cca7237801ca0e195338cf22edb5d4b0_NeikiAnalytics

Sharing

Copy URL

Twitter E-mail

General

Target

cca7237801ca0e195338cf22edb5d4b0_NeikiAnalytics
Size

41KB
MD5

cca7237801ca0e195338cf22edb5d4b0
SHA1

923ba1fa369e8acf4bb589d68d88b02fda32c857
SHA256

f3c7b84161e28d68a07105b925292bcfd968376532fe8b5a064771a7cb7d24f9
SHA512

a7b607a2431497eee35733622b5b00fdfce56452dcfdb82bdc76cce30af0ceaacd46cd730fac8e58d26c38070605e0e0ce986068bea7f75bcf1a038dbda948ae
SSDEEP

384:9poTU7zpHO9sXJtEuybqpBOjgA6n5xCvvJcCz2FkRBdXCnYPL0YUHeM+fUYmWFR6:boA7zGsXJOuIq3CgXx3Fk9XCzWU+/De

Score

1^/10

Malware Config

Signatures

Files

cca7237801ca0e195338cf22edb5d4b0_NeikiAnalytics
.sys windows:6 windows x86 arch:x86

1f6af70c9f6bfeb6cada77e36b37b3da

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

36:2a:d1:09:5b:a2:ef:78:9d:42:da:ef:f8:06:9b:65
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

01/12/2014, 00:00

Not After

30/11/2016, 23:59

Subject

CN=Suprema Inc.,O=Suprema Inc.,L=Seongnam-si,ST=Gyeonggi-do,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:3d:2e:1b:a2:0d:cd:a2:62:00:00:00:00:00:00:3d
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/01/2017, 18:25

Not After

12/04/2018, 18:25

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:f1:18:d3:fd:9f:bb:0c:da:c6:b3:36:d6:7b:ad:24:9c:36:b9:0a:fc:8a:c7:4d:1b:07:41:9c:9e:32:11:8a
Signer

Actual PE Digest

c8:f1:18:d3:fd:9f:bb:0c:da:c6:b3:36:d6:7b:ad:24:9c:36:b9:0a:fc:8a:c7:4d:1b:07:41:9c:9e:32:11:8a

Digest Algorithm

sha256

PE Digest Matches

true

84:ab:0c:a3:5a:4a:c1:a8:6d:49:cf:d9:fa:35:b6:57:8b:8d:3a:26
Signer

Actual PE Digest

84:ab:0c:a3:5a:4a:c1:a8:6d:49:cf:d9:fa:35:b6:57:8b:8d:3a:26

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\dev_data\code3_inter\suprema\windows7_091202\sfrusb\objfre_win7_x86\i386\SFRUSB.pdb

Imports

ntoskrnl.exe

IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
KeSetEvent
IoIsWdmVersionAvailable
ExAllocatePool
RtlInitUnicodeString
memcpy
IoDeleteDevice
IoDetachDevice
IoWMIRegistrationControl
ZwOpenKey
PoRequestPowerIrp
PsTerminateSystemThread
IoFreeIrp
PoCallDriver
KeWaitForSingleObject
memmove
ObReferenceObjectByHandle
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
IoRegisterDeviceInterface
PsCreateSystemThread
ZwClose
RtlFreeUnicodeString
IoSetDeviceInterfaceState
ObfDereferenceObject
RtlCopyUnicodeString
KeInitializeSpinLock
KeTickCount
KeBugCheckEx
IofCompleteRequest
ExFreePool
memset
KeDelayExecutionThread
ExAllocatePoolWithTag
PoStartNextPowerIrp
IoCreateDevice
IoAttachDeviceToDeviceStack
IoAllocateIrp
IoInitializeRemoveLockEx

wmilib.sys

WmiSystemControl

usbd.sys

USBD_CreateConfigurationRequestEx
USBD_ParseConfigurationDescriptorEx
USBD_GetUSBDIVersion

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 363B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1f6af70c9f6bfeb6cada77e36b37b3da

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

36:2a:d1:09:5b:a2:ef:78:9d:42:da:ef:f8:06:9b:65Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

33:00:00:00:3d:2e:1b:a2:0d:cd:a2:62:00:00:00:00:00:00:3dCertificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

c8:f1:18:d3:fd:9f:bb:0c:da:c6:b3:36:d6:7b:ad:24:9c:36:b9:0a:fc:8a:c7:4d:1b:07:41:9c:9e:32:11:8aSigner

84:ab:0c:a3:5a:4a:c1:a8:6d:49:cf:d9:fa:35:b6:57:8b:8d:3a:26Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

wmilib.sys

usbd.sys

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 512B - Virtual size: 363B

.data Size: 9KB - Virtual size: 8KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 920B

.reloc Size: 1024B - Virtual size: 964B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

36:2a:d1:09:5b:a2:ef:78:9d:42:da:ef:f8:06:9b:65
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

33:00:00:00:3d:2e:1b:a2:0d:cd:a2:62:00:00:00:00:00:00:3d
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

c8:f1:18:d3:fd:9f:bb:0c:da:c6:b3:36:d6:7b:ad:24:9c:36:b9:0a:fc:8a:c7:4d:1b:07:41:9c:9e:32:11:8a
Signer

84:ab:0c:a3:5a:4a:c1:a8:6d:49:cf:d9:fa:35:b6:57:8b:8d:3a:26
Signer

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 512B - Virtual size: 363B

.data
Size: 9KB - Virtual size: 8KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 1024B - Virtual size: 964B