a74a5f02bd404c85319dbad7c8806e60_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

a74a5f02bd404c85319dbad7c8806e60_NeikiAnalytics
Size

73KB
MD5

a74a5f02bd404c85319dbad7c8806e60
SHA1

f4e79d4119a09af3d3ca80f24f91dd917c7f40f0
SHA256

9252f746288e6035e0fe7cfbf8c76c4d265d6dc01c7638ccfea0c28414b4ff89
SHA512

488d3ef4f14ba3f46f4f1afc5b502ea452e7c942e212c4324a85396fd55091c8c6c85731cfa64666d869c9848db0543c7538f7bd8d52c7f0192d7a4e9c27d949
SSDEEP

768:+gpWjC04DOXZGPFiEzkwZp10hEZ7asrksn1Py9n6K9zL:N4jC04HFwiLN7hhPy9nXzL

Score

1^/10

Malware Config

Signatures

Files

a74a5f02bd404c85319dbad7c8806e60_NeikiAnalytics
.sys windows:10 windows x64 arch:x64

217267fc5107c477bc70088ed55f17af

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/09/2021, 18:23

Not After

01/09/2022, 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

63:32:3c:d7:10:e7:e3:9d:d4:2e:84:25:d6:67:f2:56:84:6a:51:9b:d7:15:04:bd:c8:50:3a:4e:df:6b:31:3f
Signer

Actual PE Digest

63:32:3c:d7:10:e7:e3:9d:d4:2e:84:25:d6:67:f2:56:84:6a:51:9b:d7:15:04:bd:c8:50:3a:4e:df:6b:31:3f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

ramdisk.pdb

Imports

ntoskrnl.exe

IoAcquireRemoveLockEx
IofCompleteRequest
KeEnterCriticalRegion
ExAcquireFastMutex
ExReleaseFastMutex
KeLeaveCriticalRegion
IoSetDeviceInterfaceState
IoReleaseRemoveLockEx
IoInvalidateDeviceRelations
KeQueryHighestNodeNumber
KeQueryNodeActiveAffinity
KeSetSystemGroupAffinityThread
MmAllocatePagesForMdlEx
KeRevertToUserGroupAffinityThread
MmMapLockedPagesSpecifyCache
MmFreePagesFromMdl
MmUnmapLockedPages
RtlInitUnicodeString
IoCreateFile
ZwQueryInformationFile
ZwCreateSection
ZwClose
ObReferenceObjectByHandle
MmSectionObjectType
ExAllocatePool2
RtlStringFromGUID
_vsnwprintf
RtlCreateUnicodeString
IoCreateDevice
IoCreateSymbolicLink
ExFreePoolWithTag
KeInitializeEvent
IoInitializeRemoveLockEx
KeInitializeSemaphore
RtlCompareMemory
ObfDereferenceObject
IofCallDriver
KeWaitForSingleObject
IoRegisterDeviceInterface
IoGetDeviceProperty
PoStartNextPowerIrp
PoCallDriver
IoDeleteDevice
IoAttachDeviceToDeviceStack
RtlFreeUnicodeString
ZwOpenKey
ZwQueryValueKey
IoReleaseRemoveLockAndWaitEx
MmUnmapViewOfSection
PsGetCurrentProcess
IoDeleteSymbolicLink
KeSetEvent
ObfReferenceObject
IoDetachDevice
RtlCopyUnicodeString
IoReportDetectedDevice
IoFreeWorkItem
RtlQueryRegistryValuesEx
_wcsnicmp
_wcsupr
wcsstr
RtlCheckRegistryKey
RtlInitUnicodeStringEx
RtlInitString
IoAllocateWorkItem
IoQueueWorkItem
MmMapViewOfSection
MmMapIoSpaceEx
KeReleaseSemaphore
MmUnmapIoSpace
ZwFlushVirtualMemory

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GFIDS
Size: 4KB - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

217267fc5107c477bc70088ed55f17af

Code Sign

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3cCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

63:32:3c:d7:10:e7:e3:9d:d4:2e:84:25:d6:67:f2:56:84:6a:51:9b:d7:15:04:bd:c8:50:3a:4e:df:6b:31:3fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 8KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 320B

.pdata Size: 4KB - Virtual size: 708B

.idata Size: 4KB - Virtual size: 2KB

PAGE Size: 16KB - Virtual size: 14KB

fothk Size: 4KB - Virtual size: 4KB

INIT Size: 4KB - Virtual size: 1KB

GFIDS Size: 4KB - Virtual size: 76B

.rsrc Size: 4KB - Virtual size: 1008B

.reloc Size: 4KB - Virtual size: 1KB

33:00:00:03:3c:89:c6:6a:7b:45:bb:1f:bd:00:00:00:00:03:3c
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

63:32:3c:d7:10:e7:e3:9d:d4:2e:84:25:d6:67:f2:56:84:6a:51:9b:d7:15:04:bd:c8:50:3a:4e:df:6b:31:3f
Signer

.text
Size: 8KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 320B

.pdata
Size: 4KB - Virtual size: 708B

.idata
Size: 4KB - Virtual size: 2KB

PAGE
Size: 16KB - Virtual size: 14KB

fothk
Size: 4KB - Virtual size: 4KB

INIT
Size: 4KB - Virtual size: 1KB

GFIDS
Size: 4KB - Virtual size: 76B

.rsrc
Size: 4KB - Virtual size: 1008B

.reloc
Size: 4KB - Virtual size: 1KB