b89899ea317a83dd89f22eda0958b378dae71f1c90a7e25b50e533334f64d559_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b89899ea317a83dd89f22eda0958b378dae71f1c90a7e25b50e533334f64d559_NeikiAnalytics.exe
Size

119KB
MD5

34b0a1ab49602a12c02d3d475d33bfa0
SHA1

0f981c0ab0a63f1b9cfbc23ef1ee2d6ac2fb1904
SHA256

b89899ea317a83dd89f22eda0958b378dae71f1c90a7e25b50e533334f64d559
SHA512

0a979d98d29417e7a7a9e42e03fa3ef9b7421abaf9feee1fefb8928fe2bdaa323c930c9964ea906d3de708aeb60e0007757cf6413aca3dbbff9d0ac6cf125f8f
SSDEEP

1536:nqE2t1FFuw6ALX633d80HuuTbdDB7TIrNtG0rt5QwZn+Q/Jg:92t1FFu5ALX633dtHuMbPcGaQwZn+t

Score

1^/10

Malware Config

Signatures

Files

b89899ea317a83dd89f22eda0958b378dae71f1c90a7e25b50e533334f64d559_NeikiAnalytics.exe
.dll windows:4 windows x86 arch:x86

3dce0597064cbb6f0f5b0e3be97139ac

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:2b:10:1e:96:19:27:f5:35:40:bd:ea:d6:ae:c6:de
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

03/05/2006, 00:00

Not After

02/05/2009, 23:59

Subject

CN=Bentley Systems\, Incorporated,OU=Digital ID Class 3 - Microsoft VBA Software Validation v2+OU=PLATFORM PRG,O=Bentley Systems\, Incorporated,L=Exton,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

11:dc:43:09:5d:b8:52:8b:3a:93:25:df:9a:77:52:19:cd:a2:18:b5
Signer

Actual PE Digest

11:dc:43:09:5d:b8:52:8b:3a:93:25:df:9a:77:52:19:cd:a2:18:b5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\Builds\ms08090451\orln\symbols\dll\rgelib.pdb

Imports

toolsubs

memutil_free
toolSubsystem_printf

ustation

mdlVec_normalize
mdlVec_magnitude
mdlVec_addPoint
mdlElmdscr_display
mdlElmdscr_createFromVertices
mdlElmdscr_appendElement
mdlLineString_create2
mdlLine_create2
mdlArc_create
mdlRMatrix_fromColumnVectors
mdlComplexChain_createHeader
mdlElmdscr_directTransform
mdlElmdscr_add
mdlElmdscr_initOrAddToChain
fc_2piP
mdlElmdscr_convertTo2D
mdlArc_create2
mdlDisplayPath_insertAtHead
mdlDisplayPath_new
mdlDisplayPath_release
mdlDisplayPath_addRef
mdlDisplayPath_isSamePath
mdlDisplayPath_setCursorElemIndex
mdlDisplayPath_getElem
mdlComplexChain_directCreateHeader
mdlElmdscr_createShapeWithHoles
mdlElmdscr_validate
mdlElement_extractRange
mdlElement_setSymbology2
mdlCnv_compileDataDefFromFileWithAllocType
mdlSystem_setCurrMdlDesc
mdlSystem_getUstnMdlDesc
mdlElmdscr_replaceDscr
mdlElmdscr_duplicateSingle
mdlElement_setProperties
mdlElmdscr_setVisible
mdlElement_displayAttributePresent
mdlElmdscr_setFromTemplate
mdlElmdscr_stripTags
mdlElmdscr_regionIntersection
mdlElmdscr_regionDifference
mdlElmdscr_regionUnion
mdlVec_distance
mdlMline_firstPoint
mdlLinkage_setElementIds
mdlModelRef_areSame
mdlElmdscr_transform
mdlElmdscr_matchDimToModelRef
mdlMlineStyle_setScaleOffset
mdlMlineStyle_getScaleOffset
mdlElmdscr_getByElemRef
mdlModelRef_findFromCache
mdlModelRef_getCache
mdlDependency_getRoots
mdlElmdscr_areIdentical
?DoRedraw@RedrawElems@Ustn@Bentley@@QAEXPBUmsElementDescr@@@Z
mdlArc_extract
??0RedrawElems@Ustn@Bentley@@QAE@XZ
mdlMline_getBoundaryDescr
mdlLineString_create
mdlLinkage_extractFromElement
mdlLinkage_appendToElement
mdlLinkage_deleteFromElement
mdlDependency_appendLinkageUsingDescr
mdlDependency_deleteLinkage
mdlDependency_initLinkage
mdlTag_getTextElement
mdlCurrTrans_end
mdlElmdscr_createFromVertices2
mdlRMatrix_rotatePointArray
mdlRMatrix_multiplyTransposePointArray
mdlTextNode_extractWide
mdlText_extractWide
mdlTextNode_extractShape
mdlText_extractShape
mdlCurrTrans_identity
mdlCurrTrans_begin
mdlCell_setRange
mdlRMatrix_toPacked2x2
mdlRMatrix_getIdentity
mdlTMatrix_isIdentity
mdlElmdscr_extractCellTMatrix
mdlTMatrix_computeFlattenTransform
mdlTMatrix_getIdentity
mdlCell_create2
mdlElmdscr_templateFromEdP
mdlTMatrix_transformPointArray
mdlElmdscr_duplicate
mdlElmdscr_isAssociativeRegion
mdlElmdscr_rewriteByModelRef
mdlElmdscr_findTagInDescriptor
mdlElmdscr_read
mdlCnv_bufferToFileFormat
mdlPattern_clearRawDwgLoopsModifier
dlmSystem_mdlFree
mdlLinkage_extractNamedDoubleArrayLinkageByIndex
mdlVec_pointEqualTol
mdlPattern_extractAssociative
mdlTMatrix_getTranslation
mdlCell_getFlattenMatrix
mdlDependency_setRoots
mdlAssoc_getElementDescr
mdlElmdscr_isGroupedHole
mdlElement_getSymbology
mdlLine_directCreate
mdlElmdscr_setSymbology
mdlElement_add
mdlLine_create
mdlElmdscr_transformAllowModification
mdlTMatrix_multiply
mdlCurrTrans_getAddresses
mdlView_getHomogeneousMaps
mdlView_isValidIndex
dlmSystem_mdlCalloc
mdlRMatrix_getColumnVector
fc_piP
mdlLinear_extract
mdlElmdscr_duplicateFromPool
mdlElement_display
mdlSystem_extendedAbortEnable
mdlElmdscr_displayedInView
mdlSystem_extendedAbortRequested
mdlSelect_returnPositions
mdlElmdscr_readToMaster
mdlElmdscr_isClosed
mdlCnv_convertUnicodeToMultibyte
mdlCell_extract
mdlModelRef_is3D
mdlModelRef_getActive
mdlElmdscr_fromCompoundElement
mdlSelect_isActive
?SetViews@RedrawElems@Ustn@Bentley@@QAEXH@Z

kernel32

RaiseException
LoadLibraryA
GetLastError
FreeLibrary
LocalFree
LocalAlloc
GetModuleHandleA
GetProcAddress
DisableThreadLibraryCalls
InterlockedExchange

msvcr71

_onexit
_except_handler3
__CppXcptFilter
_adjust_fdiv
_initterm
__CxxFrameHandler
malloc
free
__dllonexit

Exports

Exports

bspsurf_clipTrimLoops
dlmPassword
mdlAssocRegion_addAssocRegionLinkage
mdlAssocRegion_addDependencyLinkage
mdlAssocRegion_addSeedPointLinkage
mdlAssocRegion_appendLoopOEDCodeLinkage
mdlAssocRegion_createUsingShapes
mdlAssocRegion_extractLoopOEDCode
mdlAssocRegion_extractSeedPoints
mdlAssocRegion_freeResources
mdlAssocRegion_getParams
mdlAssocRegion_getRegionByInwardParity
mdlAssocRegion_initialize
mdlAssocRegion_is3D
mdlAssocRegion_isCoplanar
mdlAssocRegion_postProcessText
mdlAssocRegion_processRegionWithText
mdlAssocRegion_setParams
mdlAssocRegion_validateFunc
mdlRegion_classifyPath
mdlRegion_difference
mdlRegion_exclusiveOr
mdlRegion_floodFillWithHoles
mdlRegion_intersection
mdlRegion_union
rge_buildDependencyAndLoopLists
rge_collector_accept
rge_collector_reject
rge_collector_select
rge_collector_selectUnderPolyline
rge_combineShapes
rge_constructDisplayPathForEdP
rge_displayAllEdges
rge_displaySmallestContainingFace
rge_displayVertexNeighborhood
rge_flyOver_dynamics
rge_flyOver_polylineDynamics
rge_init
rge_restart
rge_startFlyOver
rgelmdscr_addElmDscr
rgelmdscr_addFacesAtPoints
rgelmdscr_displayEdgeRanges
rgelmdscr_displaySmallestContainingFace
rgelmdscr_displaySmallestContainingFaceForcePlanar
rgelmdscr_drawActiveFaces
rgelmdscr_duplicateEdP
rgelmdscr_freeContext
rgelmdscr_getActiveFaceElmDscr
rgelmdscr_getCurveUserInt
rgelmdscr_getFaceEdP
rgelmdscr_mergeContext
rgelmdscr_mergeContextWithGapTolerance
rgelmdscr_newContext
rgelmdscr_nodeToParentCurveId
rgelmdscr_setAbortFunction
rgelmdscr_setCurveUserInt
rgelmdscr_setDistanceTolerance
rgelmdscr_toggleFaceAtPoint
rgelmdscr_toggleFacesAtPoints

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3dce0597064cbb6f0f5b0e3be97139ac

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

46:2b:10:1e:96:19:27:f5:35:40:bd:ea:d6:ae:c6:deCertificate

Extended Key Usages

Key Usages

11:dc:43:09:5d:b8:52:8b:3a:93:25:df:9a:77:52:19:cd:a2:18:b5Signer

Headers

File Characteristics

PDB Paths

Imports

toolsubs

ustation

kernel32

msvcr71

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 44KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 50KB - Virtual size: 49KB

.reloc Size: 2KB - Virtual size: 2KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

46:2b:10:1e:96:19:27:f5:35:40:bd:ea:d6:ae:c6:de
Certificate

11:dc:43:09:5d:b8:52:8b:3a:93:25:df:9a:77:52:19:cd:a2:18:b5
Signer

.text
Size: 44KB - Virtual size: 44KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 50KB - Virtual size: 49KB

.reloc
Size: 2KB - Virtual size: 2KB