90e2a966793ab4852f83d24cbadbf97af386765888024c2bdedb8eff2d4bd591_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

90e2a966793ab4852f83d24cbadbf97af386765888024c2bdedb8eff2d4bd591_NeikiAnalytics.exe
Size

802KB
MD5

5f97b73434d0c1f69bf71d9a2bdfc640
SHA1

4df4f8147b170f1c191bb9839c2d9b4fdeed242d
SHA256

90e2a966793ab4852f83d24cbadbf97af386765888024c2bdedb8eff2d4bd591
SHA512

5a470c96c25691e778087ab383ed2a15309b7340495fa5144baccaa149cbe2988ee122151158353e38f0b13fdd518d2f455df3948bd2a97d9c0ae63551d7c84c
SSDEEP

24576:TDs6xpxYy3/3A0ARiKfryrFYWlYZexuM9rEH7Z:lpj3/3AJryMZexu7

Score

1^/10

Malware Config

Signatures

Files

90e2a966793ab4852f83d24cbadbf97af386765888024c2bdedb8eff2d4bd591_NeikiAnalytics.exe
.dll windows:5 windows x86 arch:x86

1ccb58c346cfdbea2a72089746034496

Code Sign

44:82:06:ac:63:f0:b2:b4:be:d6:75:fa:ce:06:89:47
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08/10/2018, 00:00

Not After

28/12/2021, 23:59

Subject

CN=Famatech Corp.,O=Famatech Corp.,L=Road Town,ST=Tortola,C=VG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e5:3b:48:2a:41:68:5a:96:d6:1b:c4:ce:0d:05:32:15:c5:19:ed:54:62:22:c1:dd:52:57:13:c5:47:db:fe:d9
Signer

Actual PE Digest

e5:3b:48:2a:41:68:5a:96:d6:1b:c4:ce:0d:05:32:15:c5:19:ed:54:62:22:c1:dd:52:57:13:c5:47:db:fe:d9

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

Z:\MyUtil\Release\Shelper.pdb

Imports

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
GetVersion
GetCurrentThreadId
GetFileType
GetStdHandle
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
GetVersionExA
FlushConsoleInputBuffer
GetFullPathNameW
WriteConsoleW
HeapSize
SetEnvironmentVariableA
LCMapStringW
GetStringTypeW
OutputDebugStringW
RaiseException
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
SetFilePointerEx
SetStdHandle
FlushFileBuffers
GetConsoleCP
ReadConsoleW
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetCPInfo
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
DeleteFileW
CreateFileW
GetDriveTypeW
GetModuleHandleA
GetModuleFileNameW
LoadLibraryA
CloseHandle
FindClose
SetEndOfFile
ReadFile
WriteFile
GetFileSize
SetLastError
GetLastError
GetProcAddress
FreeLibrary
InterlockedCompareExchange
InterlockedExchange
GetCurrentDirectoryW
HeapFree
RtlUnwind
HeapAlloc
HeapReAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
ExitProcess
GetModuleHandleExW
AreFileApisANSI
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetTimeZoneInformation
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
FileTimeToSystemTime
CreateThread
ExitThread
ResumeThread
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP

user32

MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW

advapi32

CryptSignHashA
DeregisterEventSource
ReportEventA
RegisterEventSourceA
CryptEnumProvidersA
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextA

crypt32

CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertDuplicateCertificateContext
CertFreeCertificateContext

Exports

Exports

SHelper_AllocBuffer
SHelper_CChannel_CreateClient
SHelper_CChannel_CreateServer
SHelper_CChannel_DecryptBuffer
SHelper_CChannel_Delete
SHelper_CChannel_EncryptBuffer
SHelper_CChannel_SetKeyDec
SHelper_CChannel_SetKeyEnc
SHelper_CheckAPIVersion
SHelper_CheckExeFileSignature
SHelper_CheckNetworkProtocolVersion
SHelper_CreateClient
SHelper_CreateInvalidBuffer
SHelper_CreateServer
SHelper_Delete
SHelper_FreeBuffer
SHelper_GenerateUserParams
SHelper_GetKey
SHelper_GetMaxPacketSize
SHelper_GetName
SHelper_GetNetworkProtocolVersion
SHelper_GetNextBuffer
SHelper_Init
SHelper_RSAHelper_CreateWithPrivateKey
SHelper_RSAHelper_CreateWithPublicKey
SHelper_RSAHelper_DecryptBuffer_Private
SHelper_RSAHelper_DecryptBuffer_Public
SHelper_RSAHelper_Delete
SHelper_RSAHelper_EncryptBuffer_Private
SHelper_RSAHelper_EncryptBuffer_Public
SHelper_RSession_CreateClient
SHelper_RSession_CreateServer
SHelper_RSession_Delete
SHelper_RSession_GetClientDataOnServer
SHelper_RSession_GetKey
SHelper_RSession_GetNextBuffer
SHelper_RSession_GetServerDataOnClient
SHelper_SetUserParams

Sections

.text
Size: 516KB - Virtual size: 516KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1ccb58c346cfdbea2a72089746034496

Code Sign

44:82:06:ac:63:f0:b2:b4:be:d6:75:fa:ce:06:89:47Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

e5:3b:48:2a:41:68:5a:96:d6:1b:c4:ce:0d:05:32:15:c5:19:ed:54:62:22:c1:dd:52:57:13:c5:47:db:fe:d9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

crypt32

Exports

Exports

Sections

.text Size: 516KB - Virtual size: 516KB

.rdata Size: 164KB - Virtual size: 163KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 24KB

44:82:06:ac:63:f0:b2:b4:be:d6:75:fa:ce:06:89:47
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

e5:3b:48:2a:41:68:5a:96:d6:1b:c4:ce:0d:05:32:15:c5:19:ed:54:62:22:c1:dd:52:57:13:c5:47:db:fe:d9
Signer

.text
Size: 516KB - Virtual size: 516KB

.rdata
Size: 164KB - Virtual size: 163KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 24KB