E:\SHARE\HPul-MultiStak\obj\x86\hpul.pdb
Static task
static1
General
-
Target
054210b72e9c751073811a209ae94cfd0235ffbb6b3905bcc0b96d3f0023cd78_NeikiAnalytics.exe
-
Size
10KB
-
MD5
b95a89a1669c97ce8b35f48ef52ddb20
-
SHA1
605c33a2c36f0b83d5cedb322ed9778f11849e0a
-
SHA256
054210b72e9c751073811a209ae94cfd0235ffbb6b3905bcc0b96d3f0023cd78
-
SHA512
7c2260fff6192bd6e3801c8153c7708e7b7ac1448ee9bea273efb638a22b62864b6d83c4b0cd2ba2af5e653d8d1e037acd307def688ca9d0018ae533182f9322
-
SSDEEP
192:S1z/LILDhsQ4m56Tv6AjHQertnC1XjQSk:SiL9sz4wQeRnCljQS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 054210b72e9c751073811a209ae94cfd0235ffbb6b3905bcc0b96d3f0023cd78_NeikiAnalytics.exe
Files
-
054210b72e9c751073811a209ae94cfd0235ffbb6b3905bcc0b96d3f0023cd78_NeikiAnalytics.exe.sys windows:6 windows x86 arch:x86
772f0a79e2252d1266d39d9bd6cd481a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
memset
RtlCompareMemory
memmove
mcd.sys
ChangerClassAllocatePool
ChangerClassSendSrbSynchronous
ChangerClassInitialize
ChangerClassFreePool
Sections
.text Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 512B - Virtual size: 478B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ