0924feb98b42f4e09e616d9839a7c95d5eecc58776c32d47e154d3398b3dfe57_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0924feb98b42f4e09e616d9839a7c95d5eecc58776c32d47e154d3398b3dfe57_NeikiAnalytics.exe
Size

2.0MB
MD5

8b37baa13ebd22d909472fd0f9f94360
SHA1

c68c917394eb9f4bbfb19d5fe15e9d2a2826de7b
SHA256

0924feb98b42f4e09e616d9839a7c95d5eecc58776c32d47e154d3398b3dfe57
SHA512

a3a7bad6230c96bea8136ed65a9489acbe105306352c46796539619024d8dedd8cd5dc3b35887490eba450510fe0822ba9cbec21927faf1d4aceb7d141f6648b
SSDEEP

24576:Gi//RZZiONfyjMm/6n3IGd3l9m8Egx5MvPhE1JKTB9XYlLTUvLvh8/iSdvXBG9FC:rHRn1fyfyr9mzHxTnvL2ZdvXUFQkU+QX

Score

1^/10

Malware Config

Signatures

Files

0924feb98b42f4e09e616d9839a7c95d5eecc58776c32d47e154d3398b3dfe57_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

cea589a1c13634a4cdacac3f04efb6fc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:f1:83:0f:e4:1a:95:77:e4:c5:02:70:b6:3d:a9:2f
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

17/04/2014, 00:00

Not After

16/05/2016, 23:59

Subject

CN=广州市千钧网络科技有限公司,OU=技术部,O=广州市千钧网络科技有限公司,L=广州,ST=广东,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c8:6e:a6:1e:db:35:fd:94:c2:f7:3d:9f:cc:c1:62:a6:b7:3a:fd:dc
Signer

Actual PE Digest

c8:6e:a6:1e:db:35:fd:94:c2:f7:3d:9f:cc:c1:62:a6:b7:3a:fd:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\56_SVN\python\trunk\solution\bin\ican3.pdb

Imports

kernel32

GetTempPathW
GetSystemInfo
Process32FirstW
OpenProcess
Process32NextW
SetFilePointer
WideCharToMultiByte
WriteFile
DeviceIoControl
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcatW
OpenEventW
SetThreadPriority
InterlockedDecrement
WritePrivateProfileSectionW
MoveFileExW
MoveFileW
GetFileAttributesW
GetCommandLineW
IsBadWritePtr
HeapDestroy
SetEvent
ResetEvent
CloseHandle
DeleteFileW
CreateEventW
HeapAlloc
HeapFree
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
LeaveCriticalSection
EnterCriticalSection
LocalFree
FormatMessageW
GetDriveTypeW
GetSystemDirectoryW
GetLogicalDriveStringsW
FindClose
FindNextFileW
FindFirstFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
GetFileSize
CreateFileW
GetStartupInfoW
GetExitCodeThread
ResumeThread
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
GetExitCodeProcess
ReadFile
PeekNamedPipe
TerminateProcess
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExpandEnvironmentStringsA
WaitForMultipleObjects
GetStdHandle
SleepEx
SetLastError
DeleteFileA
AreFileApisANSI
GetSystemTime
GetTempPathA
GetCurrentProcessId
GetVersionExA
OutputDebugStringA
GetFileAttributesExW
GetDiskFreeSpaceA
CreateFileMappingW
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
FlushFileBuffers
HeapValidate
HeapCreate
GetFileAttributesA
CreateProcessW
SetHandleInformation
CreatePipe
GetLocalTime
GetVersionExW
GetTickCount
GetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
TerminateThread
CopyFileW
OutputDebugStringW
CreateDirectoryW
InterlockedIncrement
CreateThread
WaitForSingleObject
Sleep
DeleteCriticalSection
InitializeCriticalSection
GetPrivateProfileIntW
GetPrivateProfileStringW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
FormatMessageA
GetSystemTimeAsFileTime
UnlockFileEx
LockFile
UnlockFile
QueryPerformanceCounter
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateMutexW
CreateFileA
GetFullPathNameA
GetFullPathNameW
SetFileTime
DosDateTimeToFileTime
SystemTimeToFileTime
DuplicateHandle
GetFileType
IsBadCodePtr
MulDiv
FreeResource
GetModuleHandleW
lstrlenA
InterlockedCompareExchange
InterlockedExchange
RaiseException
GetProcessHeap
HeapSize
HeapReAlloc

user32

ClientToScreen
SetWindowRgn
SetFocus
SetForegroundWindow
PeekMessageW
TranslateMessage
DispatchMessageW
MonitorFromWindow
FillRect
LoadIconW
RegisterWindowMessageW
ScreenToClient
IsZoomed
DestroyWindow
PostQuitMessage
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
CreateAcceleratorTableW
MoveWindow
SetActiveWindow
IsWindow
CharNextW
SystemParametersInfoW
GetMonitorInfoW
ShowWindow
GetParent
IsIconic
KillTimer
InvalidateRgn
GetCaretPos
GetSysColor
SetCaretPos
ShowCaret
SetTimer
ReleaseDC
GetWindowRect
GetDC
GetClientRect
PostMessageW
SendMessageW
CloseWindow
BringWindowToTop
SetWindowLongW
GetWindowLongW
SetWindowPos
ExitWindowsEx
IsWindowEnabled
MessageBoxW
UnionRect
DrawFocusRect
PtInRect
IsWindowVisible
UpdateWindow
InvalidateRect
GetCursorPos
IntersectRect
MapWindowPoints
GetSystemMetrics
DrawTextW
wsprintfW
SetParent
RegisterClassW
GetWindowRgn
CreateWindowExW
RegisterClassExW
LoadCursorW
DefWindowProcW
GetMessageW
EnableWindow
GetWindow
GetKeyState
SetCapture
ReleaseCapture
GetFocus
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
SetCursor
LoadImageW
CallWindowProcW
GetPropW
SetPropW
GetClassInfoExW
OffsetRect
InflateRect
wvsprintfW
CharPrevW
SetRect
CreateCaret
HideCaret

gdi32

GetObjectW
GetStockObject
PtInRegion
GetTextExtentPoint32W
CreateFontW
CreateRoundRectRgn
CreateRectRgn
DeleteObject
DeleteDC
SelectObject
CreateCompatibleDC
CreateDIBSection
CreatePen
CreateSolidBrush
GetTextMetricsW
SetWindowOrgEx
Rectangle
RestoreDC
BitBlt
SaveDC
CreateCompatibleBitmap
SelectClipRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
CombineRgn
StretchBlt
SetStretchBltMode
ExtTextOutW
SetBkColor
LineTo
MoveToEx
CreatePenIndirect
RoundRect
SetTextColor
SetBkMode
TextOutW
GetCharABCWidthsW
GetObjectA
GetDeviceCaps
SetPixel
GetPixel
CreateFontIndirectW

comdlg32

GetOpenFileNameW

advapi32

RegDeleteValueW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData

shell32

DragFinish
DragAcceptFiles
CommandLineToArgvW
Shell_NotifyIconW
SHGetSpecialFolderPathW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
SHGetDesktopFolder
SHOpenFolderAndSelectItems
SHFileOperationW
DragQueryFileW

ole32

CLSIDFromString
CLSIDFromProgID
OleLockRunning
CoCreateInstance
CoUninitialize
CoInitialize
CoCreateGuid

oleaut32

VariantInit
SysAllocString
SysFreeString
VariantClear

shlwapi

PathFileExistsW
PathIsDirectoryW
PathIsURLW
PathFindFileNameW

gdiplus

GdiplusShutdown
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteGraphics
GdipDeleteFont
GdipCreateLineBrushI
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateFromHDC
GdipSetTextRenderingHint
GdipDrawString
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneBrush
GdiplusStartup

comctl32

ord17
_TrackMouseEvent

msvcr90

_invalid_parameter_noinfo
_purecall
memchr
wcsnlen
_vscwprintf
vswprintf_s
_time64
free
??_V@YAXPAX@Z
_wfopen_s
_filelengthi64
malloc
fclose
fread
atoi
_atoi64
sprintf_s
_wtof
swprintf_s
_wcsicmp
_wtoi64
_wtoi
clock
wcsstr
rand
wcsrchr
wcscpy_s
wcscat_s
fseek
fflush
strtod
atof
srand
wcschr
fwrite
_fseeki64
_snscanf_s
_wcsupr_s
isdigit
isalnum
localeconv
strcspn
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
_localtime64_s
strftime
strncpy
strcpy_s
strncmp
iswspace
fopen_s
setvbuf
_vswprintf_c_l
wcstok_s
_wsetlocale
mbstowcs_s
wcstombs_s
strncpy_s
memmove
fopen
fputc
sscanf
fputs
isspace
tolower
isalpha
strchr
_itoa_s
_wtol
wcstol
_wcslwr
memset
strlen
_CxxThrowException
__CxxFrameHandler3
abort
memmove_s
__crtLCMapStringA
__pctype_func
isupper
___lc_codepage_func
___lc_handle_func
memcpy
_calloc_crt
_errno
islower
__uncaught_exception
_free_locale
wcscpy
toupper
wcscmp
wcstoul
realloc
wcslen
wcscat
wcsncpy
iswalnum
wcsncmp
abs
memcmp
cos
sin
_gmtime64
calloc
strcmp
strcpy
_lrotl
sprintf
strpbrk
strerror
__sys_nerr
strrchr
strstr
__iob_func
strtol
strtoul
isxdigit
qsort
_strtoi64
fgets
_lseeki64
_fstat64
getenv
_beginthreadex
_stat64
isgraph
isprint
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_CIsqrt
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
memcpy_s
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
_stricmp
_strnicmp
_open
_close
_read
_fileno
setlocale
_strdup
__RTDynamicCast

ws2_32

send
sendto
getpeername
connect
WSAGetLastError
htons
ntohs
getsockname
recv
bind
socket
WSASetLastError
closesocket
getsockopt
WSAStartup
recvfrom
WSACleanup
setsockopt
getaddrinfo
freeaddrinfo
ioctlsocket
select
__WSAFDIsSet
listen
accept
gethostname

wldap32

ord41
ord26
ord60
ord30
ord143
ord27
ord301
ord211
ord46
ord50
ord200
ord32
ord35
ord33
ord79
ord22

wininet

InternetSetCookieA
InternetSetCookieW
InternetGetCookieExW

winmm

timeGetTime

netapi32

Netbios

psapi

EnumProcessModules
GetModuleBaseNameW

d3d9

Direct3DCreate9

msvcp90

??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cea589a1c13634a4cdacac3f04efb6fc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

40:f1:83:0f:e4:1a:95:77:e4:c5:02:70:b6:3d:a9:2fCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

c8:6e:a6:1e:db:35:fd:94:c2:f7:3d:9f:cc:c1:62:a6:b7:3a:fd:dcSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

comctl32

msvcr90

ws2_32

wldap32

wininet

winmm

netapi32

psapi

d3d9

msvcp90

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 267KB - Virtual size: 266KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 222KB - Virtual size: 221KB

.reloc Size: 79KB - Virtual size: 78KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

40:f1:83:0f:e4:1a:95:77:e4:c5:02:70:b6:3d:a9:2f
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

c8:6e:a6:1e:db:35:fd:94:c2:f7:3d:9f:cc:c1:62:a6:b7:3a:fd:dc
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 267KB - Virtual size: 266KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 222KB - Virtual size: 221KB

.reloc
Size: 79KB - Virtual size: 78KB