a8035a09b7eec97317b8ded8e8c07440_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

a8035a09b7eec97317b8ded8e8c07440_NeikiAnalytics
Size

73KB
MD5

a8035a09b7eec97317b8ded8e8c07440
SHA1

f7f1d80af6bf79f5d6c7c63cd48199348689abe0
SHA256

47d8512186468d35da80d1860258f1c02a644259f4adfcd37a643cfc996c0400
SHA512

5cb215ed7493cc2959ab2c32ad227331c7fac0ff777ce68f006898c06e9ff08203b9e9c5b055f530f68c6381480aa8c1ac3e78184750353de1a2b703e9e76130
SSDEEP

768:qwGJpif3Da3sNNhxL6+fURO623IuEjPhGT2DZTlDrHW0HbZuPKDHB:KJMfekb+RuINPIiDnvuPKDHB

Score

1^/10

Malware Config

Signatures

Files

a8035a09b7eec97317b8ded8e8c07440_NeikiAnalytics
.sys windows:10 windows x64 arch:x64

7cd6b01c0014f531c9f538bd97df4f98

Code Sign

5b:ca:77:1d:06:6e:ec:b1:46:7d:4b:39:b3:d3:f3:f7
Certificate

Issuer

CN=WDKTestCert Johnson\,133564948863716390

Not Before

02-04-2024 01:28

Not After

02-04-2034 00:00

Subject

CN=WDKTestCert Johnson\,133564948863716390

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageKeyEncipherment
KeyUsageDataEncipherment

f3:a1:96:60:16:7b:ec:38:13:f5:ea:83:27:39:a5:0d:52:c9:89:de:a6:d3:fd:ac:1e:72:43:88:f7:cb:3e:b0
Signer

Actual PE Digest

f3:a1:96:60:16:7b:ec:38:13:f5:ea:83:27:39:a5:0d:52:c9:89:de:a6:d3:fd:ac:1e:72:43:88:f7:cb:3e:b0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Johnson\source\repos\minispy\filter\x64\Release\WM7F.pdb

Imports

ntoskrnl.exe

ZwCreateKey
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
ZwClose
__chkstk
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ObfDereferenceObject
PsGetCurrentProcessId
PsGetCurrentThreadId
PsGetVersion
ExDeleteLookasideListEx
ExInitializeLookasideListEx
ExFreePoolWithTag
ExAllocatePoolWithTag
KeInitializeSpinLock
RtlSetDaclSecurityDescriptor
RtlFreeUnicodeString
RtlCopyUnicodeString
RtlCompareUnicodeString
RtlInitUnicodeString
RtlUnicodeStringToInteger
__C_specific_handler
wcschr

fltmgr.sys

FltFreeSecurityDescriptor
FltBuildDefaultSecurityDescriptor
FltCloseClientPort
FltCloseCommunicationPort
FltCreateCommunicationPort
FltGetVolumeProperties
FltReleaseContext
FltGetInstanceContext
FltSetInstanceContext
FltAllocateContext
FltGetRoutineAddress
FltStartFiltering
FltUnregisterFilter
FltRegisterFilter
FltGetDeviceObject

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 604B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7cd6b01c0014f531c9f538bd97df4f98

Code Sign

5b:ca:77:1d:06:6e:ec:b1:46:7d:4b:39:b3:d3:f3:f7Certificate

Extended Key Usages

Key Usages

f3:a1:96:60:16:7b:ec:38:13:f5:ea:83:27:39:a5:0d:52:c9:89:de:a6:d3:fd:ac:1e:72:43:88:f7:cb:3e:b0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

fltmgr.sys

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 3KB - Virtual size: 1.5MB

.pdata Size: 1KB - Virtual size: 1KB

PAGE Size: 13KB - Virtual size: 13KB

INIT Size: 9KB - Virtual size: 9KB

INIT Size: 512B - Virtual size: 256B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 604B

5b:ca:77:1d:06:6e:ec:b1:46:7d:4b:39:b3:d3:f3:f7
Certificate

f3:a1:96:60:16:7b:ec:38:13:f5:ea:83:27:39:a5:0d:52:c9:89:de:a6:d3:fd:ac:1e:72:43:88:f7:cb:3e:b0
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 3KB - Virtual size: 1.5MB

.pdata
Size: 1KB - Virtual size: 1KB

PAGE
Size: 13KB - Virtual size: 13KB

INIT
Size: 9KB - Virtual size: 9KB

INIT
Size: 512B - Virtual size: 256B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 604B