40a87fac95b1fee45a6660d56fe67930_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

40a87fac95b1fee45a6660d56fe67930_NEIKI
Size

399KB
MD5

40a87fac95b1fee45a6660d56fe67930
SHA1

9f7a6a9f30885607d66d0d12c422d4ecf668fc6c
SHA256

52cceb7014050cfcecc7c10c7ea067b20c26dbf33cec0a9cef88cbddcb048836
SHA512

13d8661cd3357057ab8ae1fd01e32cec925b4451fa1068932b5227f82a3b0b15adc12ed260d03f3e376ccea680c23165e8ca67904534ca1ecc3f5795e5d77380
SSDEEP

6144:c1PrHGV3QVKxsytQJBxeMmQspEPhsGa3JB7UgG6H:c1PyV3AevQeEPhbiS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40a87fac95b1fee45a6660d56fe67930_NEIKI

Files

40a87fac95b1fee45a6660d56fe67930_NEIKI
.dll windows:6 windows x86 arch:x86

1532936826f95b78bb364ebbb4a9e1da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\rust-dave-sideload\target\i686-pc-windows-msvc\release\deps\rust_dave_sideload.pdb

Imports

kernel32

GetEnvironmentVariableW
VirtualAlloc
CloseHandle
GetModuleHandleA
GetProcAddress
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetNativeSystemInfo
VirtualQuery
VirtualFree
VirtualProtect
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
GetLastError
FindNextFileW
FindClose
CreateFileW
SetFileInformationByHandle
FlushFileBuffers
GetFileInformationByHandle
GetFileInformationByHandleEx
SetFilePointerEx
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TlsGetValue
TlsSetValue
AcquireSRWLockShared
ReleaseSRWLockShared
CreateThread
SetThreadStackGuarantee
GetCurrentThread
WaitForSingleObject
CreateWaitableTimerExW
SetWaitableTimer
Sleep
SetHandleInformation
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
SetLastError
ReadFile
GetCurrentProcessId
QueryPerformanceCounter
FreeEnvironmentStringsW
GetEnvironmentStringsW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
ReleaseMutex
RtlCaptureContext
HeapFree
HeapReAlloc
GetModuleHandleW
FormatMessageW
ExitProcess
GetProcessHeap
HeapAlloc
GetCurrentDirectoryW
DecodePointer
GetFullPathNameW
GetModuleFileNameW
GetSystemTimeAsFileTime
GetCommandLineW
GetFileType
TerminateProcess
HeapSize
GetStringTypeW
SetStdHandle
GetConsoleOutputCP
WriteFile
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
InterlockedFlushSList
RaiseException
RtlUnwind
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent

ntdll

RtlNtStatusToDosError
NtReadFile
NtWriteFile

ws2_32

WSAGetLastError
WSACleanup
WSAStartup
listen
bind
freeaddrinfo
getaddrinfo
closesocket
WSASocketW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress

Exports

Exports

DllMain
g2mchat_winmain
g2mcomm_winmain
g2mfeedback_winmain
g2mhost_winmain
g2minstaller_winmain
g2minsthigh_winmain
g2mlauncher_winmain
g2mmatchmaking_winmain
g2mmaterials_winmain
g2mpolling_winmain
g2mqanda_winmain
g2mrecorder_winmain
g2msessioncontrol_winmain
g2mstart_winmain
g2mtesting_winmain
g2mtranscoder_winmain
g2mui_winmain
g2muninstall_winmain
g2mvideoconference_winmain
g2mview_winmain

Sections

.text
Size: 221KB - Virtual size: 220KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1532936826f95b78bb364ebbb4a9e1da

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ntdll

ws2_32

api-ms-win-core-synch-l1-2-0

Exports

Exports

Sections

.text Size: 221KB - Virtual size: 220KB

.rdata Size: 82KB - Virtual size: 81KB

.data Size: 80KB - Virtual size: 82KB

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 221KB - Virtual size: 220KB

.rdata
Size: 82KB - Virtual size: 81KB

.data
Size: 80KB - Virtual size: 82KB

.reloc
Size: 15KB - Virtual size: 14KB