3713babf5fbbbcf85cf64d29a097708bfe1ad471409f5d0ec914884be402df86_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

3713babf5fbbbcf85cf64d29a097708bfe1ad471409f5d0ec914884be402df86_NeikiAnalytics.exe
Size

1.2MB
MD5

559c43b38eb9cda558975284c08e6380
SHA1

8a23f1f8148e4b9cc9c20b3be56b39e9b0dab5ed
SHA256

3713babf5fbbbcf85cf64d29a097708bfe1ad471409f5d0ec914884be402df86
SHA512

5171bb84e6301c2977262d5bf105abeea1b18be911ccfd956c4863c586d2399f697dd5b7e1f15756179c813adf40cd326a300f3b7f3390af0959ebe63f7ba703
SSDEEP

12288:JE6N7PFEDWJihVbjnEPBgQVl4lPaH8dn/StuEm2XwZyAopv+4Apovq/:JE27PFEUQU6l4yn/StM2WfC+4Apiq/

Score

1^/10

Malware Config

Signatures

Files

3713babf5fbbbcf85cf64d29a097708bfe1ad471409f5d0ec914884be402df86_NeikiAnalytics.exe
.dll regsvr32 windows:6 windows x64 arch:x64

07e8776825d8080e63beb2e3328c292f

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:9b:b5:3d:d0:6f:10:b3:db:a8:2e:8d:3f:af:65:88
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26-07-2018 00:00

Not After

19-10-2021 12:00

Subject

CN=Dolby Laboratories\, Inc.,O=Dolby Laboratories\, Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:9b:b5:3d:d0:6f:10:b3:db:a8:2e:8d:3f:af:65:88
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

26-07-2018 00:00

Not After

19-10-2021 12:00

Subject

CN=Dolby Laboratories\, Inc.,O=Dolby Laboratories\, Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

75:20:b5:3a:64:b4:7a:0a:da:43:69:cb:1a:e0:39:5d:71:c4:a7:05:19:9c:9f:8f:78:fe:ea:05:f0:b6:29:1a
Signer

Actual PE Digest

75:20:b5:3a:64:b4:7a:0a:da:43:69:cb:1a:e0:39:5d:71:c4:a7:05:19:9c:9f:8f:78:fe:ea:05:f0:b6:29:1a

Digest Algorithm

sha256

PE Digest Matches

true

5d:eb:4d:2c:e6:0a:82:57:7a:89:9c:b8:69:19:fa:06:7d:c3:46:ff
Signer

Actual PE Digest

5d:eb:4d:2c:e6:0a:82:57:7a:89:9c:b8:69:19:fa:06:7d:c3:46:ff

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\DAX322\dolbyapo\solution_output\DolbyAPOvlldpgm\x64\Release\DolbyAPOvlldpgm.pdb

Imports

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-errorhandling-l1-1-0

RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

SetEvent
AcquireSRWLockExclusive
WaitForSingleObject
DeleteCriticalSection
EnterCriticalSection
InitializeSRWLock
InitializeCriticalSectionEx
CreateEventW
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
TryAcquireSRWLockExclusive
LeaveCriticalSection

oleaut32

VarBstrCmp
SysStringLen
SysAllocString
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
VarUI4FromStr
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
SysFreeString

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-localization-l1-2-0

LCMapStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidCodePage
FormatMessageW
GetACP
IsValidLocale
GetOEMCP
GetLocaleInfoW
GetThreadLocale
GetCPInfo
GetLocaleInfoEx
LCMapStringEx
SetThreadLocale

api-ms-win-core-string-l1-1-0

GetStringTypeW
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
CompareStringEx

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
PropVariantClear
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromString

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventWriteString

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
FreeLibrary
SizeofResource
LoadResource
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
FreeLibraryAndExitThread
GetModuleFileNameW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l2-1-0

CharUpperBuffW
CharNextW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegCloseKey
RegSetValueExA
RegEnumKeyExW
RegOpenKeyExW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
ExitThread
CreateThread
GetCurrentProcess
GetStartupInfoW
GetCurrentThreadId
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThread
ExitProcess
TerminateProcess
ResumeThread

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSize
HeapFree
HeapDestroy
HeapReAlloc
HeapAlloc

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64

audioeng

AERT_Allocate
AERT_Free

kernel32

OutputDebugStringW
IsDebuggerPresent
TryEnterCriticalSection
InitializeCriticalSection

advapi32

DeregisterEventSource
RegQueryValueExW
ReportEventW
RegisterEventSourceW
RegDeleteKeyExW

ole32

StringFromCLSID

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
SleepConditionVariableCS
InitializeConditionVariable
WakeAllConditionVariable

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlUnwindEx
RtlPcToFileHeader

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList

api-ms-win-core-fibers-l1-1-0

FlsSetValue
FlsAlloc
FlsFree
FlsGetValue

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-processenvironment-l1-1-0

SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetStdHandle
SetStdHandle

api-ms-win-core-file-l1-1-0

FlushFileBuffers
FindClose
CreateFileW
SetFilePointerEx
WriteFile
FindNextFileW
FindFirstFileExW
GetFileType

api-ms-win-core-console-l1-1-0

SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
WriteConsoleW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 835KB - Virtual size: 834KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_BSS
Size: - Virtual size: 8B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

RT_CONST
Size: 1024B - Virtual size: 680B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

RT_DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07e8776825d8080e63beb2e3328c292f

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

01:9b:b5:3d:d0:6f:10:b3:db:a8:2e:8d:3f:af:65:88Certificate

Extended Key Usages

Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

01:9b:b5:3d:d0:6f:10:b3:db:a8:2e:8d:3f:af:65:88Certificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

75:20:b5:3a:64:b4:7a:0a:da:43:69:cb:1a:e0:39:5d:71:c4:a7:05:19:9c:9f:8f:78:fe:ea:05:f0:b6:29:1aSigner

5d:eb:4d:2c:e6:0a:82:57:7a:89:9c:b8:69:19:fa:06:7d:c3:46:ffSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-util-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

oleaut32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

audioeng

kernel32

advapi32

ole32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-timezone-l1-1-0

Exports

Exports

Sections

.text Size: 835KB - Virtual size: 834KB

RT_CODE Size: 2KB - Virtual size: 2KB

RT_BSS Size: - Virtual size: 8B

.rdata Size: 316KB - Virtual size: 316KB

.data Size: 10KB - Virtual size: 18KB

.pdata Size: 41KB - Virtual size: 41KB

RT_CONST Size: 1024B - Virtual size: 680B

RT_DATA Size: 1KB - Virtual size: 1KB

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 5KB - Virtual size: 4KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

01:9b:b5:3d:d0:6f:10:b3:db:a8:2e:8d:3f:af:65:88
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

01:9b:b5:3d:d0:6f:10:b3:db:a8:2e:8d:3f:af:65:88
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

75:20:b5:3a:64:b4:7a:0a:da:43:69:cb:1a:e0:39:5d:71:c4:a7:05:19:9c:9f:8f:78:fe:ea:05:f0:b6:29:1a
Signer

5d:eb:4d:2c:e6:0a:82:57:7a:89:9c:b8:69:19:fa:06:7d:c3:46:ff
Signer

.text
Size: 835KB - Virtual size: 834KB

RT_CODE
Size: 2KB - Virtual size: 2KB

RT_BSS
Size: - Virtual size: 8B

.rdata
Size: 316KB - Virtual size: 316KB

.data
Size: 10KB - Virtual size: 18KB

.pdata
Size: 41KB - Virtual size: 41KB

RT_CONST
Size: 1024B - Virtual size: 680B

RT_DATA
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 5KB - Virtual size: 4KB