60f92ac7d5aa74f5451a3844d14c27c0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

60f92ac7d5aa74f5451a3844d14c27c0_NeikiAnalytics
Size

21KB
MD5

60f92ac7d5aa74f5451a3844d14c27c0
SHA1

f23c65b2ce23d5b65dc664afd17280e99cf68fcb
SHA256

05366edd1fad2d3e4cac24fc83b087f19b6f9f10e4007442bf832d266a205f46
SHA512

1e0e2f200f534602a0b55adbdd8572ecf58ff45169f7fa75da8ff33ec7e16949ea27c2011db2ef8e5f833f5b2cd1ca2149edca8a65ddc7c9b995bfc51548c525
SSDEEP

384:yFlUskgTYVkt7bRJ/ZFq10KfJvaDorp3YJLWnk1bT6:SdkgTYGVbRBZFMvvasrULTb+

Score

1^/10

Malware Config

Signatures

Files

60f92ac7d5aa74f5451a3844d14c27c0_NeikiAnalytics
.sys windows:6 windows x86 arch:x86

971955f20be278ab6128ef55c0095d97

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3f:a8:fe:ed:52:d7:b4:d3:1b:94:e9:6b:a2:60:15:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

27/10/2006, 00:00

Not After

26/12/2007, 23:59

Subject

CN=Webroot Software\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Webroot Software\, Inc.,L=Boulder,ST=Colorado,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ac:48:44:4f:57:80:fb:fb:0e:91:8f:c4:0e:9f:b5:fa:cd:d4:02:71
Signer

Actual PE Digest

ac:48:44:4f:57:80:fb:fb:0e:91:8f:c4:0e:9f:b5:fa:cd:d4:02:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\windowwasher_scm\ww_6.5.5_rel\source\driver\sys\objfre_wlh_x86\i386\wrssweep.pdb

Imports

ntoskrnl.exe

IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
ExAllocatePoolWithTag
IoGetRelatedDeviceObject
IoGetDeviceObjectPointer
PsGetCurrentProcessId
ExFreePoolWithTag
ObfDereferenceObject
IoFreeMdl
MmUnlockPages
KeWaitForSingleObject
IofCallDriver
IoBuildSynchronousFsdRequest
KeInitializeEvent
MmProbeAndLockPages
IoAllocateMdl
MmIsAddressValid
IoCreateSymbolicLink
KeTickCount
RtlUnwind
MmGetSystemRoutineAddress
ZwClose
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
RtlLengthSid
memcpy
memset
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
RtlFreeUnicodeString
KeBugCheckEx

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 530B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

971955f20be278ab6128ef55c0095d97

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

3f:a8:fe:ed:52:d7:b4:d3:1b:94:e9:6b:a2:60:15:72Certificate

Extended Key Usages

Key Usages

ac:48:44:4f:57:80:fb:fb:0e:91:8f:c4:0e:9f:b5:fa:cd:d4:02:71Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 424B

PAGE Size: 6KB - Virtual size: 6KB

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 530B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

3f:a8:fe:ed:52:d7:b4:d3:1b:94:e9:6b:a2:60:15:72
Certificate

ac:48:44:4f:57:80:fb:fb:0e:91:8f:c4:0e:9f:b5:fa:cd:d4:02:71
Signer

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 424B

PAGE
Size: 6KB - Virtual size: 6KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 530B