Static task
static1
General
-
Target
34b9d78699ba3c9919fec36b154d2030_NeikiAnalytics.exe
-
Size
37KB
-
MD5
34b9d78699ba3c9919fec36b154d2030
-
SHA1
32702bc8b4462705e0e4bf3b730e916b41856b2b
-
SHA256
1a51995187fdf7f4893955bc2ad171da4fe2d20f965ae1ce1913ea38be9774fe
-
SHA512
1fa4afbb1eb3a344c54bc1b098b99e2428cd3f25bdc8041b5072eea88cfddf3d739b2da4c6f7795fe6214f8709b50605cab422cd1ca3762e414ddfd47aa42fc6
-
SSDEEP
768:nP38uiFao+EJZIw2g1NDRzlo4f94oe/wJ64QFQFDjo7xp7Tw8Rc/3zDjLe/:nP8lAo/JN2g1NDRzllyQzLo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 34b9d78699ba3c9919fec36b154d2030_NeikiAnalytics.exe
Files
-
34b9d78699ba3c9919fec36b154d2030_NeikiAnalytics.exe.sys windows:4 windows x86 arch:x86
356eb237f75b00fde2685d0ef7a31dee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
MmGetPhysicalAddress
IoReportResourceUsage
MmUnmapIoSpace
ZwClose
ZwMapViewOfSection
ObReferenceObjectByHandle
ZwOpenSection
WRITE_REGISTER_UCHAR
WRITE_REGISTER_USHORT
READ_REGISTER_USHORT
atoi
isdigit
strstr
RtlUnicodeStringToAnsiString
RtlQueryRegistryValues
RtlFreeAnsiString
RtlInitAnsiString
IoWriteErrorLogEntry
memmove
IoAllocateErrorLogEntry
ZwUnmapViewOfSection
IoDeleteSymbolicLink
ExAllocatePoolWithTag
Ke386SetIoAccessMap
Ke386IoSetAccessProcess
IoGetCurrentProcess
MmAllocateNonCachedMemory
MmFreeNonCachedMemory
KeInitializeEvent
IoDisconnectInterrupt
KeSetEvent
KeRemoveQueueDpc
KeClearEvent
IoConnectInterrupt
KeInitializeDpc
KeInsertQueueDpc
PsGetCurrentProcessId
PsTerminateSystemThread
ObfDereferenceObject
PsCreateSystemThread
KeGetCurrentThread
IofCompleteRequest
RtlInitUnicodeString
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
MmMapIoSpace
KeInitializeSpinLock
sprintf
KeResetEvent
KeWaitForSingleObject
DbgPrint
READ_REGISTER_UCHAR
_alldiv
READ_REGISTER_ULONG
WRITE_REGISTER_ULONG
_allmul
ExFreePool
wcscat
hal
HalGetInterruptVector
HalAllocateCommonBuffer
HalGetAdapter
HalFreeCommonBuffer
KfAcquireSpinLock
KfReleaseSpinLock
READ_PORT_ULONG
READ_PORT_USHORT
READ_PORT_UCHAR
WRITE_PORT_USHORT
WRITE_PORT_UCHAR
HalSetBusDataByOffset
HalGetBusData
HalGetBusDataByOffset
KeQueryPerformanceCounter
HalTranslateBusAddress
WRITE_PORT_ULONG
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 32B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 864B - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ