4810030879719de475cc659c8dc813bae9f363111257dbbc9f2
SSDEEP

49152:yZ+dZejFjreZerhtlxkhl9MXzqtS758Jxfp3ray:y24Ce7lamO

Score

1^/10

Malware Config

Signatures

Files

7a764278f9a8cd999b1a313bc8c81e3afba4ee93deed350ce06a059f9cfee757_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

694406e12a958177cda48a703a8dfc4c

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:cd:77:9a:de:d4:6f:8f:ec:dc:2c:73
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

05/01/2023, 03:29

Not After

27/01/2026, 06:53

Subject

SERIALNUMBER=91440300761955047C,CN=Chipspoint Electronics Co.\, Ltd.,O=Chipspoint Electronics Co.\, Ltd.,STREET=福田区福田路深圳国际文化大厦0701、0702,L=Shenzhen,ST=Guangdong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13085348454e5a48454e,1.3.6.1.4.1.311.60.2.1.2=#13094755414e47444f4e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:45

Not After

08/05/2033, 07:45

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10/12/2014, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:19:5f:9f:0c:88:6a:2c:27:51:cc:39:90:0f:70:5a:4e:23:f5:09
Signer

Actual PE Digest

7a:19:5f:9f:0c:88:6a:2c:27:51:cc:39:90:0f:70:5a:4e:23:f5:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\jk_win7\workspace\00-BM-S-NetSDK--win32-vs2005\Bin\Release(PDB)\dhconfigsdk.pdb

Imports

ws2_32

ntohs

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
GetLocalTime
GetLastError
CloseHandle
CreateEventA
SetEvent
ResetEvent
WaitForSingleObject
TerminateThread
GetCurrentThreadId
GetTickCount
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
LoadLibraryExA
WideCharToMultiByte
MultiByteToWideChar
OutputDebugStringA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetModuleFileNameA
CopyFileA
Sleep
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
GetTimeZoneInformation
GetSystemTimeAsFileTime
ExitThread
CreateThread
GetModuleHandleA
TlsGetValue
SystemTimeToFileTime
TlsSetValue
GetFileAttributesA
SetLastError
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
ExitProcess
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
FatalAppExitA
VirtualAlloc
HeapReAlloc
WriteFile
SetConsoleCtrlHandler
LoadLibraryW
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
CreateFileA
ReadFile
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
CompareFileTime
CreateDirectoryA
TlsAlloc
TlsFree

advapi32

CryptReleaseContext
CryptAcquireContextA
CryptGenRandom

Exports

Exports

CLIENT_PacketData
CLIENT_ParseAnalyzerEventData
CLIENT_ParseData
CLIENT_ParseDataByCallback
CLIENT_ParseVideoInAnalyse

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 272KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 175KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

694406e12a958177cda48a703a8dfc4c

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

41:cd:77:9a:de:d4:6f:8f:ec:dc:2c:73Certificate

Extended Key Usages

Key Usages

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6aCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

7a:19:5f:9f:0c:88:6a:2c:27:51:cc:39:90:0f:70:5a:4e:23:f5:09Signer

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

advapi32

Exports

Exports

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 272KB - Virtual size: 271KB

.data Size: 172KB - Virtual size: 175KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 188KB - Virtual size: 187KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

41:cd:77:9a:de:d4:6f:8f:ec:dc:2c:73
Certificate

01:b2:8b:d4:cf:ee:ee:0d:be:d0:b3:0d:9b:f8:43:6a
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

7a:19:5f:9f:0c:88:6a:2c:27:51:cc:39:90:0f:70:5a:4e:23:f5:09
Signer

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 272KB - Virtual size: 271KB

.data
Size: 172KB - Virtual size: 175KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 188KB - Virtual size: 187KB