014fc12b5569d515d331b47b5ba133fca3fa68676788b609ba7c1df3e461852c_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

014fc12b5569d515d331b47b5ba133fca3fa68676788b609ba7c1df3e461852c_NeikiAnalytics.exe
Size

18KB
MD5

c9ba56be92a40313ddb3b5c548343bb0
SHA1

27ecfc1cf34be36eae1252e51fd1d998948a0be2
SHA256

014fc12b5569d515d331b47b5ba133fca3fa68676788b609ba7c1df3e461852c
SHA512

6cdb8e740858ed01a494de62ad225e8aef41a797965d26fde88b4d4c7611ee86b2842ef15e14c8d1ae5bcc6fb449d4b013c9a45a87ded12a528e22ba71681497
SSDEEP

384:sNH1d9R1dHpYCeTvE5v0INqy8ZpH3GCJEXm1:sNH1XxiCe5INqyiRBE8

Score

1^/10

Malware Config

Signatures

Files

014fc12b5569d515d331b47b5ba133fca3fa68676788b609ba7c1df3e461852c_NeikiAnalytics.exe
.sys windows:10 windows x64 arch:x64

b2c5beb8945c2075ca039d57d6decbf5

Code Sign

37:74:43:4f:9e:b4:0e:22:1f:92:36:ca:1f:2f:27:17
Certificate

Issuer

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV E36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/02/2023, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:76:0b:40:03:b5:50:7a:11:2d:63:40:db:57:fb:2a
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV E36,O=Sectigo Limited,C=GB

Not Before

16/09/2023, 00:00

Not After

05/09/2024, 23:59

Subject

SERIALNUMBER=51.169.800/0001-71,CN=KPRL TECNOLOGIA LTDA,O=KPRL TECNOLOGIA LTDA,ST=São Paulo,C=BR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024252

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

35:8c:35:dd:cd:d5:f5:82:1c:73:ea:ff:c3:41:b3:bf:3d:06:b4:4e:ed:2d:38:84:a0:15:21:ea:cb:36:20:37
Signer

Actual PE Digest

35:8c:35:dd:cd:d5:f5:82:1c:73:ea:ff:c3:41:b3:bf:3d:06:b4:4e:ed:2d:38:84:a0:15:21:ea:cb:36:20:37

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\marco\GitHub\Lux\Software\mouseDriver\x64\Release\kernel_socket_server.pdb

Imports

netio.sys

WskCaptureProviderNPI
WskReleaseProviderNPI
WskDeregister
WskRegister

ntoskrnl.exe

RtlInitUnicodeString
ExAllocatePool2
ExFreePoolWithTag
KeInitializeEvent
KeResetEvent
KeSetEvent
KeWaitForSingleObject
MmProbeAndLockPages
IoAllocateIrp
IoAllocateMdl
IoFreeIrp
IoFreeMdl
IoReuseIrp
__C_specific_handler
KeAcquireSpinLockAtDpcLevel
KeReleaseSpinLockFromDpcLevel
PsCreateSystemThread
IofCompleteRequest
IoReleaseRemoveLockEx
ZwClose
KeLowerIrql
KfRaiseIrql
ObfDereferenceObject
ObReferenceObjectByName
IoDriverObjectType

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b2c5beb8945c2075ca039d57d6decbf5

Code Sign

37:74:43:4f:9e:b4:0e:22:1f:92:36:ca:1f:2f:27:17Certificate

Extended Key Usages

Key Usages

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cbCertificate

Extended Key Usages

Key Usages

3f:76:0b:40:03:b5:50:7a:11:2d:63:40:db:57:fb:2aCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

35:8c:35:dd:cd:d5:f5:82:1c:73:ea:ff:c3:41:b3:bf:3d:06:b4:4e:ed:2d:38:84:a0:15:21:ea:cb:36:20:37Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

netio.sys

ntoskrnl.exe

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 396B

INIT Size: 1024B - Virtual size: 908B

.reloc Size: 512B - Virtual size: 36B

37:74:43:4f:9e:b4:0e:22:1f:92:36:ca:1f:2f:27:17
Certificate

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb
Certificate

3f:76:0b:40:03:b5:50:7a:11:2d:63:40:db:57:fb:2a
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

35:8c:35:dd:cd:d5:f5:82:1c:73:ea:ff:c3:41:b3:bf:3d:06:b4:4e:ed:2d:38:84:a0:15:21:ea:cb:36:20:37
Signer

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 396B

INIT
Size: 1024B - Virtual size: 908B

.reloc
Size: 512B - Virtual size: 36B