2664356d0f91a3a2b3c399d2f06b539e6ef4fe2d05192c1220109d590f2a8498_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2664356d0f91a3a2b3c399d2f06b539e6ef4fe2d05192c1220109d590f2a8498_NeikiAnalytics.exe
Size

69KB
MD5

3f65a04f6617df4cac930d4ff9745dd0
SHA1

34750aad631074243c20e2d37c66de1aa586cf34
SHA256

2664356d0f91a3a2b3c399d2f06b539e6ef4fe2d05192c1220109d590f2a8498
SHA512

96b5c802163ba0ac12969e2d8dec4d1266bd5235021238c6c16bc8c12526b441a40034c188e740304d2217fc16052d4ea73935c510337b340888b19e3c9891c6
SSDEEP

1536:QpZ+C+dWcWnmT66F5PwYEs58fIsN7SA1KBvPd1L7S:QpT+8cuSTIds58PNP1KBnd1fS

Score

1^/10

Malware Config

Signatures

Files

2664356d0f91a3a2b3c399d2f06b539e6ef4fe2d05192c1220109d590f2a8498_NeikiAnalytics.exe
.dll windows:6 windows x64 arch:x64

7757a3feb8e6ea4eb9877161a53ecd8b

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:d1:ab:d4:d8:da:2e:d7:9f:85:a5:b3
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

16/05/2022, 14:10

Not After

16/05/2025, 14:10

Subject

CN=NOVYE OBLACHNYE TEKHNOLOGII OOO,O=NOVYE OBLACHNYE TEKHNOLOGII OOO,L=Innopolis,ST=Republic of Tatarstan,C=RU,1.2.840.113549.1.9.1=#0c15636f6e74616374406d796f66666963652e7465616d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ee:0b:33:62:f2:b8:6c:72:76:01:82:26:e9:0d:d4:17:03:7b:7c:0e:7a:6c:e5:09:9f:f6:05:d0:a8:66:88:47
Signer

Actual PE Digest

ee:0b:33:62:f2:b8:6c:72:76:01:82:26:e9:0d:d4:17:03:7b:7c:0e:7a:6c:e5:09:9f:f6:05:d0:a8:66:88:47

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

cppu3

typelib_typedescription_new
typelib_typedescription_newMIInterface
typelib_typedescription_newInterfaceMethod
typelib_typedescription_release
typelib_typedescription_register
typelib_typedescriptionreference_new
typelib_typedescriptionreference_release
typelib_static_type_getByTypeClass
typelib_static_type_init
typelib_static_sequence_type_init
uno_type_sequence_construct
uno_type_sequence_reference2One
uno_type_sequence_realloc
uno_type_sequence_destroy
uno_any_destruct

cppuhelper3msc

??1OWeakObject@cppu@@MEAA@XZ
??3OWeakObject@cppu@@SAXPEAX@Z
?WeakImplHelper_getTypes@cppu@@YA?AV?$Sequence@VType@uno@star@sun@com@@@uno@star@sun@com@@PEAUclass_data@1@@Z
?WeakImplHelper_query@cppu@@YA?AVAny@uno@star@sun@com@@AEBVType@3456@PEAUclass_data@1@PEAXPEAVOWeakObject@1@@Z
??0OWeakObject@cppu@@QEAA@XZ
?queryAdapter@OWeakObject@cppu@@UEAA?AV?$Reference@VXAdapter@uno@star@sun@com@@@uno@star@sun@com@@XZ
?supportsService@cppu@@YA_NPEAVXServiceInfo@lang@star@sun@com@@AEBVOUString@rtl@@@Z
?release@OWeakObject@cppu@@UEAAXXZ
?acquire@OWeakObject@cppu@@UEAAXXZ

sal3

rtl_string_release
rtl_string_alloc
rtl_uString2String
rtl_uString_acquire
rtl_uString_release
rtl_uString_new
rtl_uString_newFromLiteral
rtl_uString_assign
rtl_uString_newConcatAsciiL
osl_getSystemPathFromFileURL
rtl_allocateMemory
rtl_freeMemory
osl_acquireMutex
osl_releaseMutex
osl_getGlobalMutex
osl_getThreadTextEncoding

utllo

??1SvtPathOptions@@UEAA@XZ
?GetFingerprintPath@SvtPathOptions@@QEBAAEBVOUString@rtl@@XZ
??0SvtPathOptions@@QEAA@XZ

msvcp140

_Mtx_destroy_in_situ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
_Mtx_init_in_situ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
_Mbrtowc
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock

kernel32

CreateEventW
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
InitializeSListHead

vcruntime140

strchr
_CxxThrowException
__current_exception
__std_exception_copy
__std_terminate
__current_exception_context
__C_specific_handler
memset
__std_type_info_destroy_list
__std_exception_destroy
memmove
memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_initterm_e
_initterm
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
terminate

api-ms-win-crt-heap-l1-1-0

realloc
malloc
calloc
free
_callnewh

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-stdio-l1-1-0

fgets
__stdio_common_vfprintf
fclose
fopen

api-ms-win-crt-string-l1-1-0

_strdup
isspace
strncpy
isdigit
strpbrk

Exports

Exports

lingucomponent_LangGuess_get_implementation

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7757a3feb8e6ea4eb9877161a53ecd8b

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

62:d1:ab:d4:d8:da:2e:d7:9f:85:a5:b3Certificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

ee:0b:33:62:f2:b8:6c:72:76:01:82:26:e9:0d:d4:17:03:7b:7c:0e:7a:6c:e5:09:9f:f6:05:d0:a8:66:88:47Signer

Headers

DLL Characteristics

File Characteristics

Imports

cppu3

cppuhelper3msc

sal3

utllo

msvcp140

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 34KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 172B

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

62:d1:ab:d4:d8:da:2e:d7:9f:85:a5:b3
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

ee:0b:33:62:f2:b8:6c:72:76:01:82:26:e9:0d:d4:17:03:7b:7c:0e:7a:6c:e5:09:9f:f6:05:d0:a8:66:88:47
Signer

.text
Size: 34KB - Virtual size: 34KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 172B