4d3b9b8c9f89319a735d3c542bf3ffbe88d71bbb53708560286912db0540ba17_NeikiAnalytics[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

4d3b9b8c9f89319a735d3c542bf3ffbe88d71bbb53708560286912db0540ba17_NeikiAnalytics.exe
Size

49KB
MD5

42cf277f38cf9cdc1cfa2c572a90de00
SHA1

ef9267ae88ebad1318f12911906d80f62323987d
SHA256

4d3b9b8c9f89319a735d3c542bf3ffbe88d71bbb53708560286912db0540ba17
SHA512

97cb12d5ef4f2ac15de03ae4fb2b670e71afc28519ec868aee324e5a6fa333f55b0ebb556d608c222eb1a27bd0826985b9df18069de5d73d1483863d11730467
SSDEEP

768:Z4DZtkRYhMawAoe72LrqJanpIpM7QeCjvM+Q67iU32EMgY/DVUdmlUC29zyT:QZtffwA3M2eUPM36mUm3g4VUdmlUCCzS

Score

1^/10

Malware Config

Signatures

Files

4d3b9b8c9f89319a735d3c542bf3ffbe88d71bbb53708560286912db0540ba17_NeikiAnalytics.exe
.sys windows:6 windows x64 arch:x64

c031d31dd4a7dfc7b567bcaadf88fca2

Code Sign

33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

14-09-2023 19:14

Not After

04-09-2024 19:14

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8a:45:0a:00:dc:c5:9d:d3:f8:6c:77:0e:b9:cc:6a:05:e7:7d:c2:00:d9:cc:15:fe:3d:b0:cb:2d:21:90:54:7b
Signer

Actual PE Digest

8a:45:0a:00:dc:c5:9d:d3:f8:6c:77:0e:b9:cc:6a:05:e7:7d:c2:00:d9:cc:15:fe:3d:b0:cb:2d:21:90:54:7b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

PDB Paths

F:\ckp\src\cphapi\E87_70\build\release\static\x64\ISWKL.pdb

Imports

epklib.sys

EPkPsUnregister
EPkPsGet
EPkPsRelease
EPkPsRegister

ntoskrnl.exe

RtlInitUnicodeString
KeInitializeEvent
KeSetEvent
KeInitializeMutex
KeReleaseMutex
KeWaitForSingleObject
ExAllocatePool
ExFreePoolWithTag
MmGetSystemRoutineAddress
IoGetCurrentProcess
ObfReferenceObject
ObfDereferenceObject
PsGetCurrentProcessId
MmCreateSection
MmMapViewOfSection
MmUnmapViewOfSection
ZwQueryInformationThread
__C_specific_handler
_wcsnicmp
DbgPrint
KeDelayExecutionThread
IofCompleteRequest
ZwLoadDriver
ZwClose
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwOpenKey
ZwQueryValueKey
ZwQueryFullAttributesFile
ObQueryNameString
ObReferenceObjectByName
PsDereferenceImpersonationToken
PsDereferencePrimaryToken
PsReferenceImpersonationToken
PsReferencePrimaryToken
RtlEqualSid
SeQueryInformationToken
SeQuerySessionIdToken
_snwprintf
RtlGetAce
IoDriverObjectType
RtlGetVersion
ProbeForRead
IoCreateDevice
IoDeleteDevice
PoStartNextPowerIrp
ObReferenceObjectByHandle
ExUuidCreate
IoFileObjectType
KeWaitForMultipleObjects
ExAllocatePoolWithTag
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPages
MmUnmapLockedPages
SeCaptureSubjectContext
SeReleaseSubjectContext
SeAccessCheck
PsWrapApcWow64Thread
IoAllocateMdl
IoFreeMdl
ObReferenceObjectByPointer
ObGetObjectSecurity
ObReleaseObjectSecurity
PsSetCreateProcessNotifyRoutine
PsGetProcessId
PsGetThreadId
KeInitializeApc
PsGetProcessWow64Process
KeInsertQueueApc
KeStackAttachProcess
KeUnstackDetachProcess
ObOpenObjectByPointer
PsGetThreadProcess
PsLookupProcessByProcessId
PsLookupThreadByThreadId
SePrivilegeCheck
ZwCreateEvent
ZwDuplicateObject
ZwQueryObject
ZwQuerySystemInformation
ExEventObjectType
PsProcessType
PsThreadType
PsInitialSystemProcess
ExAcquireFastMutex
ExReleaseFastMutex
ExCreateCallback
ExRegisterCallback
ExUnregisterCallback
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlIsGenericTableEmptyAvl
KeBugCheck
_itow
ZwQueryInformationProcess
KeLowerIrql
KfRaiseIrql
KeInitializeDpc
KeInsertQueueDpc
KeSetImportanceDpc
KeSetTargetProcessorDpc
KeQueryActiveProcessors

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c031d31dd4a7dfc7b567bcaadf88fca2

Code Sign

33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09Certificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

8a:45:0a:00:dc:c5:9d:d3:f8:6c:77:0e:b9:cc:6a:05:e7:7d:c2:00:d9:cc:15:fe:3d:b0:cb:2d:21:90:54:7bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

epklib.sys

ntoskrnl.exe

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 1024B - Virtual size: 5KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 32B

33:00:00:01:09:5e:de:a2:12:7e:92:81:cc:00:00:00:00:01:09
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

8a:45:0a:00:dc:c5:9d:d3:f8:6c:77:0e:b9:cc:6a:05:e7:7d:c2:00:d9:cc:15:fe:3d:b0:cb:2d:21:90:54:7b
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 1024B - Virtual size: 5KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 32B