General

Malware Config

Signatures

Files

• 3299a29a7eff98ce4b3c23aaee7e3438f3db068cf22bc6db110d07d26503df3a_NeikiAnalytics.exe

  .exe windows:5 windows x86 arch:x86

  99e90cf7e3ddc56aff62d04e923cce29

  
  

  Code Sign

  9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  05-05-2015 00:00

  Not After

  31-12-2015 23:59

  Subject

  CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  11-03-2013 00:00

  Not After

  10-03-2016 23:59

  Subject

  CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  77:64:19:64:61:21:3f:98:69:8c:e5:af:23:83:90:2f:63:ad:3c:ce

  Signer

  Actual PE Digest

  77:64:19:64:61:21:3f:98:69:8c:e5:af:23:83:90:2f:63:ad:3c:ce

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  e:\building\ludashi_projects\360HardwareMaster\inst\Release\inst.pdb

  Imports

  kernel32

  WriteFile

  CreateFileW

  GetTempPathW

  DebugBreak

  OutputDebugStringW

  lstrlenA

  GetModuleFileNameW

  Sleep

  RaiseException

  GetCurrentThreadId

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  FlushInstructionCache

  GetCurrentProcess

  GetModuleHandleW

  InitializeCriticalSection

  FreeLibrary

  MultiByteToWideChar

  SizeofResource

  LoadResource

  FindResourceW

  LoadLibraryExW

  lstrcmpiW

  LockResource

  GetTempFileNameW

  DeviceIoControl

  GetCurrentProcessId

  LoadLibraryW

  CreateProcessW

  GetProcAddress

  WideCharToMultiByte

  LocalFree

  UnmapViewOfFile

  SetFilePointer

  MapViewOfFile

  CreateFileMappingW

  GetFileAttributesExW

  CreateMutexW

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  OpenProcess

  GetLongPathNameW

  GetLocalTime

  GetFileSizeEx

  GetCPInfo

  GetCurrentThread

  HeapReAlloc

  GetStartupInfoW

  GetLastError

  CloseHandle

  GetDriveTypeW

  GetDiskFreeSpaceExW

  lstrcmpiA

  lstrcmpA

  SetEnvironmentVariableA

  GetLogicalDriveStringsW

  CompareStringA

  WriteConsoleW

  GetConsoleOutputCP

  WriteConsoleA

  GetTimeZoneInformation

  SetStdHandle

  GetLocaleInfoW

  LCMapStringA

  GetTickCount

  QueryPerformanceCounter

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetModuleHandleA

  FlushFileBuffers

  GetConsoleMode

  lstrcpyW

  GetFullPathNameW

  SetLastError

  lstrlenW

  InterlockedIncrement

  InterlockedDecrement

  MoveFileExW

  RemoveDirectoryW

  GetFileAttributesW

  CreateThread

  ExitThread

  ExitProcess

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  TerminateProcess

  RtlUnwind

  GetConsoleCP

  GetStringTypeW

  GetStringTypeA

  IsValidLocale

  EnumSystemLocalesA

  GetLocaleInfoA

  GetUserDefaultLCID

  GetDateFormatA

  GetTimeFormatA

  TlsFree

  DeleteAtom

  FindAtomW

  TlsAlloc

  ReleaseMutex

  AddAtomW

  OpenThread

  GetAtomNameW

  TlsSetValue

  WaitForSingleObject

  TlsGetValue

  GetSystemTime

  FormatMessageW

  ReadFile

  SetFilePointerEx

  SetFileAttributesW

  FindFirstFileW

  LCMapStringW

  GetStartupInfoA

  GetFileType

  SetEndOfFile

  LocalFileTimeToFileTime

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  InterlockedExchange

  FindNextFileW

  DeleteFileW

  SetConsoleCtrlHandler

  GetModuleFileNameA

  GetStdHandle

  HeapSize

  GetSystemTimeAsFileTime

  SystemTimeToFileTime

  FindClose

  CompareStringW

  FatalAppExitA

  HeapDestroy

  HeapCreate

  IsValidCodePage

  GetOEMCP

  CreateFileA

  VirtualAlloc

  InterlockedCompareExchange

  HeapFree

  GetProcessHeap

  HeapAlloc

  LoadLibraryA

  IsProcessorFeaturePresent

  VirtualFree

  GetACP

  user32

  LoadStringW

  CharNextW

  wvsprintfW

  DefWindowProcW

  DispatchMessageW

  TranslateMessage

  GetMessageW

  PeekMessageW

  UnregisterClassA

  DestroyWindow

  SetWindowLongW

  CreateWindowExW

  GetClassInfoExW

  LoadCursorW

  RegisterClassExW

  LoadImageW

  GetSystemMetrics

  PostQuitMessage

  PostMessageW

  SetWindowTextW

  SendMessageW

  GetWindowLongW

  CallWindowProcW

  FindWindowExW

  GetWindowThreadProcessId

  wsprintfW

  GetActiveWindow

  MessageBoxW

  advapi32

  RegQueryInfoKeyW

  RegEnumKeyExA

  RegQueryValueExW

  RegQueryValueExA

  RegDeleteKeyW

  RegDeleteValueW

  RegSetValueExW

  RegEnumKeyExW

  RegOpenKeyExW

  RegCreateKeyExW

  RegCloseKey

  RegOpenKeyExA

  shell32

  SHGetSpecialFolderPathW

  ord165

  ShellExecuteW

  SHCreateDirectoryExW

  SHFileOperationW

  ShellExecuteExW

  CommandLineToArgvW

  ole32

  CoTaskMemRealloc

  CoCreateGuid

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromProgID

  CoCreateInstance

  CoInitialize

  CoSetProxyBlanket

  CoInitializeSecurity

  CoInitializeEx

  CoUninitialize

  oleaut32

  VarUI4FromStr

  VariantClear

  VariantInit

  SysAllocString

  SysFreeString

  shlwapi

  PathFindFileNameW

  PathIsPrefixW

  PathAppendW

  PathFileExistsW

  PathFindExtensionW

  PathCombineW

  wnsprintfW

  SHGetValueW

  PathRemoveBackslashW

  StrToIntExW

  SHGetValueA

  PathRemoveFileSpecW

  SHSetValueA

  comctl32

  InitCommonControlsEx

  ws2_32

  WSACleanup

  WSAStartup

  setupapi

  SetupIterateCabinetW

  wintrust

  WTHelperProvDataFromStateData

  WinVerifyTrust

  crypt32

  CertGetNameStringW

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  psapi

  GetModuleFileNameExW

  iphlpapi

  GetAdaptersInfo

  wininet

  InternetGetConnectedState

  urlmon

  URLDownloadToCacheFileW

  URLDownloadToFileW

  netapi32

  Netbios

  Sections

  .text

  Size: 363KB - Virtual size: 363KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 42KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 15KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 632KB - Virtual size: 631KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 13KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ