Static task
static1
Behavioral task
behavioral1
Sample
8672e9905950f208a259f364f0a08070_NEIKI.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8672e9905950f208a259f364f0a08070_NEIKI.dll
Resource
win10v2004-20240226-en
General
-
Target
8672e9905950f208a259f364f0a08070_NEIKI
-
Size
2.0MB
-
MD5
8672e9905950f208a259f364f0a08070
-
SHA1
3ad14bac4841b5dac8ef1ecb599bb20ad66b0696
-
SHA256
d45090837856603f5853c7a040cc690f3ca219ba4c36ea30e7aafae1d8d73101
-
SHA512
3c32a30360e1301aa9a6ceaafd7f251ddbf9aad5ac2a1ef7b9c845a1b1ba93dbaf2299e6f9464752e2e935ea2f69ed43247f2a7008d21bdd13b2c3d0a4805cbd
-
SSDEEP
24576:nB++2e1vd0WVrD0Gd5P86FuCCPcxUxobzkd/d4HpfQifEFL1evG0xbL3P9J3:nBdz1D0d6FuCkxobzkmfLGL1ez1X3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8672e9905950f208a259f364f0a08070_NEIKI
Files
-
8672e9905950f208a259f364f0a08070_NEIKI.dll windows:5 windows x86 arch:x86
7b7fd30764f6dbc3a977adae305c6297
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wininet
InternetSetStatusCallbackW
avifil32
AVIFileExit
ws2_32
WSAGetLastError
gdi32
GetEnhMetaFilePaletteEntries
GetICMProfileA
GetWorldTransform
SelectObject
GetAspectRatioFilterEx
GetEnhMetaFileBits
SetSystemPaletteUse
GetCharABCWidthsA
ole32
CoFileTimeNow
msvcrt
srand
fflush
fgets
memset
shlwapi
StrRChrIA
netapi32
NetShareGetInfo
mscms
CloseColorProfile
winmm
midiStreamRestart
midiInStart
midiInGetDevCapsA
rpcrt4
RpcErrorEndEnumeration
advapi32
RegCloseKey
SaferRecordEventLogEntry
AccessCheck
CryptReleaseContext
winspool.drv
SetPortW
user32
PostQuitMessage
GetKBCodePage
SetScrollInfo
CreateDialogIndirectParamA
InflateRect
RealChildWindowFromPoint
TrackPopupMenuEx
ShowWindow
EnumPropsExA
UpdateWindow
GetClipboardSequenceNumber
ChangeDisplaySettingsExW
keybd_event
kernel32
InterlockedPushEntrySList
GetProcessHeap
WaitForSingleObject
GetBinaryTypeA
LeaveCriticalSection
Process32FirstW
GetModuleFileNameW
GetModuleHandleW
LoadLibraryA
GetLargestConsoleWindowSize
WideCharToMultiByte
AssignProcessToJobObject
PostQueuedCompletionStatus
SetLastError
GetModuleFileNameA
oleaut32
GetRecordInfoFromGuids
LoadTypeLibEx
SysStringLen
shell32
SHGetMalloc
ExtractIconA
msacm32
acmGetVersion
Sections
.text Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.data Size: 176KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 808KB - Virtual size: 807KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
4TIs Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CRT Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.code Size: 600KB - Virtual size: 598KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CONST Size: 132KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt1 Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
yh5UY0Qi Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ