Static task
static1
Behavioral task
behavioral1
Sample
a40c2a4ae2313afc7e14a478d4768400_NEIKI.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a40c2a4ae2313afc7e14a478d4768400_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
a40c2a4ae2313afc7e14a478d4768400_NEIKI
-
Size
6.3MB
-
MD5
a40c2a4ae2313afc7e14a478d4768400
-
SHA1
59a935153374ce06f21b600ed68af1e8b14b1a21
-
SHA256
5646fe27b64a2e06b7c92515294381a61b9c6a21e93fb81d9e03378b60fa04c0
-
SHA512
97129fcf9365a7cdadc2d3c69fec82feaf39175cd19e8e35f8c4720883fa52eddca582a93d991990a7806be9c856540c5c5501dc5297301d3afe85537d41d7ef
-
SSDEEP
49152:IrxUHL083ne1XRRfPHZmOGxXpy2JIvGvm/5/hT3H2KGinS79XkIIm++YVdXz+VQr:8/DVbAK/Ma3N05yNLsLxMS74
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a40c2a4ae2313afc7e14a478d4768400_NEIKI
Files
-
a40c2a4ae2313afc7e14a478d4768400_NEIKI.exe windows:4 windows x64 arch:x64
cbc808c4ca60ff4962d3ac5890dbf643
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
ntdll
NtWaitForSingleObject
ws2_32
WSAGetOverlappedResult
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateIoCompletionPort
CreateThread
CreateWaitableTimerA
DuplicateHandle
ExitProcess
FreeEnvironmentStringsW
GetConsoleMode
GetEnvironmentStringsW
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatus
GetStdHandle
GetSystemInfo
GetThreadContext
LoadLibraryW
LoadLibraryA
ResumeThread
SetConsoleCtrlHandler
SetErrorMode
SetEvent
SetProcessPriorityBoost
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
SuspendThread
VirtualAlloc
VirtualFree
WaitForSingleObject
WriteConsoleW
WriteFile
Sections
.text Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 113KB - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.symtab Size: 426KB - Virtual size: 426KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ