Static task
static1
General
-
Target
7fe929b4c96192302019e6bffa76abe0_NeikiAnalytics
-
Size
1.0MB
-
MD5
7fe929b4c96192302019e6bffa76abe0
-
SHA1
81730f4f21c2e0d520b4c43fb082ccf8982bdc54
-
SHA256
a5521dfaf568f1c3d04ff1030dff28c8e45852ad41d548e77e3087e5aa2630bd
-
SHA512
d3cb9cd9ceeea2c6994aacd87fc523c57e70cae5a7c40551babb94a0819211da4beabe6bbe872d6a207a9f8fe54ea13afee098c4becfd5da3a73fa376f68055c
-
SSDEEP
24576:NXgItDb1NTSceM0pTHrD9sdOBA1sITLzp3Jl8FYt3VIc6mEOrs5lNyT:9gq1NTxoPCdIA1sITLl3oKJ6mEO2ly
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7fe929b4c96192302019e6bffa76abe0_NeikiAnalytics
Files
-
7fe929b4c96192302019e6bffa76abe0_NeikiAnalytics.sys windows:10 windows x64 arch:x64
d5e90601da448613a1aa254ac5f0ae08
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
RtlInitAnsiString
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAnsiStringToUnicodeString
KeLowerIrql
KfRaiseIrql
ExAllocatePool
ExFreePoolWithTag
MmProbeAndLockPages
MmUnlockPages
MmProtectMdlSystemAddress
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoFreeMdl
IoGetCurrentProcess
ObfDereferenceObject
MmCopyMemory
PsLookupProcessByProcessId
PsGetProcessSectionBaseAddress
MmCopyVirtualMemory
ObReferenceObjectByName
IoCreateDriver
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 844B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1024B - Virtual size: 844B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.n.? Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ