978c0fc3a1961d78bd36ec4af95aeb10_NEIKI | Triage

Sharing

General

Target

978c0fc3a1961d78bd36ec4af95aeb10_NEIKI
Size

119KB
MD5

978c0fc3a1961d78bd36ec4af95aeb10
SHA1

2802f77c724e69f8bd3aac875ecbd08f4ea98178
SHA256

9d36a1d65ccf51dec3c6963f2d88b5bc949e029856ba6a05b5ca830d23c2a68b
SHA512

98fd4d62ad6790d19a14e34297c1ad74eafe2bdb38ecb9696261499c43138b2065631ed46ed69ebeeb4350fe4dc40dedfc309a29640fc9b39a02fa37d85cd8bb
SSDEEP

3072:sJnorYRqjV2o/aD4niVgigPVOMANvyEqPPwUU:cor++2o1/rJ4vyVg3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
978c0fc3a1961d78bd36ec4af95aeb10_NEIKI

Files

978c0fc3a1961d78bd36ec4af95aeb10_NEIKI
.exe windows:4 windows x86 arch:x86

462fc0b20bf8e5e3cfb04ce92c6a55b5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessPriorityBoost
CopyContext
QuirkIsEnabledForPackage3Worker
GetCurrentThread
PeekConsoleInputW
GetCurrentActCtx
SwitchToFiber
GetOverlappedResult
IsNativeVhdBoot
DosPathToSessionPathW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE