General

Malware Config

Signatures

Files

• 335a618d23c582687daf00549b887fa6c3cbef9ccc3b06fd0226117536f0eb7a_NeikiAnalytics.exe

  .exe windows:4 windows x86 arch:x86

  9c22b849e7bbeaa48d629de4759bcd90

  
  

  Code Sign

  34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  17-11-2006 00:00

  Not After

  16-07-2036 23:59

  Subject

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

  Certificate

  Issuer

  CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  6e:50:ee:b4:a8:37:1f:48:da:66:5c:63:2d:a4:d1:dc

  Certificate

  Issuer

  CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

  Not Before

  07-02-2013 00:00

  Not After

  07-02-2015 23:59

  Subject

  CN=RHUB Communications Inc,O=RHUB Communications Inc,L=San Jose,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageMicrosoftCommercialCodeSigning

  Signer

  Actual PE Digest

  Digest Algorithm

  PE Digest Matches

  false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\RHUB2\PCSetup\Release\PCSetup.pdb

  Imports

  kernel32

  GetStartupInfoW

  ExitProcess

  RtlUnwind

  GetDriveTypeW

  ExitThread

  CreateThread

  HeapFree

  GetSystemTimeAsFileTime

  GetFileType

  HeapAlloc

  HeapReAlloc

  HeapSize

  VirtualProtect

  VirtualAlloc

  GetStdHandle

  GetModuleFileNameA

  UnhandledExceptionFilter

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetCommandLineW

  SetHandleCount

  HeapDestroy

  HeapCreate

  VirtualFree

  GetCurrentDirectoryA

  IsBadWritePtr

  GetTimeZoneInformation

  SetStdHandle

  GetOEMCP

  GetCPInfo

  IsBadReadPtr

  IsBadCodePtr

  GetStringTypeA

  GetStringTypeW

  GetUserDefaultLCID

  EnumSystemLocalesA

  IsValidLocale

  IsValidCodePage

  LCMapStringA

  LCMapStringW

  CreateFileA

  GetDriveTypeA

  CompareStringA

  CompareStringW

  SetEnvironmentVariableA

  GetTickCount

  FileTimeToSystemTime

  SetErrorMode

  GetFullPathNameW

  GetVolumeInformationW

  DuplicateHandle

  SetEndOfFile

  UnlockFile

  LockFile

  FlushFileBuffers

  ReadFile

  TlsFree

  LocalReAlloc

  TlsSetValue

  TlsAlloc

  TlsGetValue

  GlobalHandle

  GlobalReAlloc

  LocalFree

  LocalAlloc

  GlobalFlags

  InterlockedIncrement

  GetCurrentDirectoryW

  lstrcpynW

  MulDiv

  SetLastError

  GlobalUnlock

  WritePrivateProfileStringW

  FreeResource

  GlobalFindAtomW

  lstrlenA

  GetModuleHandleA

  lstrcatW

  GetVersionExA

  GlobalAddAtomW

  InterlockedDecrement

  GlobalLock

  lstrcmpW

  GlobalDeleteAtom

  GetModuleHandleW

  ConvertDefaultLocale

  GetVersion

  EnumResourceLanguagesW

  GetLocaleInfoW

  LoadLibraryA

  GetTempPathA

  GetTempFileNameA

  DeleteFileA

  Sleep

  DeleteCriticalSection

  InitializeCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  CreateProcessW

  GetCurrentThread

  OpenProcess

  TerminateProcess

  GetLongPathNameW

  CopyFileW

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  QueryPerformanceFrequency

  QueryPerformanceCounter

  GlobalAlloc

  GlobalFree

  GetFileAttributesW

  CreateDirectoryW

  FindFirstFileW

  RemoveDirectoryW

  SetFileAttributesW

  DeleteFileW

  FindNextFileW

  FindClose

  MultiByteToWideChar

  SetThreadPriority

  SetEvent

  CreateEventW

  lstrcpyW

  SetFilePointer

  IsDebuggerPresent

  GetLastError

  FormatMessageW

  lstrcmpiW

  GetSystemInfo

  VirtualQuery

  CreateFileW

  GetFileSize

  GetFileTime

  CloseHandle

  FileTimeToLocalFileTime

  FileTimeToDosDateTime

  OutputDebugStringW

  RaiseException

  GetCurrentThreadId

  GetModuleFileNameW

  LoadLibraryW

  GetTempPathW

  GetCurrentProcessId

  GetProcAddress

  GetCurrentProcess

  FreeLibrary

  lstrlenW

  WriteFile

  WideCharToMultiByte

  SetUnhandledExceptionFilter

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  GetVersionExW

  GetThreadLocale

  GetLocaleInfoA

  GetACP

  GetStartupInfoA

  InterlockedExchange

  user32

  PostThreadMessageW

  RegisterClipboardFormatW

  MessageBeep

  GetNextDlgGroupItem

  InvalidateRgn

  CopyAcceleratorTableW

  SetRect

  IsRectEmpty

  CharNextW

  DestroyMenu

  CharUpperW

  GetSysColorBrush

  LoadCursorW

  ShowWindow

  MoveWindow

  SetWindowTextW

  IsDialogMessageW

  EndPaint

  BeginPaint

  GetWindowDC

  ReleaseDC

  GetDC

  ClientToScreen

  GrayStringW

  DrawTextExW

  DrawTextW

  TabbedTextOutW

  CreateDialogIndirectParamW

  GetNextDlgTabItem

  EndDialog

  SetWindowContextHelpId

  MapDialogRect

  RegisterWindowMessageW

  WinHelpW

  CreateWindowExW

  GetClassInfoExW

  GetClassLongW

  SetPropW

  GetPropW

  RemovePropW

  SendDlgItemMessageW

  SendDlgItemMessageA

  IsWindow

  SetFocus

  IsChild

  GetWindowTextW

  GetForegroundWindow

  PostMessageW

  GetClassInfoW

  OffsetRect

  GetWindowRect

  GetClientRect

  InvalidateRect

  GetCapture

  SendMessageW

  EnableWindow

  LoadIconW

  LoadBitmapW

  ReleaseCapture

  SetActiveWindow

  GetDlgItem

  GetTopWindow

  DestroyWindow

  GetMessageTime

  GetMessagePos

  MapWindowPoints

  SetForegroundWindow

  UpdateWindow

  GetMenu

  GetSubMenu

  GetMenuItemID

  GetMenuItemCount

  GetSysColor

  AdjustWindowRectEx

  ScreenToClient

  EqualRect

  RegisterClassW

  UnregisterClassW

  GetDlgCtrlID

  DefWindowProcW

  CallWindowProcW

  SetWindowLongW

  SetWindowPos

  IntersectRect

  SystemParametersInfoA

  IsIconic

  GetWindowPlacement

  GetSystemMetrics

  CopyRect

  PtInRect

  GetWindow

  SetMenuItemBitmaps

  GetFocus

  ModifyMenuW

  GetClassNameW

  PostQuitMessage

  DispatchMessageW

  GetMessageW

  PeekMessageW

  wvsprintfW

  wsprintfW

  FindWindowW

  MessageBoxW

  GetActiveWindow

  GetDesktopWindow

  UnhookWindowsHookEx

  SetCursor

  IsWindowEnabled

  GetLastActivePopup

  GetWindowLongW

  GetParent

  ValidateRect

  GetCursorPos

  GetKeyState

  IsWindowVisible

  TranslateMessage

  CallNextHookEx

  SetWindowsHookExW

  GetMenuCheckMarkDimensions

  CheckMenuItem

  EnableMenuItem

  GetMenuState

  SetCapture

  gdi32

  GetMapMode

  GetRgnBox

  GetTextColor

  GetBkColor

  CreateRectRgnIndirect

  GetDeviceCaps

  SetWindowExtEx

  ScaleViewportExtEx

  SetViewportExtEx

  OffsetViewportOrgEx

  SetViewportOrgEx

  SelectObject

  GetStockObject

  DeleteDC

  ExtSelectClipRgn

  CreateRoundRectRgn

  Escape

  ExtTextOutW

  TextOutW

  RectVisible

  PtVisible

  GetWindowExtEx

  GetViewportExtEx

  DeleteObject

  SetMapMode

  SetBkMode

  RestoreDC

  SaveDC

  GetObjectW

  SetBkColor

  SetTextColor

  GetClipBox

  CreateBitmap

  FrameRgn

  CreateSolidBrush

  ScaleWindowExtEx

  comdlg32

  GetFileTitleW

  winspool.drv

  OpenPrinterW

  ClosePrinter

  DocumentPropertiesW

  advapi32

  RegOpenKeyExW

  RegQueryValueExW

  RegDeleteKeyW

  GetUserNameW

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  ImpersonateSelf

  RegQueryValueW

  RegOpenKeyW

  RegEnumKeyW

  OpenSCManagerW

  OpenServiceW

  ControlService

  CloseServiceHandle

  RegCreateKeyExW

  RegSetValueExW

  OpenThreadToken

  RegCloseKey

  shell32

  ShellExecuteW

  SHCreateDirectoryExW

  SHGetFolderPathW

  SHGetSpecialFolderPathW

  comctl32

  ord17

  shlwapi

  PathStripToRootW

  PathFindFileNameW

  PathFindExtensionW

  PathRemoveFileSpecW

  PathIsUNCW

  oledlg

  OleUIBusyW

  ole32

  CoRevokeClassObject

  CLSIDFromProgID

  CLSIDFromString

  CoTaskMemFree

  CoTaskMemAlloc

  OleInitialize

  CoGetClassObject

  StgOpenStorageOnILockBytes

  StgCreateDocfileOnILockBytes

  CreateILockBytesOnHGlobal

  OleUninitialize

  CoFreeUnusedLibraries

  CoRegisterMessageFilter

  OleFlushClipboard

  OleIsCurrentClipboard

  oleaut32

  SysAllocStringLen

  VariantClear

  VariantChangeType

  VariantInit

  SysFreeString

  SysStringLen

  OleCreateFontIndirect

  VariantTimeToSystemTime

  SystemTimeToVariantTime

  SafeArrayDestroy

  SysAllocString

  VariantCopy

  urlmon

  URLDownloadToFileA

  wininet

  HttpSendRequestW

  HttpOpenRequestW

  InternetConnectW

  InternetOpenW

  InternetReadFile

  DetectAutoProxyUrl

  InternetReadFileExA

  InternetErrorDlg

  HttpQueryInfoA

  HttpSendRequestA

  InternetQueryOptionA

  HttpOpenRequestA

  InternetConnectA

  InternetOpenA

  InternetSetOptionA

  InternetCloseHandle

  ws2_32

  recv

  shutdown

  send

  connect

  setsockopt

  socket

  closesocket

  inet_addr

  WSALookupServiceEnd

  WSAAddressToStringW

  WSALookupServiceNextW

  WSALookupServiceBeginW

  WSAStartup

  inet_ntoa

  gethostbyname

  gethostname

  htons

  WSAGetLastError

  Sections

  .text

  Size: 293KB - Virtual size: 292KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 84KB - Virtual size: 83KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 30KB - Virtual size: 76KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ