6a382571d619c38029362242c323e490_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

6a382571d619c38029362242c323e490_NeikiAnalytics
Size

234KB
MD5

6a382571d619c38029362242c323e490
SHA1

f32195e2e547d0ad36f71e6d8a8f17bdcfd1bb12
SHA256

134008c48ad23375f3c5f07ba26c707b31290e2d9806f071c3dc651c8bfffb7a
SHA512

c2c4ca82c8e3476c3e6d55e7efd9891b10c8fa2f4ce51352a5119be68b11505d02055dcc916fea00565c15fd77e4b0af48f4fc798e12edddd1e539cdba41123d
SSDEEP

1536:zxrFNX+T1XxIpIgcoh1QpMk4hFsIS3HbbJTp1gMm5uLwDIzfI9FfckGFZwPjhre:trFNX+xBUjPhuHXvSOm2YUJHwPE

Score

1^/10

Malware Config

Signatures

Files

6a382571d619c38029362242c323e490_NeikiAnalytics
.sys windows:5 windows x86 arch:x86

5b9436b0dfef046d606329a710cf1b65

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:bf:e2:15:6e:8a:c4:9d:02:6f:80:eb:66:9f:e4:08
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-04-2009 00:00

Not After

24-05-2012 23:59

Subject

CN=Raxco Software\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Raxco Software\, Inc.,L=Gaithersburg,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

84:64:ca:bf:26:8e:f3:18:37:c6:28:60:61:2f:f8:37:6a:ef:ca:cd
Signer

Actual PE Digest

84:64:ca:bf:26:8e:f3:18:37:c6:28:60:61:2f:f8:37:6a:ef:ca:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\PerfectDisk_v12\Dev\binaries\Win32\Release\PDBoot.pdb

Imports

ntdll

NtWaitForSingleObject
NtDeviceIoControlFile
NtFsControlFile
NtCreateFile
RtlInitUnicodeString
NtClose
RtlNtStatusToDosError
NtCreateEvent
_allmul
_alldiv
NtReadFile
_chkstk
NtWriteFile
strncmp
_snwprintf
_aulldiv
memcpy
wcscmp
wcsncpy
wcslen
wcscpy
strncpy
strlen
strchr
memset
NtWaitForMultipleObjects
towupper
NtTerminateProcess
wcscat
NtShutdownSystem
NtAdjustPrivilegesToken
NtOpenProcessToken
_allrem
toupper
RtlFindSetBitsAndClear
RtlClearBits
RtlInitializeBitMap
_wcsicmp
NtDisplayString
sprintf
wcsstr
iswalpha
RtlFindLongestRunClear
RtlFindClearBitsAndSet
RtlSetBits
tolower
NtQueryDirectoryFile
RtlCreateHeap
RtlAllocateHeap
RtlFreeHeap
NtOpenKey
NtQueryValueKey
NtSetValueKey
NtEnumerateValueKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
NtSetInformationFile
NtQueryInformationFile
NtDeleteFile
NtFlushBuffersFile
NtQueryVolumeInformationFile
RtlUpcaseUnicodeString
strcpy
RtlUnicodeStringToOemString

Exports

Exports

_DefragCancelVerifyVolume@8
_DefragClearBootMountIntent@8
_DefragDebugMessage@8
_DefragOfflineComplete@4
_DefragOfflineMoveFile@40
_DefragOnlineMoveFile@28
_DefragOnlineQueryExtentInformation@24
_DefragOpenFile@20
_DefragOpenVolume@16
_DefragOpenVolumeEx@16
_DefragPDBootComplete@0
_DefragQueryAllInformation@52
_DefragQueryAllocationBitmap@24
_DefragQueryAttributeDefinitions@16
_DefragQueryAttributeName@28
_DefragQueryDllVersion@8
_DefragQueryDriverVersion@16
_DefragQueryExtentInformationEx@44
_DefragQueryFileId@12
_DefragQueryMftBitmap@28
_DefragQueryNameInformation@28
_DefragQueryNonResidentAttributes@24
_DefragQueryNonResidentAttributesEx@20
_DefragQueryNtfsInfo@8
_DefragQueryVolumeState@20
_DefragReboot@0
_DefragSetBootMountIntent@12
_DefragSpecifyDebugFile@16
_DefragTruncateFile@8
_DefragUnloadIntent@0
_DefragVerifyVolume@8
_DefragWaitVerifyVolume@8
_DefragZeroFile@8

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 146KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b9436b0dfef046d606329a710cf1b65

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

5d:bf:e2:15:6e:8a:c4:9d:02:6f:80:eb:66:9f:e4:08Certificate

Extended Key Usages

Key Usages

84:64:ca:bf:26:8e:f3:18:37:c6:28:60:61:2f:f8:37:6a:ef:ca:cdSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

Exports

Exports

Sections

.text Size: 75KB - Virtual size: 74KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 146KB - Virtual size: 148KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

5d:bf:e2:15:6e:8a:c4:9d:02:6f:80:eb:66:9f:e4:08
Certificate

84:64:ca:bf:26:8e:f3:18:37:c6:28:60:61:2f:f8:37:6a:ef:ca:cd
Signer

.text
Size: 75KB - Virtual size: 74KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 146KB - Virtual size: 148KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB