c3831c5e9f018814e417fb0a2007a660_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

c3831c5e9f018814e417fb0a2007a660_NEIKI
Size

36KB
MD5

c3831c5e9f018814e417fb0a2007a660
SHA1

1a183a2aff46c38e7b7dc2cd7b6f4f571572db45
SHA256

1fc2cb011c08b739e2c8fd25763b9ca6f15208c955c3562c3ac078c8e7677be8
SHA512

39709a17df3b71633a11f7558f3d784dacafe22fa0627450777ec0c6c37264bdbce08ddb7d6360511eca0326a323bf18777d303bf5d72c27919265fdb20c9ff8
SSDEEP

384:hnOenRR40LZLtd8aH+ovRt/3x7hOS60tt:hnDnRu0LVH+ovhhOc3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3831c5e9f018814e417fb0a2007a660_NEIKI

Files

c3831c5e9f018814e417fb0a2007a660_NEIKI
.exe windows:4 windows x86 arch:x86

a452f8394c1e5c4ce9411e3a3540ef49

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ltgeolib

?DistanciaPuntos@@YANAAUTPunto@@0@Z
?DamePuntoPorCoord@@YA?AUTPunto@@NNN@Z
?AnguloPuntos0360@@YAXAAUTPunto@@0AANAAH@Z
?TraslacionPuntoPolares@@YAXAAUTPunto@@NN0@Z

generalv

?LeerUnReal@@YAXPA_WAAHAAN@Z
?LeerLineaDeCfg@@YAXPAU_iobuf@@PA_WAA_WAAH3@Z
?fOpen@@YAPAU_iobuf@@PB_W0@Z
?StrCpy@@YAXPA_WPB_W@Z
?StrCat@@YAPA_WPA_WPB_W@Z
?StrChr@@YAPB_WPB_WH@Z
?StrLen@@YAIPB_W@Z
?StrnCmp@@YAHPB_W0I@Z
?CambiarDirectorioDeApp@@YAXXZ

librpost

?FiniPostCut@@YAXAAPAUTRegPst@@HHH@Z
?InsertLineCnc@@YAXPA_WHPAUTRegPst@@AAH@Z
?FormatValue@@YAXNHHHHPA_W@Z
?DameAnguloPasoArco@@YAXNNNNNNHAAN@Z
?DameLineaNumeroDeSub@@YAXPAUTRegPst@@HHPA_W@Z
?DameNumeroLineasDeSub@@YAXPAUTRegPst@@HAAH@Z
?SubHaSidoEjec@@YAXPAUTRegPst@@HAAH@Z
?DameNumeroDeSub@@YAXPAUTRegPst@@AAH@Z
?CreateListPostFiles@@YAXHPA_WAAPAUTRegFilePost@@1AAH@Z
?ScanMecCut@@YAXPAUTRegPst@@AAH1@Z
?EraseListPostFiles@@YAXAAPAUTRegFilePost@@0@Z
?InitPostCut@@YAXPA_W000AAPAUTRegPst@@AAH@Z

mfc80u

ord1079
ord757
ord4032
ord4008
ord6272
ord3795
ord6274
ord4320
ord2054
ord2009
ord3800
ord1007
ord5096
ord6215
ord5378
ord3826
ord1911
ord2925
ord5220
ord5222
ord2239
ord3942
ord4562
ord5226
ord5209
ord5562
ord2531
ord2725
ord2829
ord4301
ord2708
ord2832
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4475
ord4255
ord3327
ord566
ord3677
ord764
ord1198
ord5579

msvcr80

_XcptFilter
fclose
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm
_wcmdln
exit
_initterm_e
_exit
_cexit
__wgetmainargs
_amsg_exit
_CItan
feof

kernel32

InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a452f8394c1e5c4ce9411e3a3540ef49

Headers

File Characteristics

Imports

ltgeolib

generalv

librpost

mfc80u

msvcr80

kernel32

Sections

.text Size: 16KB - Virtual size: 14KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 7KB

.rsrc Size: 4KB - Virtual size: 956B

.text
Size: 16KB - Virtual size: 14KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 7KB

.rsrc
Size: 4KB - Virtual size: 956B