bfe18d7040417b357b8e67d604b6d6c0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

bfe18d7040417b357b8e67d604b6d6c0_NeikiAnalytics
Size

128KB
MD5

bfe18d7040417b357b8e67d604b6d6c0
SHA1

86b9acdc490a274a2d194582ee2d6a6acfcfc808
SHA256

3c898a40df02d49a6b1a93b73852c2180499f8d0c98d371b92f6510dd2b73ee9
SHA512

cdb62e80c95eb69a497bb090002edb285c7017e35513819176dc2e819eb8ee735be32feea6619540a7176fd8cf0326f70ecfb4181277f3cf9c9c3e1f9fdb327d
SSDEEP

3072:E51ZZybaOfkcS6ARiCQmRpzo6d+2XCmkVdAwNHWU0N/d:E5zZybaOfkcS6ARiCQmRpzo6d+2XCmkY

Score

1^/10

Malware Config

Signatures

Files

bfe18d7040417b357b8e67d604b6d6c0_NeikiAnalytics
.sys windows:6 windows x64 arch:x64

924d971354f56a4416e9453f10f03357

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:93:e4:1d:d2:55:96:22:67:d7:c0:4a
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

21/04/2021, 13:55

Not After

31/12/2023, 14:00

Subject

CN=Bromium\, Inc.,O=Bromium\, Inc.,L=Cupertino,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

06/04/2022, 07:44

Not After

08/05/2033, 07:44

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:58:e7:c5:89:c0:68:dc:a7:27:00:00:00:00:00:58
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a5:66:b3:b2:5d:d8:28:44:e1:79:86:3e:30:00:f6:d4:e5:f9:8e:a5:8f:55:93:67:1d:87:be:e1:de:e5:b9:0b
Signer

Actual PE Digest

a5:66:b3:b2:5d:d8:28:44:e1:79:86:3e:30:00:f6:d4:e5:f9:8e:a5:8f:55:93:67:1d:87:be:e1:de:e5:b9:0b

Digest Algorithm

sha256

PE Digest Matches

false

a5:66:b3:b2:5d:d8:28:44:e1:79:86:3e:30:00:f6:d4:e5:f9:8e:a5:8f:55:93:67:1d:87:be:e1:de:e5:b9:0b
Signer

Actual PE Digest

a5:66:b3:b2:5d:d8:28:44:e1:79:86:3e:30:00:f6:d4:e5:f9:8e:a5:8f:55:93:67:1d:87:be:e1:de:e5:b9:0b

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins\DSL_win_uxen_build_magic\xen\build\vm-support\windows\uxenstor\uxenstor.pdb

Imports

uxenv4vlib.sys

uxen_v4v_cancel_async
uxen_v4vlib_set_resume_dpc
uxen_v4v_ring_free
uxen_v4v_ring_bind
uxen_v4v_notify
uxen_v4v_sendv_from_ring_async

uxenkdebuglib.sys

uxendebug_out

ntoskrnl.exe

IofCallDriver
KeBugCheckEx
InitSafeBootMode
PoStartNextPowerIrp
IoCsqInitialize
IoReleaseRemoveLockAndWaitEx
IoInitializeRemoveLockEx
IoDetachDevice
IoDeleteDevice
DbgPrintEx
KeGetCurrentIrql
_vsnprintf
KdDebuggerEnabled
KeAcquireSpinLockAtDpcLevel
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeReleaseSpinLockFromDpcLevel
ExAcquireSpinLockShared
ExReleaseSpinLockShared
ExAcquireSpinLockExclusiveAtDpcLevel
ExReleaseSpinLockExclusiveFromDpcLevel
MmMapLockedPagesSpecifyCache
IoAttachDeviceToDeviceStack
IofCompleteRequest
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
IoCsqInsertIrp
IoCsqRemoveNextIrp
ExAllocatePoolWithTag
ExFreePoolWithTag
KeInitializeDpc
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
MmMapIoSpace
MmUnmapIoSpace
IoCreateDevice

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 492B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

924d971354f56a4416e9453f10f03357

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

69:93:e4:1d:d2:55:96:22:67:d7:c0:4aCertificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1dCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

33:00:00:00:58:e7:c5:89:c0:68:dc:a7:27:00:00:00:00:00:58Certificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

a5:66:b3:b2:5d:d8:28:44:e1:79:86:3e:30:00:f6:d4:e5:f9:8e:a5:8f:55:93:67:1d:87:be:e1:de:e5:b9:0bSigner

a5:66:b3:b2:5d:d8:28:44:e1:79:86:3e:30:00:f6:d4:e5:f9:8e:a5:8f:55:93:67:1d:87:be:e1:de:e5:b9:0bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

uxenv4vlib.sys

uxenkdebuglib.sys

ntoskrnl.exe

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 3KB - Virtual size: 4KB

.pdata Size: 512B - Virtual size: 492B

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 436B

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

69:93:e4:1d:d2:55:96:22:67:d7:c0:4a
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

01:c2:9c:7a:f4:7a:a6:02:58:0e:af:32:b1:23:b1:1d
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

33:00:00:00:58:e7:c5:89:c0:68:dc:a7:27:00:00:00:00:00:58
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

a5:66:b3:b2:5d:d8:28:44:e1:79:86:3e:30:00:f6:d4:e5:f9:8e:a5:8f:55:93:67:1d:87:be:e1:de:e5:b9:0b
Signer

a5:66:b3:b2:5d:d8:28:44:e1:79:86:3e:30:00:f6:d4:e5:f9:8e:a5:8f:55:93:67:1d:87:be:e1:de:e5:b9:0b
Signer

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 3KB - Virtual size: 4KB

.pdata
Size: 512B - Virtual size: 492B

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 436B