b985eb54b678a6a7688301d58e80dacbd626a23c104edec07c805a183d884a7e_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
b985eb54b678a6a7688301d58e80dacbd626a23c104edec07c805a183d884a7e_NeikiAnalytics.exe
Size 1.5MB
Sample240629-yk6m8svbmd
SHA256 b985eb54b678a6a7688301d58e80dacbd626a23c104edec07c805a183d884a7e
MD5 0d63417570a9af0ad2875460adb77a50
SHA1 e2ffe3be6ed25272c93c07c0e15d53fdd51ce986
SHA512 575617bfde8fffe140516c8be24a889256545ca67b477d779e4d9440804d5117be70cfe82501eedf93a7b5872548ce5f63b4011cf5befa44dd8c1c19d727c39d
SSDEEP 24576:F6pyry8IXmY/dyd/2bgfFOROmGxk+arjvgz4HF/W3hLPpZO4xRuaKg7rDmZw7ZO4:F6pU7IbZbg9OROmGxk+arjvgz4l/W3dF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

b985eb54b678a6a7688301d58e80dacbd626a23c104edec07c805a183d884a7e_NeikiAnalytics.exe

.dll 1.5MB

b985eb54b678a6a7688301d58e80dacbd626a23c104edec07c805a183d884a7e_NeikiAnalytics.exe

IMPHASH 8b65b647278c90a91a98d2cac8dfa8b1
SHA256 b985eb54b678a6a7688301d58e80dacbd626a23c104edec07c805a183d884a7e
MD5 0d63417570a9af0ad2875460adb77a50
SHA1 e2ffe3be6ed25272c93c07c0e15d53fdd51ce986
SHA512 575617bfde8fffe140516c8be24a889256545ca67b477d779e4d9440804d5117be70cfe82501eedf93a7b5872548ce5f63b4011cf5befa44dd8c1c19d727c39d
SSDEEP 24576:F6pyry8IXmY/dyd/2bgfFOROmGxk+arjvgz4HF/W3hLPpZO4xRuaKg7rDmZw7ZO4:F6pU7IbZbg9OROmGxk+arjvgz4l/W3dF
MD5 SHA1 SHA512 SSDEEP

Digest

bb:41:e4:ac:2b:3d:20:d3:19:ed:4c:09:aa:3e:ed:38:bc:06:18:fc:3a:d3:4f:c5:89:51:62:b4:2e:ba:10:c6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Pranas NET Corp,O=Pranas NET Corp,POSTALCODE=11375,STREET=Ste 5F+STREET=6535 Yellowstone Blvd,L=Forest Hills,ST=New York,C=US

Chains

Feb 20, 2018

CN=Pranas NET Corp,O=Pranas NET Corp,POSTALCODE=11375,STREET=Ste 5F+STREET=6535 Yellowstone Blvd,L=Forest Hills,ST=New York,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

PE Signature issue

Digest

6f:d6:63:ec:a1:44:80:9d:ce:c7:e5:d8:38:d1:91:81:2a:a9:99:3e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pranas NET Corp,O=Pranas NET Corp,POSTALCODE=11375,STREET=Ste 5F+STREET=6535 Yellowstone Blvd,L=Forest Hills,ST=New York,C=US,2.5.4.18=#13053131333735

Chains

Feb 20, 2018

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Pranas NET Corp,O=Pranas NET Corp,POSTALCODE=11375,STREET=Ste 5F+STREET=6535 Yellowstone Blvd,L=Forest Hills,ST=New York,C=US,2.5.4.18=#13053131333735

Serial Number

60:ec:fc:b6:50:77:3f:f3:8c:b9:5a:84:23:d9:7c:25

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 10, 2014 - Jun 10, 2019

Subject

CN=Pranas NET Corp,O=Pranas NET Corp,POSTALCODE=11375,STREET=Ste 5F+STREET=6535 Yellowstone Blvd,L=Forest Hills,ST=New York,C=US

Serial Number

9d:a7:75:11:a4:ec:88:d7:65:d6:16:6b:7a:6d:29:5c

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 20, 2016 - Apr 20, 2019

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

Major OS version

Entry point

6044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\dev\sqlite\dotnet\bin\2015\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

kernel32

LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx OutputDebugStringA DeleteFileW HeapReAlloc CloseHandle GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress CreateFileMappingA LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetDiskFreeSpaceW WriteFile GetFullPathNameW AreFileApisANSI EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile DeleteFileA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA CompareStringW LCMapStringW GetACP GetTimeZoneInformation FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetStdHandle GetFileType GetStringTypeW SetStdHandle RaiseException GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW

advapi32

CryptCreateHash CryptDestroyKey CryptAcquireContextW CryptEncrypt CryptDuplicateKey CryptDecrypt CryptDeriveKey CryptHashData CryptDestroyHash

interop_compileoption_get interop_compileoption_used interop_libversion interop_sourceid sqlite3_activate_see sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_finish_interop sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_blob64 sqlite3_bind_double sqlite3_bind_double_interop sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_int64_interop sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_parameter_name_interop sqlite3_bind_pointer sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_text64 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_bind_zeroblob64 sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_close_interop sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_cancel_auto_extension sqlite3_changes sqlite3_changes_interop sqlite3_clear_bindings sqlite3_close sqlite3_close_interop sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_database_name16_interop sqlite3_column_database_name_interop sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_decltype16_interop sqlite3_column_decltype_interop sqlite3_column_double sqlite3_column_double_interop sqlite3_column_int sqlite3_column_int64 sqlite3_column_int64_interop sqlite3_column_name sqlite3_column_name16 sqlite3_column_name16_interop sqlite3_column_name_interop sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_origin_name16_interop sqlite3_column_origin_name_interop sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_table_name16_interop sqlite3_column_table_name_interop sqlite3_column_text sqlite3_column_text16 sqlite3_column_text16_interop sqlite3_column_text_interop sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_collcompare_interop sqlite3_context_collseq_interop sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_disposable_module sqlite3_create_disposable_module_interop sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_interop sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_cursor_rowid_interop sqlite3_data_count sqlite3_data_directory sqlite3_db_cacheflush sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_dispose_module sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errmsg_interop sqlite3_errstr sqlite3_exec sqlite3_expanded_sql sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_finalize_interop sqlite3_free sqlite3_free_table sqlite3_fts5_init sqlite3_fts_init sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_index_column_info_interop sqlite3_initialize sqlite3_interrupt sqlite3_json_init sqlite3_key sqlite3_key_v2 sqlite3_last_insert_rowid sqlite3_last_insert_rowid_interop sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_malloc64 sqlite3_malloc_size_interop sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_highwater_interop sqlite3_memory_used sqlite3_memory_used_interop sqlite3_mprintf sqlite3_msize sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open16_interop sqlite3_open_interop sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_percentile_init sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_interop sqlite3_prepare16_v2 sqlite3_prepare16_v3 sqlite3_prepare_interop sqlite3_prepare_v2 sqlite3_prepare_v3 sqlite3_preupdate_count sqlite3_preupdate_depth sqlite3_preupdate_hook sqlite3_preupdate_new sqlite3_preupdate_old sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_realloc64 sqlite3_regexp_init sqlite3_rekey sqlite3_rekey_v2 sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_reset_interop sqlite3_result_blob sqlite3_result_blob64 sqlite3_result_double sqlite3_result_double_interop sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_int64_interop sqlite3_result_null sqlite3_result_pointer sqlite3_result_subtype sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_text64 sqlite3_result_value sqlite3_result_zeroblob sqlite3_result_zeroblob64 sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_rtree_query_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_set_last_insert_rowid sqlite3_sha_init sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_status64 sqlite3_step sqlite3_stmt_busy sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strglob sqlite3_stricmp sqlite3_strlike sqlite3_strnicmp sqlite3_system_errno sqlite3_table_column_metadata sqlite3_table_column_metadata_interop sqlite3_table_cursor_interop sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_totype_init sqlite3_trace sqlite3_trace_v2 sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_double_interop sqlite3_value_dup sqlite3_value_free sqlite3_value_int sqlite3_value_int64 sqlite3_value_int64_interop sqlite3_value_numeric_type sqlite3_value_pointer sqlite3_value_subtype sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16_interop sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_text_interop sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_config sqlite3_vtab_on_conflict sqlite3_vtshim_init sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_compact_heap sqlite3_win32_is_nt sqlite3_win32_mbcs_to_utf8 sqlite3_win32_mbcs_to_utf8_v2 sqlite3_win32_reset_heap sqlite3_win32_set_directory sqlite3_win32_sleep sqlite3_win32_unicode_to_utf8 sqlite3_win32_utf8_to_mbcs sqlite3_win32_utf8_to_mbcs_v2 sqlite3_win32_utf8_to_unicode sqlite3_win32_write_debug sqlite3changegroup_add sqlite3changegroup_add_strm sqlite3changegroup_delete sqlite3changegroup_new sqlite3changegroup_output sqlite3changegroup_output_strm sqlite3changeset_apply sqlite3changeset_apply_strm sqlite3changeset_concat sqlite3changeset_concat_strm sqlite3changeset_conflict sqlite3changeset_finalize sqlite3changeset_fk_conflicts sqlite3changeset_invert sqlite3changeset_invert_strm sqlite3changeset_new sqlite3changeset_next sqlite3changeset_old sqlite3changeset_op sqlite3changeset_pk sqlite3changeset_start sqlite3changeset_start_strm sqlite3session_attach sqlite3session_changeset sqlite3session_changeset_strm sqlite3session_create sqlite3session_delete sqlite3session_diff sqlite3session_enable sqlite3session_indirect sqlite3session_isempty sqlite3session_patchset sqlite3session_patchset_strm sqlite3session_table_filter

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b985eb54b678a6a7688301d58e80dacbd626a23c104edec07c805a183d884a7e_NeikiAnalytics.exe

PE Signature issue

kernel32

advapi32

generic