8f1e311b5834d04a8a0373eeef04e300_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target
8f1e311b5834d04a8a0373eeef04e300_NEIKI
Size 286KB
Sample240508-24a78aeh69
SHA256 9c9bc6bec04a100f46b6254b3778864fbf6e841039cbd9e72ef0c40e1414dbd7
MD5 8f1e311b5834d04a8a0373eeef04e300
SHA1 acfe4b8a16035499a20d4c6b3bc8ae7c48bc98a7
SHA512 8370906b32b3636e777e01251414cff0caa8f350303b42859170f16311566e75ca5f67048434e2f6e1fd243db60140ec4ac6d72758fc0873e5dff20a00fd3683
SSDEEP 3072:W3GKFNxsSm3hdQSvePiCefLQkD+mgAm7T7dfAPI+TyTNQ3hXafaL0JHLoY46jyIl:a2qSoeTxD+m67HdYfGTe2ohHkX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f1e311b5834d04a8a0373eeef04e300_NEIKI

File Explorer

8f1e311b5834d04a8a0373eeef04e300_NEIKI

.exe 286KB

8f1e311b5834d04a8a0373eeef04e300_NEIKI

IMPHASH ad96801490e9c2cdfd94260239d9d45d
SHA256 9c9bc6bec04a100f46b6254b3778864fbf6e841039cbd9e72ef0c40e1414dbd7
MD5 8f1e311b5834d04a8a0373eeef04e300
SHA1 acfe4b8a16035499a20d4c6b3bc8ae7c48bc98a7
SHA512 8370906b32b3636e777e01251414cff0caa8f350303b42859170f16311566e75ca5f67048434e2f6e1fd243db60140ec4ac6d72758fc0873e5dff20a00fd3683
SSDEEP 3072:W3GKFNxsSm3hdQSvePiCefLQkD+mgAm7T7dfAPI+TyTNQ3hXafaL0JHLoY46jyIl:a2qSoeTxD+m67HdYfGTe2ohHkX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\AFDK\AFDK\x64\Release\AFDK.pdb

kernel32

GetProcAddress InitializeCriticalSectionEx RaiseException DecodePointer GetModuleHandleW MultiByteToWideChar SetEndOfFile WriteConsoleW HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetTimeZoneInformation SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW CreateFileW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CreateProcessW ExitProcess GetProcessHeap LocalFree HeapAlloc HeapFree WriteFile ReadFile CopyFileW GetCurrentProcessId GetLastError GetModuleFileNameA GetCurrentProcess CreateThread CloseHandle GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW RtlUnwind GetCommandLineW GetCommandLineA GetStdHandle GetModuleHandleExW LoadLibraryExW FreeLibrary RtlPcToFileHeader RtlUnwindEx OutputDebugStringW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount SetLastError WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleFileNameW

user32

DispatchMessageA TranslateMessage UnhookWindowsHookEx SetWindowsHookExA GetKeyNameTextA CallNextHookEx GetMessageA GetKeyState

advapi32

RegCreateKeyExW RegCloseKey RegOpenKeyExW RegDeleteValueW RegSetValueExW

shell32

SHGetSpecialFolderPathW

oleaut32

VariantClear

Sharing

General

Malware Config

Signatures

File Explorer

8f1e311b5834d04a8a0373eeef04e300_NEIKI

kernel32

user32

advapi32

shell32

oleaut32

generic