6c63d59799efa393544566f57df960a0_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

6c63d59799efa393544566f57df960a0_NEIKI
Size

536KB
MD5

6c63d59799efa393544566f57df960a0
SHA1

4bf35ae3c8a580ea7c68b0e9f20b6f4c69a08772
SHA256

f2c4f9ae2a32553a8c295bd1e858ee5ebfa07c3c7b55781733ee5771a9306362
SHA512

77b380cce76a1d0314a6626568f1ad07d4fb4137ceb7b13da837e433498585020a07d37c1914e01f0242b423a1881d717ee509f1e8e984cee9c91fb411ec8c1c
SSDEEP

12288:iReLY3A+ErJ81TmaYbv0gK9isIj7tFobHFJ:rGA/daCsgK9RuxFoL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c63d59799efa393544566f57df960a0_NEIKI

Files

6c63d59799efa393544566f57df960a0_NEIKI
.exe windows:4 windows x86 arch:x86

a12c7564e3054a331b2b3835a1d32eb6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\DLL_SETUP\asset_explorer_build\agent\windows\tcp\CustomActions.pdb

Imports

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
CryptReleaseContext
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptDecrypt
OpenProcessToken
CreateProcessAsUserW

wininet

InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestExW
InternetQueryOptionW
InternetSetOptionW
HttpEndRequestW
HttpQueryInfoW
InternetCloseHandle
InternetReadFile

kernel32

SetEnvironmentVariableA
CompareStringW
CompareStringA
VirtualQuery
SetEndOfFile
lstrlenA
GetLocaleInfoW
RaiseException
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CloseHandle
FlushFileBuffers
WriteFile
lstrlenW
Sleep
GetLastError
CreateFileW
SetCurrentDirectoryW
InitializeCriticalSection
CreateDirectoryA
DeleteFileA
MoveFileA
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
GetExitCodeProcess
TerminateProcess
WaitForSingleObject
CreateProcessW
Process32NextW
ProcessIdToSessionId
Process32FirstW
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryW
SetLastError
LocalFree
FormatMessageW
SystemTimeToFileTime
GetSystemTime
GetVersionExW
OpenProcess
CreateDirectoryW
GetTempPathW
HeapValidate
IsBadReadPtr
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
GetLocalTime
RtlUnwind
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
DeleteCriticalSection
FatalAppExitA
GetModuleFileNameA
GetModuleFileNameW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
InterlockedIncrement
InterlockedDecrement
GetModuleHandleA
ExitProcess
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFullPathNameA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
MultiByteToWideChar
ReadFile
SetFilePointer
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryA
FreeLibrary
InterlockedExchange
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeZoneInformation
CreateFileA

Exports

Exports

InitLogger
Log

Sections

.text
Size: 428KB - Virtual size: 425KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a12c7564e3054a331b2b3835a1d32eb6

Headers

File Characteristics

PDB Paths

Imports

advapi32

wininet

kernel32

Exports

Exports

Sections

.text Size: 428KB - Virtual size: 425KB

.rdata Size: 88KB - Virtual size: 84KB

.data Size: 8KB - Virtual size: 14KB

.idata Size: 8KB - Virtual size: 5KB

.text
Size: 428KB - Virtual size: 425KB

.rdata
Size: 88KB - Virtual size: 84KB

.data
Size: 8KB - Virtual size: 14KB

.idata
Size: 8KB - Virtual size: 5KB