0ef4db15016d5485728d302b9630f160_NEIKI

Sharing

Copy URL

Twitter E-mail

General

Target

0ef4db15016d5485728d302b9630f160_NEIKI
Size

170KB
MD5

0ef4db15016d5485728d302b9630f160
SHA1

a70928650a6f5c58c03ada15feff5783b6e06799
SHA256

e05c52adafc62dc23f59897dcade36a9361a6b1911375a6f2a1eb03c41a0df78
SHA512

a7bc04651f00e1e179b9d56b64ee8e43b0b535a40957426d6b76c58b605638ca69353f669710449ffdc4faf57ef76f67219996176012c4fa2739391adc6202ba
SSDEEP

3072:N8z1Rf1aNvk/OEpXjb7QtxUay1h5suNAg78drGuhIUlg+IDIOWU/G9pE:NgfA5k/Os3Kq/1PsOeG0Imp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ef4db15016d5485728d302b9630f160_NEIKI

Files

0ef4db15016d5485728d302b9630f160_NEIKI
.exe windows:4 windows x86 arch:x86

2cf6cb3f5ee328d8976c1490244de29f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
ImageList_Destroy

kernel32

GlobalAddAtomA
RtlUnwind
GetLocalTime
GetFileType
HeapFree
ExitProcess
RaiseException
TerminateProcess
CreateThread
HeapAlloc
GetModuleHandleA
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
GetStartupInfoA
HeapDestroy
ExitThread
VirtualAlloc
SetStdHandle
SetHandleCount
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
HeapSize
GlobalHandle
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
GetLocaleInfoA
GetLocaleInfoW
VirtualFree
GetVersionExA
GetWindowsDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
OpenEventA
OpenFile
CreateFileA
SetFilePointer
WriteFile
_lclose
CloseHandle
CreateMutexA
CreateEventA
WaitForSingleObject
ReleaseMutex
SetEvent
WaitForMultipleObjects
GetVolumeInformationA
GetFullPathNameA
DeleteFileA
FindFirstFileA
FindClose
SetEndOfFile
ReadFile
FlushFileBuffers
GetProcessVersion
GetCurrentProcess
WritePrivateProfileStringA
MulDiv
GlobalFlags
GetModuleFileNameA
SetLastError
lstrcpynA
TlsGetValue
lstrcpyA
SetErrorMode
EnterCriticalSection
LocalReAlloc
TlsSetValue
TlsFree
GlobalReAlloc
LeaveCriticalSection
GetEnvironmentStringsW
GlobalUnlock
GlobalFree
GetLastError
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalFree
LocalAlloc
GetVersion
lstrcatA
GlobalGetAtomNameA
SuspendThread
SetThreadPriority
ResumeThread
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
lstrcmpA
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetComputerNameA
GetSystemDirectoryA
LCMapStringA
LCMapStringW
HeapCreate

user32

CharUpperA
EndDialog
DestroyMenu
FindWindowA
InvalidateRect
GetSysColorBrush
WindowFromPoint
SetRectEmpty
LoadAcceleratorsA
TranslateAcceleratorA
ReleaseCapture
LoadMenuA
SetMenu
ReuseDDElParam
UnpackDDElParam
IsIconic
BringWindowToTop
LoadStringA
UnregisterClassA
LoadIconA
UpdateWindow
SystemParametersInfoA
MapWindowPoints
GetSysColor
SetActiveWindow
IsWindow
SetFocus
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetClientRect
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
ScreenToClient
ScrollWindow
SetScrollInfo
ShowScrollBar
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
IsWindowEnabled
IsChild
GetCapture
WinHelpA
GetClassInfoA
GetMenuItemCount
ShowWindow
LoadCursorA
GetWindowTextA
GetDlgCtrlID
DestroyWindow
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetWindow
GetWindowRect
GetWindowLongA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetParent
GetNextDlgTabItem
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
PeekMessageA
GetCursorPos
SetWindowsHookExA
MessageBoxA
EnableWindow
SetCursor
ShowOwnedPopups
PostMessageA
PostQuitMessage
DefWindowProcA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
MessageBoxExA
SendMessageA
wsprintfA
GetSystemMetrics
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
ReleaseDC
GetDC
GetDesktopWindow
SetWindowTextA
ClientToScreen
PtInRect
GetClassNameA
GetSubMenu
GetMenuItemID
GetDlgItem
GetMenu

gdi32

DeleteObject
SaveDC
RestoreDC
SelectObject
GetStockObject
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
GetObjectA
GetDeviceCaps
PtVisible
RectVisible
ExtTextOutA
Escape
TextOutA
SetBkColor
SetTextColor
DeleteDC
CreateBitmap

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA
EnumPrintersA

advapi32

RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
AllocateAndInitializeSid
InitializeSecurityDescriptor
InitializeAcl
AddAccessAllowedAce
RegCloseKey
RegSetValueExA
RegQueryValueExA
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
RegOpenKeyA
FreeSid
RegSetKeySecurity

shell32

DragFinish
DragQueryFileA

rpcrt4

I_RpcGetBuffer
NdrConformantArrayUnmarshall
RpcRaiseException
RpcMgmtStopServerListening
RpcServerUseProtseqA
RpcServerRegisterIf
RpcServerInqBindings
RpcServerUnregisterIf
RpcEpRegisterA
RpcBindingVectorFree
RpcServerListen
RpcEpUnregister
NdrClientInitializeNew
NdrConformantArrayBufferSize
NdrGetBuffer
NdrConformantArrayMarshall
NdrSendReceive
NdrConvert
NdrFreeBuffer
NdrServerInitializeNew
I_RpcGetCurrentCallHandle
RpcBindingFromStringBindingA
RpcStringBindingComposeA
RpcBindingFree
RpcStringFreeA

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2cf6cb3f5ee328d8976c1490244de29f

Headers

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

rpcrt4

Sections

.text Size: 118KB - Virtual size: 118KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 22KB - Virtual size: 36KB

.rsrc Size: 1024B - Virtual size: 1016B

.text
Size: 118KB - Virtual size: 118KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 22KB - Virtual size: 36KB

.rsrc
Size: 1024B - Virtual size: 1016B