12ab863021153df6d29e0a78f6b33660_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

12ab863021153df6d29e0a78f6b33660_NEIKI
Size

1.2MB
MD5

12ab863021153df6d29e0a78f6b33660
SHA1

866d6765d9645833a20d22e03aab9df5623cdfbf
SHA256

a75ad9c79ef144d17e9a334954b046bae7db33dc1ae9bbb2f0dfdbf6c9e38bf5
SHA512

fb744637490212c8739df975fd0ae069661a10bb73efe6233184a9f814f0fbeed07c8400b1a6d017ecb3657ac9bab86357d9772ae59355f2bca3d7677013d3d0
SSDEEP

12288:eHClURwug18+tdBxpn49pDl9NrnwWzLJAOoIDNLuP0HxnhPfcx7L3yaNJDf/Uwv/:+IYDlLwYLuOoIrnU7bD3oOums/ld

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12ab863021153df6d29e0a78f6b33660_NEIKI

Files

12ab863021153df6d29e0a78f6b33660_NEIKI
.exe windows:6 windows x86 arch:x86

f98fc127a5eca3ccf5575df7351c7a65

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Package\DiskRecover\OnlineInstaller\SG\Release\PackageInstaller.pdb

Imports

shlwapi

PathIsRelativeW
PathFileExistsW

winmm

timeGetTime
timeKillEvent
timeSetEvent

comctl32

_TrackMouseEvent
ord17

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

gdiplus

GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipDeleteFont
GdipSetStringFormatTrimming
GdipCreateFontFromDC
GdipDrawRectangleI
GdipDrawBezierI
GdipSetSmoothingMode
GdipDrawLineI
GdipFillRectangle
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePath
GdipTransformPath
GdipIsOutlineVisiblePathPointI
GdipIsVisiblePathPointI
GdipGetPathWorldBoundsI
GdipAddPathPolygonI
GdipAddPathPieI
GdipAddPathArcI
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipSetStringFormatFlags
GdipFillEllipseI
GdipDrawPath
GdiplusStartup
GdiplusShutdown
GdipFillPath
GdipMeasureString
GdipTranslateMatrix
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipDrawString
GdipDeleteStringFormat
GdipCreateFontFromLogfontA
GdipRotateMatrix
GdipAddPathCurveI
GdipAddPathBezierI
GdipAddPathLine2I
GdipAddPathLineI
GdipClosePathFigure
GdipStartPathFigure
GdipGetPathFillMode
GdipSetPathFillMode
GdipResetPath
GdipClonePath
GdipCreatePath
GdipCreateTexture
GdipCreateBitmapFromHBITMAP
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDeletePen
GdipGetPenDashStyle
GdipSetPenDashStyle
GdipGetPenLineJoin
GdipSetPenLineJoin
GdipGetPenDashCap197819
GdipGetPenEndCap
GdipGetPenStartCap
GdipSetPenDashCap197819
GdipSetPenEndCap
GdipSetPenStartCap
GdipSetPenColor
GdipGetPenWidth
GdipSetPenWidth
GdipClonePen
GdipCreatePen1
GdipCreateBitmapFromFile
GdipScaleMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCreateHBITMAPFromBitmap
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipDrawEllipseI

msimg32

AlphaBlend

ws2_32

__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
recv
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
send
WSAGetLastError
bind
connect
closesocket

wldap32

ord301
ord147
ord219
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord145

advapi32

CryptGetHashParam
CryptEncrypt
RegCreateKeyExW
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
RegOpenKeyExW
CryptReleaseContext
RegCloseKey
CryptAcquireContextW
RegSetValueExW
RegQueryValueExW

kernel32

GetFileInformationByHandle
GetDriveTypeW
GetFileAttributesExW
WriteConsoleW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
SwitchToThread
EncodePointer
GetStringTypeW
GetCurrentDirectoryW
DeleteFileW
GetFileAttributesW
FindClose
FindFirstFileW
CreateDirectoryW
SystemTimeToTzSpecificLocalTime
HeapAlloc
HeapFree
OpenProcess
GetFileSizeEx
FlushFileBuffers
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
SetStdHandle
SetEndOfFile
GetFullPathNameW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
Process32NextW
FormatMessageA
SetLastError
SetFilePointerEx
PeekNamedPipe
GetFileType
WaitForSingleObjectEx
MoveFileExA
CreateMutexW
GetSystemDirectoryW
SleepEx
SetEnvironmentVariableW
FreeLibrary
FindNextFileW
GetEnvironmentVariableW
GetCurrentProcessId
GetModuleHandleA
MultiByteToWideChar
GlobalAlloc
GlobalUnlock
GlobalSize
GlobalLock
MulDiv
QueryPerformanceCounter
GetSystemTimeAsFileTime
SystemTimeToFileTime
QueryPerformanceFrequency
FileTimeToSystemTime
LocalFileTimeToFileTime
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
TerminateThread
GetCurrentThreadId
SetThreadPriority
ResetEvent
SetEvent
CreateEventW
Process32FirstW
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
VirtualQuery
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
ExitProcess
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetEnvironmentVariableA
GetStdHandle
WaitForMultipleObjects
GlobalFree
CreateProcessW
FormatMessageW
LocalFree
Sleep
WideCharToMultiByte
GetDiskFreeSpaceW
CreateFileW
GetFileSize
CloseHandle
ReadFile
SetFilePointer
WriteFile
GetTickCount
TerminateProcess
GetCurrentProcess
LoadLibraryW
GetProcAddress
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
LoadResource
LockResource
SizeofResource
FindResourceW
GetModuleHandleW
DecodePointer
WaitForSingleObject
GetModuleFileNameW
VerSetConditionMask
VerifyVersionInfoW
FreeResource
GetExitCodeProcess
GetNativeSystemInfo
CreateToolhelp32Snapshot

user32

MapWindowPoints
FindWindowW
GetParent
UnionRect
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
CharNextW
GetKeyState
GetAsyncKeyState
GetSysColor
ClientToScreen
SetCursor
PtInRect
UpdateLayeredWindow
IntersectRect
IsRectEmpty
GetUpdateRect
EndPaint
BeginPaint
ReleaseCapture
SetCapture
GetFocus
GetCursorPos
InvalidateRect
GetDC
GetPropW
SetPropW
CallWindowProcW
GetSystemMetrics
SetFocus
EnableWindow
GetWindow
GetClassInfoExW
RegisterClassW
LoadCursorW
ReleaseDC
SetWindowTextW
IsWindowVisible
ShowWindow
IsWindow
MoveWindow
SetWindowLongW
SetWindowRgn
GetDesktopWindow
MessageBoxW
GetClientRect
SetWindowPos
SetForegroundWindow
PostQuitMessage
UnregisterClassW
SendMessageW
KillTimer
TranslateMessage
GetQueueStatus
CallMsgFilterW
MsgWaitForMultipleObjectsEx
PeekMessageW
SetTimer
DispatchMessageW
RegisterClassExW
WaitMessage
CreateWindowExW
DestroyWindow
PostMessageW
DefWindowProcW
GetWindowLongW
IsIconic
IsZoomed
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
ScreenToClient
OffsetRect
GetWindowRect

gdi32

DeleteObject
CreateRoundRectRgn
GetStockObject
CreateFontIndirectW
SelectObject
BitBlt
GetDeviceCaps
CreateDIBSection
StretchBlt
CreateCompatibleDC
DeleteDC
SaveDC
RestoreDC
GetWindowOrgEx
SetWindowOrgEx
SetStretchBltMode
GetObjectA
CreateRectRgnIndirect
ExtSelectClipRgn
GetObjectW

shell32

CommandLineToArgvW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CoCreateGuid
CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemFree

urlmon

URLDownloadToFileW

wininet

DeleteUrlCacheEntryW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 832KB - Virtual size: 831KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f98fc127a5eca3ccf5575df7351c7a65

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

winmm

comctl32

imm32

gdiplus

msimg32

ws2_32

wldap32

advapi32

kernel32

user32

gdi32

shell32

ole32

urlmon

wininet

version

Sections

.text Size: 832KB - Virtual size: 831KB

.rdata Size: 174KB - Virtual size: 173KB

.data Size: 17KB - Virtual size: 29KB

.rsrc Size: 159KB - Virtual size: 159KB

.reloc Size: 41KB - Virtual size: 41KB

.text
Size: 832KB - Virtual size: 831KB

.rdata
Size: 174KB - Virtual size: 173KB

.data
Size: 17KB - Virtual size: 29KB

.rsrc
Size: 159KB - Virtual size: 159KB

.reloc
Size: 41KB - Virtual size: 41KB