551a24b4b12cdb73d39a30d641f1fdc0_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

551a24b4b12cdb73d39a30d641f1fdc0_NEIKI
Size

1.6MB
MD5

551a24b4b12cdb73d39a30d641f1fdc0
SHA1

f06b8325e42d0b6453808d1886a1218d69fc00f9
SHA256

04b09039e6af3779c3e35850ed5e642165113b9cd1fe03c75bd5b6e2104a067b
SHA512

99acf2fdf91e80f4e024a0b0017c79b64e1cff828b4cabc26c4ae717587323bf469949f5affa4f4699bbe1541b331b7c1c2f9179adc954ce8adb37c696fdebe6
SSDEEP

24576:CPqDcAsNjA9tyFKU8B9COn32XcHkvMhDEHj5EJTB08wNvQSx/ig:CPqDcrD58B9CrMhD2FuTZwWS5/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
551a24b4b12cdb73d39a30d641f1fdc0_NEIKI

Files

551a24b4b12cdb73d39a30d641f1fdc0_NEIKI
.exe windows:1 windows x86 arch:x86

20e4c9485eec611b081d9ef9d752184d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

claasc

ASCII

clados

DOS

clamss

MSSQL

claole

Cla$HookOle

clarun

Cla$ACCEPTED
Cla$ADDqueue
Cla$ADDqueuekey
Cla$AssertFailed
Cla$AssertFailedM
Cla$AssignLong2RefUfo
Cla$AssignReal2RefUfo
Cla$AssignRefUfo
Cla$BEEP
Cla$BindG
Cla$CLEAR
Cla$CLEARqueue
Cla$clearstr
Cla$ClearUfo
Cla$CLOCK
Cla$CLOSEwindow
Cla$code
Cla$COMMIT
Cla$comparestr
Cla$DEBUGHOOK
Cla$DecDistinct
Cla$DecDistinctR
Cla$DecMul
Cla$DELETEqueue
Cla$DELETEREG
Cla$DISABLE
Cla$DISPLAY
Cla$DISPOSEqueue
Cla$DISPOSEref
Cla$DISPOSEvref
Cla$Dlongpower
Cla$DPopLong
Cla$DPopReal
Cla$DPushConstant
Cla$DPushLong
Cla$ENABLE
Cla$EndEventLoop
Cla$EndEventLoops
Cla$ERRORCODE
Cla$EVENT
Cla$FIELD
Cla$FILEERRORCODE
Cla$FILEERRORMSG
Cla$FileExists
Cla$FILE_ADDf
Cla$FILE_BUILDf
CLA$FILE_CALLBACK
Cla$FILE_CLEAR
Cla$FILE_CLOSE
Cla$FILE_CREATE
Cla$FILE_DELETE
CLA$FILE_DESTROY
Cla$FILE_DUPLICATEk
CLA$FILE_FREESTATE
Cla$FILE_GETfk
Cla$FILE_GETfl
Cla$FILE_GETNULLS
CLA$FILE_GETSTATE
Cla$FILE_GET_PROPERTY
Cla$FILE_NAME
Cla$FILE_NEXT
Cla$FILE_NOMEMO
Cla$FILE_OPEN
Cla$FILE_POSITIONf
Cla$FILE_POSITIONk
Cla$FILE_PREV
Cla$FILE_PUTf
Cla$FILE_REGETf
Cla$FILE_REGETk
Cla$FILE_RESETf
Cla$FILE_RESETk
CLA$FILE_RESTORESTATE
Cla$FILE_SEND
Cla$FILE_SETk
Cla$FILE_SETkk
Cla$FILE_SETNULLS
Cla$FILE_SET_PROPERTY
Cla$FILE_WATCH
Cla$FOCUS
Cla$FREEqueue
Cla$FREEqueuea
Cla$freestr
Cla$FreeUfo
Cla$freewindow
Cla$GETINI
Cla$GetPropS
Cla$GETqueuekey
Cla$GETqueueptr
Cla$GETREG
Cla$Group2Ufo
Cla$HALT
Cla$init
Cla$INSTANCE
Cla$IsUfoString
Cla$KEYCODE
Cla$KEY_GET_PROPERTY
Cla$LOGOUT
Cla$LONGPATH
Cla$longtostr
Cla$Mem2Ufo
Cla$MessageBox
Cla$NewMemB
Cla$NewMemT
Cla$NewMemZ
Cla$NEWqueue
Cla$NOTIFICATION
Cla$OPENowned
Cla$OPENwindow
Cla$POINTERqueue
Cla$PopAString
Cla$PopBind
Cla$PopCString
Cla$PopReal
Cla$PopString
Cla$PopTemp
Cla$POST
Cla$PushAString
Cla$PushBind
Cla$PushCString
Cla$PushLong
Cla$PushPictLong
Cla$PushString
Cla$PushUfo
Cla$PUTINI
Cla$PUTqueue
Cla$PUTREG
Cla$pwopen
Cla$RECORDSqueue
Cla$RefAssignAny
Cla$ROLLBACK
Cla$SELECT
Cla$SETCURSOR
Cla$SETKEYCODE
Cla$SetPropS
Cla$SetPropV
Cla$SORTqueuekey
Cla$Stack2DStack
Cla$Stack2Ufo
Cla$StackCLIP
Cla$StackCompareN
Cla$StackCompareNEQ
Cla$StackCompareR
Cla$StackConcat
Cla$StackConcatR
Cla$StackErrstr
Cla$StackHeap
Cla$StackINSTRING
Cla$StackLEFT
Cla$StackLen
Cla$STACKpop
Cla$StackRotate
Cla$StackSUB
Cla$StackUPPER
Cla$StartEventLoop
Cla$STATUSfile
Cla$STOP
Cla$storecstr
Cla$storestr
Cla$String2Ref
Cla$THREAD
Cla$THREAD_FILE
Cla$TODAY
Cla$Ufo2Real
Cla$Ufodistinct
Cla$UNHIDE
Cla$UNREGISTEREVENT
Cla$WHAT
Cla$YIELD
NewCriticalSection
THR$GetInstance
_exit
_free
_malloc
__a_chkstk
__e_index
__e_stack
__sysinit
__sysstart

kernel32

GlobalAlloc
GlobalFree
MultiByteToWideChar

pxclib40

PXC_AddCheckBox
PXC_AddChoice
PXC_AddFontA
PXC_AddPage
PXC_AddTextBox
PXC_CheckBox_SetOptions
PXC_Choice_AddItem
PXC_Choice_SelectItems
PXC_Choice_SetOptions
PXC_EnableLinkAnalyzer
PXC_EndPage
PXC_FormField_SetAppearanceInfo
PXC_FormField_SetBorderInfo
PXC_FormField_SetReadOnly
PXC_FormField_SetRequired
PXC_Free
PXC_GetPage
PXC_NewDocumentEx
PXC_ReleaseDocument
PXC_SetAnnotsInfo
PXC_SetCompression
PXC_SetDocumentInfoW
PXC_SetPageLayout
PXC_SetPageMode
PXC_SetSpecVersion
PXC_SetViewerPreferences
PXC_TextBox_SetCaption
PXC_TextBox_SetOptions
PXC_WriteDocumentExA

shell32

ShellExecuteA

user32

GetDesktopWindow

xcpro40

PXCp_CheckPassword
PXCp_Delete
PXCp_FinishReadDocument
PXCp_GetPagesCount
PXCp_Init
PXCp_PlaceContents
PXCp_ReadDocumentW
PXCp_WriteDocumentW

Sections

.text
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cwtls
Size: 1024B - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.cwdebug
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20e4c9485eec611b081d9ef9d752184d

Headers

File Characteristics

Imports

claasc

clados

clamss

claole

clarun

kernel32

pxclib40

shell32

user32

xcpro40

Sections

.text Size: 87KB - Virtual size: 86KB

.data Size: 21KB - Virtual size: 70KB

.cwtls Size: 1024B - Virtual size: 19KB

.idata Size: 7KB - Virtual size: 6KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 7KB - Virtual size: 6KB

.cwdebug Size: 512B - Virtual size: 28B

.text
Size: 87KB - Virtual size: 86KB

.data
Size: 21KB - Virtual size: 70KB

.cwtls
Size: 1024B - Virtual size: 19KB

.idata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 7KB - Virtual size: 6KB

.cwdebug
Size: 512B - Virtual size: 28B