General

Malware Config

Signatures

Files

• 342e4c5558f96ae0d5da658a3a8264967039285079611c26ace2cf950a8b0ea2_NeikiAnalytics.exe

  .exe windows:5 windows x86 arch:x86

  ec9b83582f662fb45fd31bf7cc66b18e

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  07-06-2012 00:00

  Not After

  06-06-2022 23:59

  Subject

  CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  75:fb:51:c8:76:8e:f6:92:7b:f4:1d:a1:a2:34:a1:d9

  Certificate

  Issuer

  CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  30-07-2013 00:00

  Not After

  25-07-2015 23:59

  Subject

  SERIALNUMBER=2748129,CN=Adobe Systems\, Incorporated,OU=AcrobatXI,O=Adobe Systems\, Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  f0:2c:c1:59:fc:38:b8:d1:83:64:50:e5:50:8d:67:2b:84:3a:2d:4e

  Signer

  Actual PE Digest

  f0:2c:c1:59:fc:38:b8:d1:83:64:50:e5:50:8d:67:2b:84:3a:2d:4e

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  F:\CB\ARM\BuildResults\bin\Win32\Release\armsvc.pdb

  Imports

  kernel32

  GetCurrentThreadId

  CloseHandle

  DeleteFileW

  LocalFree

  MoveFileExW

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetFileSize

  FormatMessageW

  FlushFileBuffers

  GetLocalTime

  MapViewOfFile

  UnmapViewOfFile

  Sleep

  CreateFileMappingW

  DeleteCriticalSection

  GetVolumeInformationW

  FindNextFileW

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  GetTickCount

  QueryPerformanceCounter

  IsDebuggerPresent

  lstrcmpiW

  RemoveDirectoryW

  LocalAlloc

  FindClose

  GetProcAddress

  GetLastError

  RaiseException

  GetTempPathW

  lstrlenW

  MultiByteToWideChar

  lstrcmpW

  CreateFileW

  GetModuleFileNameW

  ReadFile

  GetFileAttributesW

  SizeofResource

  CopyFileW

  InitializeCriticalSection

  WriteFile

  GetModuleHandleW

  CreateDirectoryW

  InterlockedDecrement

  InterlockedIncrement

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  GetStartupInfoW

  InterlockedCompareExchange

  InterlockedExchange

  LoadLibraryExW

  LoadResource

  FreeLibrary

  FindResourceW

  SetFilePointer

  FindFirstFileW

  OpenFileMappingW

  lstrcmpA

  user32

  GetMessageW

  PostThreadMessageW

  CharNextW

  LoadStringW

  DispatchMessageW

  advapi32

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegisterEventSourceW

  CloseServiceHandle

  DeleteService

  OpenSCManagerW

  StartServiceCtrlDispatcherW

  OpenServiceW

  RegSetValueExW

  RegCloseKey

  RegEnumKeyExW

  ControlService

  ReportEventW

  RegisterServiceCtrlHandlerW

  RegOpenKeyExW

  CreateServiceW

  SetServiceStatus

  RegDeleteValueW

  RegDeleteKeyW

  DeregisterEventSource

  RegQueryInfoKeyW

  RegQueryValueExW

  RegCreateKeyExW

  shell32

  SHGetFolderPathW

  ShellExecuteExW

  SHCreateDirectoryExW

  ole32

  CoCreateInstance

  CoUninitialize

  CoTaskMemRealloc

  StringFromGUID2

  CoTaskMemFree

  CoTaskMemAlloc

  CoRevokeClassObject

  CoInitialize

  CoRegisterClassObject

  oleaut32

  SysStringLen

  LoadTypeLi

  SysFreeString

  RegisterTypeLi

  VarUI4FromStr

  UnRegisterTypeLi

  SysAllocString

  crypt32

  CertFindCertificateInStore

  CertFreeCertificateContext

  CertGetNameStringW

  CryptQueryObject

  CryptDecodeObject

  CertCloseStore

  CryptMsgGetParam

  CryptMsgClose

  wintrust

  WinVerifyTrust

  msvcr90

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _configthreadlocale

  _except_handler4_common

  _crt_debugger_hook

  _CxxThrowException

  ?_type_info_dtor_internal_method@type_info@@QAEXXZ

  _invoke_watson

  _controlfp_s

  __CxxFrameHandler3

  __set_app_type

  _initterm_e

  _initterm

  ??3@YAXPAX@Z

  wcsncpy_s

  ??_U@YAPAXI@Z

  memcmp

  free

  malloc

  vswprintf_s

  wcslen

  wcsstr

  _recalloc

  memset

  ??_V@YAXPAX@Z

  rand

  _itow_s

  srand

  rand_s

  memcpy_s

  _putws

  wcscat_s

  abs

  wcscpy_s

  _time64

  _wtoi

  swprintf_s

  ?terminate@@YAXXZ

  _unlock

  __dllonexit

  _encode_pointer

  _lock

  _onexit

  _decode_pointer

  _amsg_exit

  __wgetmainargs

  _cexit

  _exit

  _XcptFilter

  exit

  _wcmdln

  Sections

  .text

  Size: 46KB - Virtual size: 46KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE