6ee1b5f340f1742d166360901d5efc80_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

6ee1b5f340f1742d166360901d5efc80_NEIKI
Size

4.8MB
MD5

6ee1b5f340f1742d166360901d5efc80
SHA1

c6e46fd53cc3ff727d9b5a078ca9262accdaf38a
SHA256

b2416e6ae3feb3fefa55e50d376abd66682cf50d3f42a70ead27d71f725f8241
SHA512

1dd32a6af03cdc7b41f02664a5a0fb15efbf2e76c3809535e3cb668c2c0bae40d91bf8bfc7adca53bb4270414840b6d3d33370eee4ce6315cad52dfa35d021fa
SSDEEP

98304:KUwGeQ7+SOpd/pfoHz5GuZPQLq30QckmMzv3zRVbAy/4qO6K:KU4Qw/pfoTNZIG3nDr1AqO6K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ee1b5f340f1742d166360901d5efc80_NEIKI

Files

6ee1b5f340f1742d166360901d5efc80_NEIKI
.exe windows:6 windows x86 arch:x86

6e61df670bfbbd20ff13d82b5d9f53c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetGetUserW
WNetGetUniversalNameW
WNetGetConnectionW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx

shell32

ord680
SHFileOperationW
SHGetFileInfoW
SHGetFolderPathW
CommandLineToArgvW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateProcessesW
WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsA

secur32

GetUserNameExW

iphlpapi

GetAdaptersInfo

dbghelp

StackWalk
SymSetOptions
SymGetOptions
SymFunctionTableAccess
SymGetModuleInfo
SymInitialize
SymUnDName
SymLoadModule
SymGetSymFromAddr
UnDecorateSymbolName

advapi32

EqualSid
BuildTrusteeWithSidW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW
SetEntriesInAclW
MapGenericMask
GetLengthSid
FreeSid
CopySid
CheckTokenMembership
AllocateAndInitializeSid
AccessCheck
ConvertStringSidToSidW
ConvertSidToStringSidW
RegGetValueW
GetUserNameW
LookupAccountNameW
LookupAccountSidW
RevertToSelf
IsValidSid
ImpersonateSelf
GetTokenInformation
OpenThreadToken
OpenProcessToken
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

user32

LoadStringW
LoadStringA
GetDesktopWindow
wsprintfA

kernel32

GetCPInfo
LoadLibraryExW
GetModuleHandleExW
CreateThread
ExitThread
ResumeThread
ExitProcess
RaiseException
FreeLibraryAndExitThread
HeapReAlloc
GetFileType
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
ReadConsoleW
RtlUnwind
GetProcAddress
GetStringTypeW
GetLocaleInfoW
DecodePointer
EncodePointer
TlsFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCommandLineW
LocalFree
FreeConsole
GetUserDefaultLangID
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexA
FormatMessageA
OpenMutexA
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetStdHandle
OutputDebugStringA
AllocConsole
WriteConsoleW
GetTickCount
CompareStringW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
VerSetConditionMask
HeapAlloc
HeapFree
GetProcessHeap
Sleep
GetCurrentProcess
GetCurrentThread
GetSystemInfo
GetComputerNameExW
GetVersionExA
GetModuleFileNameW
GetModuleHandleA
TlsGetValue
VerifyVersionInfoW
GetACP
GetUserDefaultLocaleName
GetThreadContext
VirtualQueryEx
FreeLibrary
GetModuleFileNameA
LoadLibraryA
lstrcpynA
lstrcpyA
lstrcatA
LoadLibraryW
SetEvent
ResetEvent
CreateEventA
CreateFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileSizeEx
LockFile
ReadFile
SetFilePointerEx
UnlockFile
WriteFile
CreateDirectoryW
DeleteFileW
GetDriveTypeW
GetFileInformationByHandle
GetVolumePathNameW
RemoveDirectoryW
SetFileAttributesW
SetFileTime
GetTempPathW
GetBinaryTypeW
CopyFileW
MoveFileW
MoveFileExW
FileTimeToSystemTime
SystemTimeToFileTime
FindFirstFileExW
FindNextFileW
GetComputerNameW
FormatMessageW
GlobalMemoryStatusEx
GetCurrentThreadId
TerminateProcess
GetExitCodeProcess
CreateProcessW
SetPriorityClass
OpenProcess
FoldStringW
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoA
GetSystemDefaultLCID
GetCurrentProcessId
GetModuleHandleW
CreateToolhelp32Snapshot
Process32First
Process32Next
K32GetModuleFileNameExW
CreateFileA
FindFirstFileA
FindNextFileA
GetFileSize
GetStringTypeExW
LCMapStringW
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsSetValue

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 347KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e61df670bfbbd20ff13d82b5d9f53c6

Headers

DLL Characteristics

File Characteristics

Imports

mpr

ole32

shell32

version

wtsapi32

secur32

iphlpapi

dbghelp

advapi32

user32

kernel32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 326KB - Virtual size: 326KB

.data Size: 67KB - Virtual size: 81KB

.rsrc Size: 347KB - Virtual size: 347KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 326KB - Virtual size: 326KB

.data
Size: 67KB - Virtual size: 81KB

.rsrc
Size: 347KB - Virtual size: 347KB