97fe3f405e5df8087eefc66d9bd285d0_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

97fe3f405e5df8087eefc66d9bd285d0_NEIKI
Size

119KB
MD5

97fe3f405e5df8087eefc66d9bd285d0
SHA1

8e6c09043dee5fa37cc836d39453f0ddaa27f2af
SHA256

0098955f57dca59f6289358665d45a590bdecdc255e5d0c83adaf970952f3f64
SHA512

4f96060249f026f3aa93037f481ed1a96871db0282a2f5610e596672ff1b2374bba2ea293a879d618410b01e51e92b0d4711fbb062813f4a6f0358a86087dae7
SSDEEP

3072:MQnuQw/VlCMJ1frOxJ2kQBvCOMd7HFotyx6jKre8Cza/nLfh:OmxdQBaVutyLre8Sa/Lfh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97fe3f405e5df8087eefc66d9bd285d0_NEIKI

Files

97fe3f405e5df8087eefc66d9bd285d0_NEIKI
.exe windows:4 windows x86 arch:x86

7ce78ad3c717ee214aa5301febfb3a7e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32First
Wow64SetThreadContext
GetApplicationRestartSettings
DeleteVolumeMountPointA
SetSearchPathMode
AcquireSRWLockShared
GetApplicationRecoveryCallbackWorker
VirtualAllocEx
SetFileApisToANSI

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE