a085204924aa0fea675c1ba359d85870_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a085204924aa0fea675c1ba359d85870_NEIKI
Size

119KB
MD5

a085204924aa0fea675c1ba359d85870
SHA1

e4fa33657704c0c13f4d054861b3599fccc5f59c
SHA256

9b6be0525d1bfdc4ea9cd603f313a9312b0f0b51f3cdd13ae283942bc1db302d
SHA512

82fa09161002f876c40758b6b980d6cc3254f86bca7f59948c96d18074499d30b6859877a8005e2c6db0d46c2bb80531eaa80cf145aee975868c502bc3a6672e
SSDEEP

3072:y0i/7I5RBYqSUOVXjLL8EGZnDXKrJDwmLqa1wbf4:xiDI5RoUOVX/KtDXK11qekA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a085204924aa0fea675c1ba359d85870_NEIKI

Files

a085204924aa0fea675c1ba359d85870_NEIKI
.exe windows:4 windows x86 arch:x86

a6f2f68087dfc2b0f4996bdc935b4344

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryA
SetCurrentDirectoryA
RegQueryInfoKeyA
CloseThreadpoolCleanupGroupMembers
GetConsoleNlsMode
ContinueDebugEvent
FreeConsole
GetVolumePathNamesForVolumeNameA
InterlockedPopEntrySList

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE