8a87217d5008fec298a56278aac1c420_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8a87217d5008fec298a56278aac1c420_NEIKI
Size

4KB
MD5

8a87217d5008fec298a56278aac1c420
SHA1

10551ce59687a58b0cec1df29b08ccf7b2b4104c
SHA256

604e4e6eb4564a82212c9258686c58289596cb289ef0af28b6b3941480e66ff3
SHA512

104bb32bb4c71ec606a8cf80bdfa7ee636d9f5f9afae2814b0e75064dcfb5b0d3b96e0a405d170c70277c04ade5e1d803a5850e34cc3d8ddfcc9535417efa01d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a87217d5008fec298a56278aac1c420_NEIKI

Files

8a87217d5008fec298a56278aac1c420_NEIKI
.dll windows:6 windows x64 arch:x64

35a9e9974c673669c35cafffdf20e1bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentThreadId

Exports

Exports

ClearPointers
LoadPointers
MarkAsLeftover
StorePointers
WibuIsLeftoverModule
tlsDirectorySpace

Sections

.text
Size: 512B - Virtual size: 281B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ