82a8e2a674794d5ffa93f3e6fe2fd700_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

82a8e2a674794d5ffa93f3e6fe2fd700_NeikiAnalytics
Size

254KB
MD5

82a8e2a674794d5ffa93f3e6fe2fd700
SHA1

767c8ab4fab16d8e378c3f99b0f88e95c382d9c2
SHA256

c7793ba15d9a11048d6ebb8a55b9e09140566c294501d8a7b379e01128176e73
SHA512

c1b8aff83a77c312f7c4106690eb7fef577717760ab22d58499ecbd2ec6193c6a3f3e6518a2d43712d0b239fd56c2b471772bbdc98770bc7149048306bb28293
SSDEEP

6144:F5v5PQOeAOi1BCvQKkLIaj8CW/a/yTsWuww/XTZ+3z/:BrzH1BCo0cqTsjT4/

Score

1^/10

Malware Config

Signatures

Files

82a8e2a674794d5ffa93f3e6fe2fd700_NeikiAnalytics
.sys windows:6 windows x64 arch:x64

de54b47273779089f124854a16635ef3

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:eb:27:cc:4d:cf:d7:17:db:90:99:d9:ba:f6:9d:16:8e:ae:93:76:cb:04:32:b4:99:a6:81:bc:f8:db:77:ec
Signer

Actual PE Digest

0c:eb:27:cc:4d:cf:d7:17:db:90:99:d9:ba:f6:9d:16:8e:ae:93:76:cb:04:32:b4:99:a6:81:bc:f8:db:77:ec

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

amdsbs.pdb

Imports

ntoskrnl.exe

DbgPrint
ExSystemTimeToLocalTime
MmUnmapIoSpace
KfRaiseIrql
MmMapIoSpace
KeLowerIrql
ExAllocatePoolWithTag
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
KeInitializeEvent
RtlQueryRegistryValues
RtlAppendUnicodeStringToString
IofCompleteRequest
RtlWriteRegistryValue
IoEnumerateDeviceObjectList
RtlCreateRegistryKey
IofCallDriver
IoGetAttachedDevice
KeQueryTimeIncrement
__chkstk
strcmp

storport.sys

StorPortResumeDevice
StorPortSetBusDataByOffset
StorPortStallExecution
StorPortGetPhysicalAddress
StorPortDeviceReady
StorPortBusy
StorPortResume
StorPortReady
StorPortDeviceBusy
StorPortPauseDevice
StorPortGetDeviceBase
StorPortSetDeviceQueueDepth
StorPortLogError
StorPortPause
StorPortInitialize
StorPortGetUncachedExtension
StorPortExtendedFunction
ScsiPortNotification
StorPortNotification
StorPortGetBusData

Sections

.text
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

de54b47273779089f124854a16635ef3

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

0c:eb:27:cc:4d:cf:d7:17:db:90:99:d9:ba:f6:9d:16:8e:ae:93:76:cb:04:32:b4:99:a6:81:bc:f8:db:77:ecSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

storport.sys

Sections

.text Size: 221KB - Virtual size: 221KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 1KB - Virtual size: 149KB

.pdata Size: 7KB - Virtual size: 7KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 204B

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

0c:eb:27:cc:4d:cf:d7:17:db:90:99:d9:ba:f6:9d:16:8e:ae:93:76:cb:04:32:b4:99:a6:81:bc:f8:db:77:ec
Signer

.text
Size: 221KB - Virtual size: 221KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 1KB - Virtual size: 149KB

.pdata
Size: 7KB - Virtual size: 7KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 204B