d:\程序\kill\Driver\i386\KILLPRC.pdb
Static task
static1
General
-
Target
b944c8983cf2bfeb7f84de84f93922306e4e201d2888e5949f83d8f4c661846f_NeikiAnalytics.exe
-
Size
3KB
-
MD5
3615cd67412e42f93fb159fb142e2400
-
SHA1
281c846a1751f3c546389786eaf8aceed61f2a80
-
SHA256
b944c8983cf2bfeb7f84de84f93922306e4e201d2888e5949f83d8f4c661846f
-
SHA512
f5129c41238ab47c0d2ba63ae9e6cbc8fa93032f3a58130d797c518a807f9e9387464f9db981b27d17f23089f1fb7cf9f16beab10bd3ef9f030cb37898371dc8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b944c8983cf2bfeb7f84de84f93922306e4e201d2888e5949f83d8f4c661846f_NeikiAnalytics.exe
Files
-
b944c8983cf2bfeb7f84de84f93922306e4e201d2888e5949f83d8f4c661846f_NeikiAnalytics.exe.sys windows:6 windows x86 arch:x86
e833bd1df48442a94c2758b0ea9fd9ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ObfDereferenceObject
ObOpenObjectByPointer
MmGetSystemRoutineAddress
RtlInitUnicodeString
PsLookupProcessByProcessId
ZwClose
ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwCreateJobObject
IofCompleteRequest
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
Sections
.text Size: 128B - Virtual size: 48B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 155B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 640B - Virtual size: 542B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 768B - Virtual size: 680B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ