TsUsbGD.pdb
Static task
static1
General
-
Target
25a493938b93fda65011d783f371b770_NeikiAnalytics.exe
-
Size
68KB
-
MD5
25a493938b93fda65011d783f371b770
-
SHA1
43960d7d94724908bf012f988f8303eba6bafe06
-
SHA256
808e86d5bf838cb4e23a9fc5d369b04dc126faa2350629b33c1dc4b71278b55f
-
SHA512
c0add23521b641196639dd80a95355ea115f34afc5b8399a73ee8294cee92ed7e6bc7f0cad1b8b060e86c016c606e398db5ce6614611aa5bf5c1f0edf66749c1
-
SSDEEP
768:CT2eAsWazaCqf/nPULegoUDl/YY3HMD0iVV3:C7A3P/nGl/YYch
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25a493938b93fda65011d783f371b770_NeikiAnalytics.exe
Files
-
25a493938b93fda65011d783f371b770_NeikiAnalytics.exe.sys windows:10 windows x64 arch:x64
37fadb9c3a4e57828526587fd5d784ff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
IoAllocateMdl
MmUnlockPages
IoFreeMdl
ObReferenceObjectByHandle
IoFileObjectType
RtlInitUnicodeString
MmGetSystemRoutineAddress
IoWMIRegistrationControl
KeGetCurrentIrql
ExAllocatePoolWithTag
DbgPrintEx
RtlCopyUnicodeString
ExFreePool
MmMapLockedPagesSpecifyCache
__C_specific_handler
MmProbeAndLockPages
RtlGUIDFromString
IoGetCurrentProcess
ObfDereferenceObject
ExFreePoolWithTag
KeBugCheckEx
wdfldr.sys
WdfVersionUnbindClass
WdfVersionBind
WdfLdrQueryInterface
WdfVersionUnbind
WdfVersionBindClass
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
fothk Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
GFIDS Size: 4KB - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ