8a3fdb96879b0e91ab46456704174b10_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8a3fdb96879b0e91ab46456704174b10_NeikiAnalytics.exe
Size

3.5MB
MD5

8a3fdb96879b0e91ab46456704174b10
SHA1

336cdfb37fff96532b06231a58a3605105472a38
SHA256

6575e653af8ea9a6cb6711ef2f6e19bd0d182c41dd5db432ebb973b0e60f8d3f
SHA512

159b2d34660862321e8acaac3021a831374bc85e50b692db5152ec0610be6fb36f624fd02ca57a61cbe5f9f2e96dc8244fbd0e1208c6476f0b3a388c6bb27102
SSDEEP

98304:EQcy/2ESizdyayDvV5xhl8V2I7jQrOl6OTT7H:En82ErzMaghl8VgrA6wn

Score

1^/10

Malware Config

Signatures

Files

8a3fdb96879b0e91ab46456704174b10_NeikiAnalytics.exe
.sys windows:10 windows x64 arch:x64

970a2e45d63ddf245f8d342112908ef6

Code Sign

33:00:00:00:43:3a:68:18:9e:33:90:29:87:00:00:00:00:00:43
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 22:25

Not After

02/12/2021, 22:25

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:30:b1:87:31:3b:3a:82:53:dc:79:c4:11:bb:b5:cb:d5:88:6b:31:67:eb:8b:39:a0:f8:32:2b:45:b2:fd:6f
Signer

Actual PE Digest

d2:30:b1:87:31:3b:3a:82:53:dc:79:c4:11:bb:b5:cb:d5:88:6b:31:67:eb:8b:39:a0:f8:32:2b:45:b2:fd:6f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntoskrnl.exe

ZwDeleteFile
_stricmp
ExAllocatePool
NtQuerySystemInformation
ExFreePoolWithTag
IoAllocateMdl
MmProbeAndLockPages
MmMapLockedPagesSpecifyCache
MmUnlockPages
IoFreeMdl
KeQueryActiveProcessors
KeSetSystemAffinityThread
KeRevertToUserAffinityThread
DbgPrint

hal

KeQueryPerformanceCounter
KeQueryPerformanceCounter
KeQueryPerformanceCounter

Sections

.text
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: - Virtual size: 795B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ESEA0
Size: - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ESEA1
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ESEA2
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

970a2e45d63ddf245f8d342112908ef6

Code Sign

33:00:00:00:43:3a:68:18:9e:33:90:29:87:00:00:00:00:00:43Certificate

Extended Key Usages

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0dCertificate

Key Usages

d2:30:b1:87:31:3b:3a:82:53:dc:79:c4:11:bb:b5:cb:d5:88:6b:31:67:eb:8b:39:a0:f8:32:2b:45:b2:fd:6fSigner

Headers

DLL Characteristics

File Characteristics

Imports

ntoskrnl.exe

hal

Sections

.text Size: - Virtual size: 64KB

.rdata Size: - Virtual size: 7KB

.data Size: - Virtual size: 33KB

.pdata Size: - Virtual size: 2KB

PAGE Size: - Virtual size: 795B

INIT Size: - Virtual size: 4KB

.ESEA0 Size: - Virtual size: 2.3MB

.ESEA1 Size: 2KB - Virtual size: 1KB

.ESEA2 Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 512B - Virtual size: 152B

33:00:00:00:43:3a:68:18:9e:33:90:29:87:00:00:00:00:00:43
Certificate

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

d2:30:b1:87:31:3b:3a:82:53:dc:79:c4:11:bb:b5:cb:d5:88:6b:31:67:eb:8b:39:a0:f8:32:2b:45:b2:fd:6f
Signer

.text
Size: - Virtual size: 64KB

.rdata
Size: - Virtual size: 7KB

.data
Size: - Virtual size: 33KB

.pdata
Size: - Virtual size: 2KB

PAGE
Size: - Virtual size: 795B

INIT
Size: - Virtual size: 4KB

.ESEA0
Size: - Virtual size: 2.3MB

.ESEA1
Size: 2KB - Virtual size: 1KB

.ESEA2
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 512B - Virtual size: 152B