11b2ba4bce28d6559f3cd385bf968f40_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

11b2ba4bce28d6559f3cd385bf968f40_NEIKI
Size

4.8MB
MD5

11b2ba4bce28d6559f3cd385bf968f40
SHA1

663e7b5b71d08173761d2086f938ff4174ec89da
SHA256

637594d0f918270eb3c5688457af4a431e0b38e082e8d2cab5303334af98c75a
SHA512

edc0742587dd8304ef4d8876103e29cb6fcab2c5eb05e794a052e2262aa44ce30509927ed505021e7b4b03d7843ad32c8b605e25e559e54d5b0e0141976a9f25
SSDEEP

98304:LhY/cesBGKAOVV2TBnorijDD31GoLCjwcFvi7sqf4k4uMvA0eoChs2Wr4nG:LhY/cesBGKAOVV2TBnorijDD3ooGsWiK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
11b2ba4bce28d6559f3cd385bf968f40_NEIKI

Files

11b2ba4bce28d6559f3cd385bf968f40_NEIKI
.exe windows:4 windows x86 arch:x86

0f1baf607fad0761e568d29b092520b9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGetDescriptionA
ImmGetIMEFileNameA
ImmGetDefaultIMEWnd
ImmGetCompositionStringA
ImmGetCompositionWindow
ImmGetProperty
ImmGetContext
ImmGetOpenStatus
ImmSetOpenStatus
ImmGetConversionStatus
ImmSetConversionStatus
ImmReleaseContext
ImmNotifyIME
ImmSetCompositionWindow

dsound

ord1
ord2

dinput8

DirectInput8Create

opengl32

glFogfv
glFogi
wglDeleteContext
wglMakeCurrent
glGetString
wglCreateContext
glClearColor
glTexEnvi
glGetIntegerv
glColor3ub
glTexSubImage2D
glViewport
glBlendFunc
glReadPixels
glGetFloatv
glScalef
glStencilOp
glColorMask
glStencilFunc
glFrontFace
glPolygonMode
glDepthMask
glTexEnvf
glGenTextures
glTexParameteri
glDeleteTextures
glColor3fv
glVertex3fv
glNormal3f
glVertex3f
glMatrixMode
glPushMatrix
glLoadIdentity
glRotatef
glTranslatef
glDepthFunc
glAlphaFunc
glPopMatrix
glClear
glFlush
glBindTexture
glTexImage2D
glColor3f
glBegin
glColor4ub
glTexCoord2f
glVertex2f
glEnd
glDisable
glEnable
glColor4f
glFogf

glu32

gluPerspective
gluOrtho2D

winmm

mmioDescend
mmioOpenA
mmioWrite
mmioRead
timeGetDevCaps
timeEndPeriod
mmioAscend
timeGetTime
mmioClose
timeBeginPeriod

kernel32

TlsFree
TlsAlloc
TlsSetValue
HeapSize
CompareStringW
CompareStringA
GetCPInfo
LCMapStringW
LCMapStringA
FatalAppExitA
HeapReAlloc
GetSystemTimeAsFileTime
HeapAlloc
GetVersion
GetStartupInfoA
GetSystemTime
GetTimeZoneInformation
HeapFree
RaiseException
RtlUnwind
MultiByteToWideChar
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
TlsGetValue
GetACP
GetOEMCP
LeaveCriticalSection
DeleteCriticalSection
InterlockedExchange
InitializeCriticalSection
EnterCriticalSection
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameA
GetTickCount
IsBadReadPtr
lstrlenA
GlobalUnlock
GlobalLock
OutputDebugStringA
GetCurrentThreadId
Sleep
SetHandleCount
GetCommandLineA
CloseHandle
ReadFile
GetFileSize
GetLastError
GetPrivateProfileStringA
GetCurrentDirectoryA
DeleteFileA
CopyFileA
SetFileAttributesA
Process32Next
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
WinExec
FindClose
FindFirstFileA
CreateMutexA
GetLocalTime
GetModuleFileNameA
SetFilePointer
WriteFile
GetSystemDirectoryA
lstrcmpiA
GetVersionExA
QueryPerformanceCounter
SetProcessAffinityMask
SetThreadPriority
SetPriorityClass
GetProcessAffinityMask
GetThreadPriority
GetPriorityClass
GetCurrentThread
GetCurrentProcess
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalMemoryStatus
ExitProcess
SetConsoleMode
GetStdHandle
AllocConsole
FreeConsole
SetConsoleTitleA
GetConsoleTitleA
SetLastError
SetConsoleCursorPosition
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
ReadConsoleOutputA
GetCurrentProcessId
GetModuleHandleA
GetNumberFormatA
FindNextFileA
RemoveDirectoryA
GetFileAttributesA
CreateDirectoryA
GetThreadContext
lstrcpynA
Module32First
Module32Next
SetUnhandledExceptionFilter
GetFileType
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
FlushFileBuffers
GetLocaleInfoW
GetStringTypeA
GetStringTypeW
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
SetEndOfFile
SetConsoleCtrlHandler
CreateFileA

user32

SetWindowTextA
GetWindowTextA
GetCaretPos
GetWindowLongA
GetAsyncKeyState
SetWindowPos
CallWindowProcA
OpenClipboard
GetClipboardData
CloseClipboard
ShowWindow
DestroyWindow
SendMessageA
GetDC
CreateWindowExA
SetFocus
GetFocus
GetScrollPos
SetScrollPos
SetTimer
wsprintfA
IntersectRect
GetDesktopWindow
SetWindowsHookExA
UnhookWindowsHookEx
ClientToScreen
GetWindowThreadProcessId
GetClassNameA
GetSystemMenu
DrawMenuBar
IsWindowVisible
RemoveMenu
EnumChildWindows
wvsprintfA
GetKeyboardLayout
GetKeyboardLayoutNameA
KillTimer
EnumDisplaySettingsA
UpdateWindow
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
SetRect
GetActiveWindow
GetCursorPos
ScreenToClient
GetDoubleClickTime
PtInRect
OffsetRect
MessageBoxA
PostMessageA
IsIconic
AdjustWindowRect
GetSystemMetrics
SetForegroundWindow
LoadIconA
LoadCursorA
RegisterClassA
BeginPaint
EndPaint
PostQuitMessage
DefWindowProcA
SetCapture
ReleaseCapture
SystemParametersInfoA
ReleaseDC
ChangeDisplaySettingsA
ShowCursor
FindWindowA
SetCursorPos
UnregisterHotKey
RegisterHotKey
GetWindowRect
SetWindowLongA
CallNextHookEx

gdi32

SetBkMode
SetPixelFormat
GetStockObject
ChoosePixelFormat
SetTextAlign
CreateFontIndirectA
GetTextExtentExPointA
GetTextExtentPoint32A
CreateFontA
DeleteObject
SelectObject
CreateCompatibleDC
CreateDIBSection
DeleteDC
SetTextColor
SetBkColor
GetTextExtentPointA
TextOutA
SwapBuffers

advapi32

RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA

ole32

CoInitialize
CoCreateInstance
CoUninitialize

ws2_32

socket
WSAGetLastError
send
WSACleanup
WSAStartup
closesocket
recv
inet_addr
gethostbyname
connect
WSAAsyncSelect
setsockopt
htons
shutdown

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wzaudio

wzAudioPlay
wzAudioOption
wzAudioCreate
wzAudioStop
wzAudioDestroy
wzAudioGetStreamOffsetRange

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 180KB - Virtual size: 122.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdate
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0f1baf607fad0761e568d29b092520b9

Headers

File Characteristics

Imports

imm32

dsound

dinput8

opengl32

glu32

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

ws2_32

version

wzaudio

Sections

.text Size: 4.4MB - Virtual size: 4.4MB

.rdata Size: 208KB - Virtual size: 207KB

.data Size: 180KB - Virtual size: 122.2MB

.rsrc Size: 12KB - Virtual size: 8KB

.rdate Size: 31KB - Virtual size: 32KB

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 208KB - Virtual size: 207KB

.data
Size: 180KB - Virtual size: 122.2MB

.rsrc
Size: 12KB - Virtual size: 8KB

.rdate
Size: 31KB - Virtual size: 32KB