4efe655aed2e768f9ad9c30764f02890_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4efe655aed2e768f9ad9c30764f02890_NEIKI
Size

291KB
MD5

4efe655aed2e768f9ad9c30764f02890
SHA1

3421d349cdb595d47025262d900c3bb824784a08
SHA256

7af9d678460b9b71f50af06b4f99980fa1b4c96ac7dae798e52509285dc36270
SHA512

244f7d578bf59797de8c4964d49d5f813723071ce09a363380a39df05259dfbcd840f0eb07cc5489ee98fd3fd7699b521fa471bb0462758c646f4473caf073d8
SSDEEP

6144:TL+rqBloJ6nkP+6b7SbDk5XheDObSy7PfWH0obSxbSsVcwkB0G56vq3k:TLySlYt+VbDgxJV7mH1eXZu0U0

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
4efe655aed2e768f9ad9c30764f02890_NEIKI
unpack001/out.upx

Files

4efe655aed2e768f9ad9c30764f02890_NEIKI
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 168KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 13KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.bss
Size: - Virtual size: 145KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE