176cb087421ccb0dd2813d58cd27b4ee745d6a9d8581a6519f5ab2ae0ba2a140_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

176cb087421ccb0dd2813d58cd27b4ee745d6a9d8581a6519f5ab2ae0ba2a140_NeikiAnalytics.exe
Size

86KB
MD5

47955fb05dd59f4dd80f69073f3c04a0
SHA1

5ae4308c1936b6dbd84c7012c0a2f598bab6bdc7
SHA256

176cb087421ccb0dd2813d58cd27b4ee745d6a9d8581a6519f5ab2ae0ba2a140
SHA512

f9455e05f620cad75469bed9c138ff827c4b69ade49a8cdcb06df2fab2bbb2cd246546d885f60223193a126d88fc8884bd3bc73b02061f0bab1c48a05e72d705
SSDEEP

1536:+y6sIV7YCkazkioIhh7Vw5p8+TNL/VKNTbTDghSe:+yS7AM1b7Vw5pvtVKNT/W

Score

1^/10

Malware Config

Signatures

Files

176cb087421ccb0dd2813d58cd27b4ee745d6a9d8581a6519f5ab2ae0ba2a140_NeikiAnalytics.exe
.sys windows:10 windows x64 arch:x64

aa2492b2ca9cb6881ab250172e1cc445

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:ec:f3:1b:6c:05:76:5e:38:33:d5:e2:26:99:5c:3f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

20/10/2015, 00:00

Not After

19/10/2018, 23:59

Subject

SERIALNUMBER=724-87-00053,CN=Works Mobile Corporation,O=Works Mobile Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:ec:f3:1b:6c:05:76:5e:38:33:d5:e2:26:99:5c:3f
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

20/10/2015, 00:00

Not After

19/10/2018, 23:59

Subject

SERIALNUMBER=724-87-00053,CN=Works Mobile Corporation,O=Works Mobile Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ba:1e:31:f6:0c:d2:95:fd:4e:35:a1:c8:08:d0:cb:83:13:c9:cf:c8:cd:b9:cd:05:f9:ba:e8:4a:c1:ed:3e:52
Signer

Actual PE Digest

ba:1e:31:f6:0c:d2:95:fd:4e:35:a1:c8:08:d0:cb:83:13:c9:cf:c8:cd:b9:cd:05:f9:ba:e8:4a:c1:ed:3e:52

Digest Algorithm

sha256

PE Digest Matches

true

e5:1f:8a:42:db:95:1a:66:5d:a8:a0:7d:fe:19:72:d0:24:57:a6:05
Signer

Actual PE Digest

e5:1f:8a:42:db:95:1a:66:5d:a8:a0:7d:fe:19:72:d0:24:57:a6:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\proj\drive-win\SRC\dokan\x64\Win8.1Release\WEDrive(1.1.0).pdb

Imports

ntoskrnl.exe

KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ObOpenObjectByPointer
__C_specific_handler
SeTokenObjectType
KeEnterCriticalRegion
ExAcquireResourceSharedLite
ExEnterCriticalRegionAndAcquireResourceExclusive
ExReleaseResourceAndLeaveCriticalRegion
IoRemoveShareAccess
IoGetRequestorProcess
FsRtlFastUnlockAll
FsRtlCheckOplock
FsRtlNotifyCleanup
RtlInitUnicodeString
RtlEqualUnicodeString
RtlLengthSecurityDescriptor
KeInitializeEvent
KeLeaveCriticalRegion
ExAllocatePoolWithTag
ExFreePoolWithTag
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeResourceLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
ExDeleteResourceLite
SeAssignSecurity
SeDeassignSecurity
IoCheckShareAccess
IoSetShareAccess
IoUpdateShareAccess
IoGetFileObjectGenericMapping
MmDoesFileHaveUserWritableReferences
FsRtlInitializeOplock
FsRtlUninitializeOplock
FsRtlOplockFsctrl
FsRtlCheckOplockEx
FsRtlOplockBreakH
FsRtlTeardownPerStreamContexts
wcsncmp
_wcsnicmp
RtlCompareMemory
IoAcquireRemoveLockEx
IoReleaseRemoveLockEx
MmMapLockedPagesSpecifyCache
FsRtlNotifyFullChangeDirectory
IoGetTopLevelIrp
IoSetTopLevelIrp
KeSetEvent
ExInitializeLookasideListEx
ExDeleteLookasideListEx
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
FsRtlRegisterFileSystemFilterCallbacks
IoUnregisterFileSystem
FsRtlCopyRead
FsRtlCopyWrite
FsRtlMdlReadDev
FsRtlMdlReadCompleteDev
FsRtlPrepareMdlWriteDev
FsRtlMdlWriteCompleteDev
FsRtlNotifyFullReportChange
towupper
RtlFreeUnicodeString
RtlStringFromGUID
KeClearEvent
IoReleaseCancelSpinLock
IoVerifyVolume
DbgPrint
FsRtlIsNtstatusExpected
MmFlushImageSection
MmCanFileBeTruncated
CcUninitializeCacheMap
CcPurgeCacheSection
CcFlushCache
IoCreateDevice
ObfReferenceObject
FsRtlCheckLockForOplockRequest
FsRtlOplockIsSharedRequest
FsRtlNotifyInitializeSync
KeInitializeTimerEx
KeCancelTimer
KeSetTimerEx
KeWaitForMultipleObjects
KeWaitForSingleObject
KeInitializeSpinLock
PsCreateSystemThread
PsTerminateSystemThread
IoBuildDeviceIoControlRequest
IofCallDriver
IoCreateSymbolicLink
IoGetDeviceObjectPointer
IoInitializeRemoveLockEx
IoSetDeviceInterfaceState
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
PsIsSystemThread
IoRegisterFileSystem
FsRtlRegisterUncProvider
FsRtlDeregisterUncProvider
FsRtlProcessFileLock
FsRtlAreThereWaitingFileLocks
KeResetEvent
ExInterlockedInsertTailList
IoReleaseRemoveLockAndWaitEx
IoGetRequestorProcessId
IoGetRequestorSessionId
FsRtlCheckLockForReadAccess
RtlValidRelativeSecurityDescriptor
KeQueryTimeIncrement
MmGetSystemRoutineAddress
ZwQueryValueKey
ZwSetSecurityObject
IoDeviceObjectType
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
SeExports
RtlCreateSecurityDescriptor
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwCreateKey

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa2492b2ca9cb6881ab250172e1cc445

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

46:ec:f3:1b:6c:05:76:5e:38:33:d5:e2:26:99:5c:3fCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

46:ec:f3:1b:6c:05:76:5e:38:33:d5:e2:26:99:5c:3fCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

ba:1e:31:f6:0c:d2:95:fd:4e:35:a1:c8:08:d0:cb:83:13:c9:cf:c8:cd:b9:cd:05:f9:ba:e8:4a:c1:ed:3e:52Signer

e5:1f:8a:42:db:95:1a:66:5d:a8:a0:7d:fe:19:72:d0:24:57:a6:05Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 6KB - Virtual size: 5KB

.data Size: 1024B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 2KB

PAGE Size: 12KB - Virtual size: 11KB

INIT Size: 5KB - Virtual size: 5KB

.rsrc Size: 1024B - Virtual size: 792B

.reloc Size: 512B - Virtual size: 48B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

46:ec:f3:1b:6c:05:76:5e:38:33:d5:e2:26:99:5c:3f
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

46:ec:f3:1b:6c:05:76:5e:38:33:d5:e2:26:99:5c:3f
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

ba:1e:31:f6:0c:d2:95:fd:4e:35:a1:c8:08:d0:cb:83:13:c9:cf:c8:cd:b9:cd:05:f9:ba:e8:4a:c1:ed:3e:52
Signer

e5:1f:8a:42:db:95:1a:66:5d:a8:a0:7d:fe:19:72:d0:24:57:a6:05
Signer

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 1024B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 2KB

PAGE
Size: 12KB - Virtual size: 11KB

INIT
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 792B

.reloc
Size: 512B - Virtual size: 48B