6d8a5fb28429fc43b93829dcc2867b10_NEIKI | Triage

Sharing

General

Target

6d8a5fb28429fc43b93829dcc2867b10_NEIKI
Size

227KB
MD5

6d8a5fb28429fc43b93829dcc2867b10
SHA1

6ed3997ac5bffd6d4caaa88a8bd65cf2d185560b
SHA256

6c3ef9025ed42cce5f7de7e3d2b30500138fdaa0918d47a00984a696f51adfbc
SHA512

619380d252cc184003e1b56021288f8761a7000603cdcf191986f7228bc3695f62d94c61e3bb24ff32a92d6d013178ba07a2fe34ed93d61c7032b6a4ab708422
SSDEEP

6144:6Rh8kXpF13fIRmPXP8AYxrtAbUR6A8U50yWEm:U/D6o3YAbURT8U50nEm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d8a5fb28429fc43b93829dcc2867b10_NEIKI

Files

6d8a5fb28429fc43b93829dcc2867b10_NEIKI
.exe windows:1 windows x86 arch:x86

efd64979adc7f9e8aae1d77756433b49

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
RtlUnwind
GetModuleHandleW

crtdll

__GetMainArgs
exit
raise
signal

ulib

??1ARGUMENT_LEXEMIZER@@UAE@XZ
??0DSTRING@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
??0ARRAY@@QAE@XZ
??0ARGUMENT_LEXEMIZER@@QAE@XZ
??0FLAG_ARGUMENT@@QAE@XZ
?Initialize@ARRAY@@QAEEKK@Z
?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z
?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z

ntdll

RtlFreeHeap

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ