Static task
static1
Behavioral task
behavioral1
Sample
8de3cc0fc52d46baa355054d62c872f0_NEIKI.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8de3cc0fc52d46baa355054d62c872f0_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
8de3cc0fc52d46baa355054d62c872f0_NEIKI
-
Size
172KB
-
MD5
8de3cc0fc52d46baa355054d62c872f0
-
SHA1
082445a14b9db6b528394e310b4b09ab669c436b
-
SHA256
3c471924ec713152c1c14207d028da528c0594772fe9acdfda5a4a0041ed4825
-
SHA512
4e17c4e01b4ed8c96fec1df5a2bd8b51dbc71d30d86698e20a6d2d50711ae9632f6700cb79d10a0fdb745758b8f6c579a8d6a44d810a456ef64721d59d4e4100
-
SSDEEP
1536:nqEHbxcidXWjK8MDD1mK/UZFqy0nJUwLccFMmmjUjoNF2h:qE7aCGj5MDD1CZFqxnJ6ciUjoNF8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8de3cc0fc52d46baa355054d62c872f0_NEIKI
Files
-
8de3cc0fc52d46baa355054d62c872f0_NEIKI.exe windows:4 windows x86 arch:x86
3d81fe5729e5af52a2e4c2360e5a5e8d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
GetVersion
ExitProcess
DebugBreak
GetStdHandle
WriteFile
InterlockedDecrement
OutputDebugStringA
GetProcAddress
LoadLibraryA
InterlockedIncrement
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapFree
VirtualFree
RtlUnwind
GetLastError
ReadFile
IsBadWritePtr
IsBadReadPtr
HeapValidate
SetConsoleCtrlHandler
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
SetFilePointer
FlushFileBuffers
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
CloseHandle
Sections
.text Size: 136KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ