3d7d6a7bf0422fa794f0d83e2c0c674285209d5a8e2c9292b6970bf19f2547d6_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

3d7d6a7bf0422fa794f0d83e2c0c674285209d5a8e2c9292b6970bf19f2547d6_NeikiAnalytics.exe
Size

1.5MB
MD5

c8349dfbb89ea2d870e28d021c80c2e0
SHA1

a5b686b0d653e4b7133423186f60ef0ac603eab4
SHA256

3d7d6a7bf0422fa794f0d83e2c0c674285209d5a8e2c9292b6970bf19f2547d6
SHA512

f97edb529b1e8e3dbe60302415436714ccc8226119cb574120a4488f638207a02276edf9c41ef38c132cad13ff4d1328cf7601c74a4ab4d5b307968d61230a98
SSDEEP

24576:8MukkWppypwhKMtdLl0IV83D3vXkyrnggYIv2m2fgRgQbKSVnl+RMdtIgICpr:0JgQgChMON

Score

1^/10

Malware Config

Signatures

Files

3d7d6a7bf0422fa794f0d83e2c0c674285209d5a8e2c9292b6970bf19f2547d6_NeikiAnalytics.exe
.exe windows:5 windows x86 arch:x86

51ee72c638ee0200ff8b37fb1213b605

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:76:07:71:52:58:3a:37:2c:33:8a:f1:1a:6e:cf:83
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

14-04-2023 00:00

Not After

13-04-2026 23:59

Subject

CN=F.lux Software LLC,O=F.lux Software LLC,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25-05-2021 00:00

Not After

31-12-2028 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22-03-2021 00:00

Not After

21-03-2036 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1e:76:07:71:52:58:3a:37:2c:33:8a:f1:1a:6e:cf:83
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

14-04-2023 00:00

Not After

13-04-2026 23:59

Subject

CN=F.lux Software LLC,O=F.lux Software LLC,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ed:35:bb:26:6b:de:63:42:0c:2f:f6:d7:11:7f:61:5f:89:64:cc:ff:ca:e9:2d:58:56:d0:6e:b2:a1:6d:f5:4c
Signer

Actual PE Digest

ed:35:bb:26:6b:de:63:42:0c:2f:f6:d7:11:7f:61:5f:89:64:cc:ff:ca:e9:2d:58:56:d0:6e:b2:a1:6d:f5:4c

Digest Algorithm

sha256

PE Digest Matches

true

b3:5f:8a:66:ac:ab:13:e2:6d:ac:8c:d8:12:71:2d:0c:0f:66:9f:5d
Signer

Actual PE Digest

b3:5f:8a:66:ac:ab:13:e2:6d:ac:8c:d8:12:71:2d:0c:0f:66:9f:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Users\mherf\git\projects\flux\NoAccount\flux.pdb

Imports

netapi32

NetApiBufferFree
NetGetJoinInformation

wsock32

bind
socket
closesocket
send
recv
sendto
setsockopt
htons
select
ioctlsocket
WSAStartup
connect

winmm

timeGetTime
timeBeginPeriod

kernel32

GetModuleFileNameA
LoadLibraryExA
ExitProcess
GetDiskFreeSpaceExA
QueryPerformanceCounter
TerminateProcess
OpenProcess
GetCurrentProcess
ResetEvent
WaitForSingleObject
DeleteCriticalSection
IsProcessorFeaturePresent
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
GetProcAddress
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
GetCurrentProcessId
CloseHandle
EnterCriticalSection
CreateMutexA
GetLastError
LeaveCriticalSection
CreateEventA
Sleep
GetTickCount
SetEvent
LCMapStringW
LCMapStringA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetHandleCount
GetConsoleMode
GetConsoleCP
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapReAlloc
VirtualFree
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
RtlUnwind
GetFileType
SetStdHandle
GetStartupInfoA
GetCommandLineA
CreateThread
ResumeThread
ExitThread
GetSystemTimeAsFileTime
HeapAlloc
GetProcessHeap
HeapFree
WriteFile
ReadFile
UnmapViewOfFile
InterlockedDecrement
InterlockedIncrement
FreeLibrary
lstrcmpiA
IsDBCSLeadByte
FlushFileBuffers
GetFileSize
SetEndOfFile
SetFilePointer
lstrcmpW
WriteConsoleA
FlushInstructionCache
SetLastError
DisableThreadLibraryCalls
MultiByteToWideChar
WideCharToMultiByte
SetThreadPriority
TerminateThread
GetCurrentThreadId
lstrcpynA
LocalFree
FormatMessageA
LoadLibraryA
GetComputerNameA
GetProcessHandleCount
GlobalAlloc
GlobalLock
GlobalUnlock
CreateFileA
GetVersion
GetVersionExA
GetLocaleInfoA
GetStdHandle
VerSetConditionMask
VerifyVersionInfoA
GetSystemPowerStatus
SetThreadExecutionState
FileTimeToSystemTime
GetLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
LocalFileTimeToFileTime
GetTimeFormatA
QueryPerformanceFrequency
GetFileAttributesExA
DeleteFileA
GetFileAttributesA
MulDiv
GetModuleHandleA
VirtualQuery
CreateDirectoryA
lstrlenW
RaiseException
LoadResource
SizeofResource
FindResourceA
lstrlenA
lstrcmpA

user32

GetWindowThreadProcessId
DestroyMenu
UnregisterHotKey
AdjustWindowRect
RegisterHotKey
SetWindowTextW
EnableWindow
LoadImageA
SetWindowTextA
SystemParametersInfoA
SetMenuDefaultItem
PostMessageA
AppendMenuA
IsDlgButtonChecked
CreatePopupMenu
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
EndPaint
GetClassNameA
GetClassInfoExA
BeginPaint
GetSysColor
EnumDisplayMonitors
MessageBeep
ExitWindowsEx
UpdateWindow
ClientToScreen
SetTimer
GetWindowRect
GetWindowTextLengthA
GetWindowTextA
LoadStringA
SetFocus
IsIconic
SetActiveWindow
GetWindowLongA
GetClassInfoA
SetWindowLongA
GetWindow
EnumThreadWindows
IsWindow
DestroyWindow
RegisterWindowMessageA
GetParent
CreateWindowExA
IsWindowVisible
ShowWindowAsync
SetMenu
RegisterClassA
SetClassLongA
DefWindowProcA
SetWindowPos
MoveWindow
GetSystemMetrics
ReleaseCapture
GetActiveWindow
FlashWindowEx
PostQuitMessage
CallWindowProcA
wsprintfA
GetAsyncKeyState
LoadCursorA
SetCursor
ShowCursor
UnregisterClassA
GetCursorPos
SetCursorPos
IsDialogMessageA
TranslateAcceleratorA
TranslateMessage
MessageBoxA
EnumChildWindows
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetDlgItemTextA
FillRect
SetCapture
CharNextA
ScreenToClient
InvalidateRect
InvalidateRgn
RedrawWindow
IsChild
RegisterClassExA
DestroyAcceleratorTable
GetFocus
CreateAcceleratorTableA
EndDialog
DialogBoxParamA
AdjustWindowRectEx
GetMenu
SetParent
GetTopWindow
GetMessageExtraInfo
KillTimer
SetForegroundWindow
LoadIconA
FindWindowExA
WindowFromPoint
GetClientRect
SendMessageA
GetDC
GetForegroundWindow
TrackPopupMenuEx
AppendMenuW
ReleaseDC
GetDlgItem
GetDesktopWindow
CheckDlgButton
GetLastInputInfo
ShowWindow

gdi32

CreateCompatibleDC
DeleteDC
CreateDCA
GetStockObject
GetDeviceCaps
SetDeviceGammaRamp
GetICMProfileA
GetDeviceGammaRamp
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
BitBlt
GetObjectA
GetKerningPairsA
GetGlyphOutlineA
CreateFontIndirectA
SetBkMode
StretchBlt
SetStretchBltMode
CreateDIBSection
Rectangle
CreatePen
SelectObject

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CreateWellKnownSid
CryptAcquireContextA
CheckTokenMembership
CryptGenRandom
OpenProcessToken

ole32

CoTaskMemRealloc
StringFromGUID2
CoRegisterClassObject
CoTaskMemAlloc
CreateStreamOnHGlobal
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleInitialize
OleUninitialize
CoResumeClassObjects
CoInitialize
CoTaskMemFree
CoInitializeEx
CoUninitialize
CoSetProxyBlanket
CLSIDFromString
CoCreateInstance

oleaut32

SysFreeString
VariantClear
VariantInit
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysAllocStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime
SysAllocString

psapi

GetProcessMemoryInfo
GetModuleFileNameExA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsExA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiOpenDevRegKey

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wininet

InternetConnectA
HttpEndRequestA
HttpSendRequestExA
InternetOpenA
DeleteUrlCacheEntry
InternetCrackUrlA
HttpOpenRequestA
InternetWriteFile
HttpQueryInfoA
InternetQueryDataAvailable
HttpSendRequestA
InternetCloseHandle
HttpAddRequestHeadersA
InternetSetOptionA
InternetReadFile

urlmon

URLDownloadToFileA
UrlMkSetSessionOption
URLDownloadToCacheFileA

dbghelp

MiniDumpWriteDump

comctl32

PropertySheetA
InitCommonControlsEx
CreatePropertySheetPageA

shlwapi

SHDeleteValueA
PathAddBackslashA

wintrust

WinVerifyTrust

shell32

Shell_NotifyIconA
SHGetSpecialFolderPathA
ShellExecuteExA
ShellExecuteA

Sections

.text
Size: 730KB - Virtual size: 729KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 506KB - Virtual size: 543KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

51ee72c638ee0200ff8b37fb1213b605

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

1e:76:07:71:52:58:3a:37:2c:33:8a:f1:1a:6e:cf:83Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

1e:76:07:71:52:58:3a:37:2c:33:8a:f1:1a:6e:cf:83Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

ed:35:bb:26:6b:de:63:42:0c:2f:f6:d7:11:7f:61:5f:89:64:cc:ff:ca:e9:2d:58:56:d0:6e:b2:a1:6d:f5:4cSigner

b3:5f:8a:66:ac:ab:13:e2:6d:ac:8c:d8:12:71:2d:0c:0f:66:9f:5dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

netapi32

wsock32

winmm

kernel32

user32

gdi32

advapi32

ole32

oleaut32

psapi

setupapi

version

wininet

urlmon

dbghelp

comctl32

shlwapi

wintrust

shell32

Sections

.text Size: 730KB - Virtual size: 729KB

.rdata Size: 165KB - Virtual size: 164KB

.data Size: 506KB - Virtual size: 543KB

.rsrc Size: 29KB - Virtual size: 28KB

.reloc Size: 40KB - Virtual size: 40KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

1e:76:07:71:52:58:3a:37:2c:33:8a:f1:1a:6e:cf:83
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

1e:76:07:71:52:58:3a:37:2c:33:8a:f1:1a:6e:cf:83
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

ed:35:bb:26:6b:de:63:42:0c:2f:f6:d7:11:7f:61:5f:89:64:cc:ff:ca:e9:2d:58:56:d0:6e:b2:a1:6d:f5:4c
Signer

b3:5f:8a:66:ac:ab:13:e2:6d:ac:8c:d8:12:71:2d:0c:0f:66:9f:5d
Signer

.text
Size: 730KB - Virtual size: 729KB

.rdata
Size: 165KB - Virtual size: 164KB

.data
Size: 506KB - Virtual size: 543KB

.rsrc
Size: 29KB - Virtual size: 28KB

.reloc
Size: 40KB - Virtual size: 40KB