1aabe87958d8cc241e8ec80ac52181f0_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

1aabe87958d8cc241e8ec80ac52181f0_NEIKI
Size

53KB
MD5

1aabe87958d8cc241e8ec80ac52181f0
SHA1

0ada7b3b2173ccb50743d37d86820e02da4cf293
SHA256

172289016ae864671bde36770fc356e0eaf4aeb365d5a380b607f0c0770e0631
SHA512

a752206102cd79a2af13a3034fe29183db433c68f0e7bbeba232dd926be0792b0b88e5a1bbc2f3e8a83eca96a56f88a879e702f0c6410afe199d53bf01539a5c
SSDEEP

768:cr8Dz1uw3ueD7aRgZ7vguSK/Ojnqpw2F6fOZEC2hB5AJxo0TuGLFm2b:cIV7aiAKRvYfOHe5AJy0TfoK

Score

1^/10

Malware Config

Signatures

Files

1aabe87958d8cc241e8ec80ac52181f0_NEIKI
.sys windows:6 windows x64 arch:x64

6ce4107871a4134b386437476d522e63

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

73:12:89:2b:88:e5:53:70:3b:a1:91:f6:d0:4e:18:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07/07/2011, 00:00

Not After

06/07/2014, 23:59

Subject

CN=Beijing Guanhua Jiexun Technology Development Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Guanhua Jiexun Technology Development Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ee:1c:68:0b:83:fa:e6:15:69:14:c6:2b:85:32:82:1f:5b:30:cf:29
Signer

Actual PE Digest

ee:1c:68:0b:83:fa:e6:15:69:14:c6:2b:85:32:82:1f:5b:30:cf:29

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_WDM_DRIVER

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\gh-cg\x2000\x2000a\v1.0\soft\win7\x2000\io2100-new\driver\objfre_win7_amd64\amd64\io2100.pdb

Imports

ntoskrnl.exe

KeEnterCriticalRegion
KeWaitForSingleObject
KeClearEvent
PoRequestPowerIrp
KeSetEvent
KeLeaveCriticalRegion
IoCancelIrp
IoAllocateWorkItem
IoQueueWorkItem
IoFreeWorkItem
RtlInitUnicodeString
ExAllocatePoolWithTag
ExFreePool
DbgPrint
RtlCopyUnicodeString
IoIsWdmVersionAvailable
IoCreateDevice
KeInitializeEvent
KeInitializeDpc
IoDeleteDevice
PoSetPowerState
IoAttachDeviceToDeviceStack
PoCallDriver
IoDetachDevice
MmMapIoSpace
IoDisconnectInterrupt
IoFreeMdl
MmUnmapIoSpace
MmUnmapLockedPages
IofCallDriver
IoGetAttachedDeviceReference
IoBuildSynchronousFsdRequest
ObfDereferenceObject
IoWMIRegistrationControl
IoAllocateMdl
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
ExAcquireFastMutex
ExReleaseFastMutex
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
IoDeleteSymbolicLink
PoStartNextPowerIrp
KeBugCheckEx
IofCompleteRequest
IoCreateSymbolicLink
RtlUnicodeToMultiByteN
RtlAnsiCharToUnicodeChar
__C_specific_handler

wmilib.sys

WmiSystemControl
WmiCompleteRequest

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 896B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 128B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ce4107871a4134b386437476d522e63

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

73:12:89:2b:88:e5:53:70:3b:a1:91:f6:d0:4e:18:9fCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

ee:1c:68:0b:83:fa:e6:15:69:14:c6:2b:85:32:82:1f:5b:30:cf:29Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

wmilib.sys

Sections

.text Size: 29KB - Virtual size: 29KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 8KB - Virtual size: 8KB

.pdata Size: 896B - Virtual size: 852B

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 128B - Virtual size: 96B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

73:12:89:2b:88:e5:53:70:3b:a1:91:f6:d0:4e:18:9f
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

ee:1c:68:0b:83:fa:e6:15:69:14:c6:2b:85:32:82:1f:5b:30:cf:29
Signer

.text
Size: 29KB - Virtual size: 29KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 8KB - Virtual size: 8KB

.pdata
Size: 896B - Virtual size: 852B

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 128B - Virtual size: 96B