home

netfilter64.sys

NetFilter SDK

ADPEAK, INC.

Part of an Adpeak program that shows ads in the browser without providing information about the ad's origin. Ads are injected as banners or text-links in random web pages. The file netfilter64.sys, “NetFilter SDK TDI Hook Driver (WPP)” by ADPEAK, INC has been detected as adware by 3 anti-malware scanners. It runs as a Windows 64-bit kernel mode device driver named “netfilter64”.
Publisher:
NetFilterSDK.com  (signed by ADPEAK, INC.)

Product:
NetFilter SDK

Description:
NetFilter SDK TDI Hook Driver (WPP)

Version:
1.4.3.1 built by: WinDDK

MD5:
d468667575841a67b78f22cb7998df2f

SHA-1:
8c9b7c43c8b0119f3623ea0b153bfcd130a94d69

SHA-256:
5dbaa411e5d7786094b5214e727242ad01f4b6081b8d73f8e0aebe587b04d566

Scanner detections:
3 / 68

Status:
Adware

Analysis date:
4/26/2024 10:35:51 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
MalSign.Secsau
2015.0.3445

herdProtect (fuzzy)
variant of tnetfilter2.sys (Adware)
2014.6.13.9

Reason Heuristics
PUP.ADPEAKINC.O
14.8.7.17

File size:
60.3 KB (61,736 bytes)

Product version:
1.4.3.1

Copyright:
Copyright © 2013 NetFilterSDK.com

Original file name:
netfilter2.sys

File type:
Driver (Win64 SYS)

Language:
English (United States)

Common path:
C:\Windows\System32\drivers\netfilter64.sys

Digital Signature
Signed by:
ADPEAK, INC.

Authority:
DigiCert Inc

Valid from:
2/12/2014 1:00:00 AM

Valid to:
2/19/2015 1:00:00 PM

Subject:
CN="ADPEAK, INC.", O="ADPEAK, INC.", L=Sarasota, S=Florida, C=US, PostalCode=34233, STREET="5342 CLARK ROAD #137", SERIALNUMBER=5016610, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization

Issuer:
CN=DigiCert EV Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0A6E05774A7EF05B65E3577F6A37AEDC

File PE Metadata
OS bitness:
Win64

CTPH (ssdeep):
1536:xaDltS1O+G9IODA2VLcN4W5J0y9/ngJPNJsC8u:YxtS1dGtMfJ0y9PgJPNJsy

Entry point:
48, 8B, 05, F1, D0, FF, FF, 49, B9, 32, A2, DF, 2D, 99, 2B, 00, 00, 48, 85, C0, 74, 05, 49, 3B, C1, 75, 2F, 4C, 8D, 05, D6, D0, FF, FF, 48, B8, 20, 03, 00, 00, 80, F7, FF, FF, 48, 8B, 00, 49, 33, C0, 49, B8, FF, FF, FF, FF, FF, FF, 00, 00, 49, 23, C0, 49, 0F, 44, C1, 48, 89, 05, AE, D0, FF, FF, 48, F7, D0, 48, 89, 05, AC, D0, FF, FF, E9, BB, B3, FF, FF, CC, CC, CC, B0, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 20, 05, 01, 00, 10, C0, 00, 00, A0, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 42, 05, 01, 00...
 
[+]

Driver
Display name:
netfilter64

Type:
Kernel device driver (KernelDriver)

Group:
PNP_TDI


Remove netfilter64.sys - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.