65b0a507516c0673f896eb76042ffee0_NEIKI

Sharing

Copy URL

Twitter E-mail

General

Target

65b0a507516c0673f896eb76042ffee0_NEIKI
Size

401KB
MD5

65b0a507516c0673f896eb76042ffee0
SHA1

953e420af6ccb59a38a31fc553c1c0a6f5fabf01
SHA256

26dc4168518062995cd0e2dbe85795dbb070f29b7274e7a8c81d743e4bd9e3e9
SHA512

00d2a546fada8f2fb0761a002ee9bef9e2ab96374156b4756e36337c534633850752d3db085bc19f42ecab51beaa4f41c2a294f621188060d213345ed2eb3ce9
SSDEEP

6144:L40WRxxbr8w+1aXX4e/fOO0yfkITBgCu96eW:sfx9rjYAX4Qf4ITreW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65b0a507516c0673f896eb76042ffee0_NEIKI

Files

65b0a507516c0673f896eb76042ffee0_NEIKI
.exe windows:5 windows x86 arch:x86

b4a7dd0b79761868c6ceed454919ebd5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
LookupAccountSidW
GetTokenInformation
AdjustTokenPrivileges
StartServiceW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfig2W
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
EnumServicesStatusW
DeleteService
ControlService
CloseServiceHandle
ChangeServiceConfigW

user32

MessageBoxA
CharNextW
LoadStringW
SetWindowLongW
GetWindowLongW
CreateWindowExW
mouse_event
keybd_event
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
SystemParametersInfoW
ShowWindow
SetWindowsHookExW
SetWindowTextW
SetTimer
SetThreadDesktop
SetCursorPos
ReleaseDC
RegisterClassW
PostMessageW
PeekMessageW
OpenInputDesktop
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
KillTimer
IsWindowVisible
GetWindowThreadProcessId
GetWindowTextW
GetSystemMetrics
GetMessageW
GetKeyState
GetIconInfo
GetForegroundWindow
GetDesktopWindow
GetDC
GetCursorPos
GetClassNameW
GetClassInfoW
GetAsyncKeyState
ExitWindowsEx
EnumWindows
EnableWindow
DispatchMessageW
DestroyWindow
DestroyIcon
DefWindowProcW
CloseDesktop
CharUpperW
CharLowerW
CallNextHookEx

kernel32

Sleep
VirtualFree
VirtualAlloc
lstrlenW
lstrcpynW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
SetCurrentDirectoryW
GetCurrentDirectoryW
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
lstrlenA
lstrlenW
lstrcpyW
lstrcmpiW
lstrcatW
WriteFile
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
UnmapViewOfFile
TerminateProcess
SleepEx
Sleep
SetThreadPriority
SetLastError
SetFileTime
SetFilePointer
SetFileAttributesW
SetEvent
SetEndOfFile
ResumeThread
ResetEvent
RemoveDirectoryW
ReadFile
QueryDosDeviceW
PeekNamedPipe
OpenProcess
MoveFileExW
MoveFileW
MapViewOfFile
LocalFree
LocalFileTimeToFileTime
LoadLibraryW
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
GlobalMemoryStatus
GetVolumeInformationW
GetVersionExW
GetTickCount
GetThreadPriority
GetThreadLocale
GetStdHandle
GetLongPathNameW
GetProcessTimes
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetComputerNameW
GetCPInfoExW
GetCPInfo
GetACP
InterlockedExchangeAdd
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExpandEnvironmentStringsW
ExitProcess
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DuplicateHandle
DosDateTimeToFileTime
DeleteFileW
DeleteCriticalSection
CreateProcessW
CreatePipe
CreateFileMappingW
CreateFileW
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringW
CloseHandle
Sleep
GetLogicalDriveStringsW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot

gdi32

SelectPalette
SelectObject
RealizePalette
GetObjectW
GetDeviceCaps
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

mpr

WNetCancelConnection2W

ole32

CoCreateGuid
IsEqualGUID

msvcrt

strchr
atoi
swprintf
memset
memcpy
free
realloc
malloc

ws2_32

WSAIoctl
WSACleanup
WSAStartup
gethostname
gethostbyname
socket
shutdown
setsockopt
sendto
send
select
recvfrom
recv
inet_ntoa
ioctlsocket
connect
closesocket

iphlpapi

GetNetworkParams

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
StrToIntW

psapi

GetModuleFileNameExW

shell32

SHGetFileInfoW
ShellExecuteW

winmm

timeGetTime

Sections

.text
Size: 319KB - Virtual size: 318KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 20KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b4a7dd0b79761868c6ceed454919ebd5

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

gdi32

mpr

ole32

msvcrt

ws2_32

iphlpapi

shlwapi

psapi

shell32

winmm

Sections

.text Size: 319KB - Virtual size: 318KB

.itext Size: 2KB - Virtual size: 1KB

.data Size: 22KB - Virtual size: 22KB

.bss Size: - Virtual size: 20KB

.idata Size: 8KB - Virtual size: 8KB

.didata Size: 512B - Virtual size: 384B

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 23KB - Virtual size: 22KB

.rsrc Size: 24KB - Virtual size: 24KB

.text
Size: 319KB - Virtual size: 318KB

.itext
Size: 2KB - Virtual size: 1KB

.data
Size: 22KB - Virtual size: 22KB

.bss
Size: - Virtual size: 20KB

.idata
Size: 8KB - Virtual size: 8KB

.didata
Size: 512B - Virtual size: 384B

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 23KB - Virtual size: 22KB

.rsrc
Size: 24KB - Virtual size: 24KB