Behavioral task
behavioral1
Sample
12503b9421c4a7867de8ba959bdd7e90_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
12503b9421c4a7867de8ba959bdd7e90_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
12503b9421c4a7867de8ba959bdd7e90_NEIKI
-
Size
1.9MB
-
MD5
12503b9421c4a7867de8ba959bdd7e90
-
SHA1
4de3d4d84dabfe581de1f124bda9278e259d4794
-
SHA256
a45ac6b131b804903dc03f4dfe6cd536c1e5f4572547d7f2e2d9c0b6f42f279a
-
SHA512
212e181f11fb845fec53cf83d10f72f63ceef139b6341519df146950c5c7425f01420040fe7f80a06579b09673616518c1edf5a72fd9536f706bedad22016853
-
SSDEEP
49152:jzfsbVk4DS0Gl9B0nZiRFJutcC04hRuTaVp1QTl/XSIGpBUT:jAbVkQGl9B+GFUtcX4C6el/JGLQ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 12503b9421c4a7867de8ba959bdd7e90_NEIKI
Files
-
12503b9421c4a7867de8ba959bdd7e90_NEIKI.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 68KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ktlju Size: 512B - Virtual size: 4KB
.wu Size: 512B - Virtual size: 4KB
.data Size: 512B - Virtual size: 4KB
.nbd Size: 512B - Virtual size: 4KB
.text Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ