df8c0b656616430dfbf79af8ac728d70_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

df8c0b656616430dfbf79af8ac728d70_NEIKI
Size

264KB
MD5

df8c0b656616430dfbf79af8ac728d70
SHA1

ee2db19a8ed957942fc0cb1a5c6f671bee505dd2
SHA256

d27685d16655c91285c5b3a6eec3b830f638b067d8c2aa02288a94d438f77dad
SHA512

7ff32e1bc572edbfe58e0a22775d07be1c5ed9182beb33c97f9e9ca7b403e056cd9745e85859ba179c852337d40ab50b541fb661369e9baaf07bb71ba43bf787
SSDEEP

3072:V3cNK7Xv5aaxoU5dwgQU0bxERNGeKKArDsLP2tjPSH:eMLPpRQU0bORMJrDAyOH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df8c0b656616430dfbf79af8ac728d70_NEIKI

Files

df8c0b656616430dfbf79af8ac728d70_NEIKI
.dll windows:4 windows x86 arch:x86

364c8c5173a421dab8280b2cb9c50328

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFlags
GlobalHandle
lstrcpyA
GetModuleFileNameA
GlobalSize
GetWindowsDirectoryA
lstrcatA
FreeLibrary
LoadLibraryA
GetProfileStringA
LoadResource
FindResourceA
LockResource
lstrcmpA
lstrcmpiA
ReadFile
SetFilePointer
WriteFile
CloseHandle
CreateFileA
GetTempFileNameA
GetTempPathA
GlobalReAlloc
lstrlenA
GetShortPathNameA
GetFullPathNameA
FindClose
FileTimeToDosDateTime
FileTimeToLocalFileTime
FindFirstFileA
SystemTimeToFileTime
GetSystemTime
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
DosDateTimeToFileTime
MultiByteToWideChar
SetFileTime
LocalFileTimeToFileTime
SetErrorMode
GetLastError
GetCurrentDirectoryA
GetLogicalDrives
GetDiskFreeSpaceA
FlushFileBuffers
GlobalFree
GetVersionExA
GlobalLock
GlobalUnlock
GlobalAlloc
MoveFileA
DeleteFileA
HeapReAlloc
SetStdHandle
GetStringTypeW
GetStringTypeA
SetEndOfFile
RtlUnwind
GetCPInfo
GetACP
GetEnvironmentStringsW
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
GetProcAddress
GetModuleHandleA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
LCMapStringW
LCMapStringA
GetEnvironmentStrings
GetStdHandle
GetOEMCP
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte

user32

GetClipboardData
SetClipboardData
LoadStringA
CharLowerA
CloseClipboard
OpenClipboard

advapi32

RegCloseKey
RegQueryValueA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA

ole32

StgSetTimes

mpr

WNetCancelConnectionA
WNetAddConnectionA

Exports

Exports

ABdivC
CFFormat
CFInstallSFM
CFUninstallSFM
DBAppend
DBCallBack
DBFile
DBHeap
DBPort
DBPrintf
DBVPrintf
EndTranslation
FMBufAllowBuffering
FMBufInitReqParms
FMBufRequestBuffering
FMBufSetDfltBuffering
FMCheckAccess
FMClose
FMCopy
FMCopyEx
FMCreateSpec
FMCreateTempName
FMDelete
FMExtractDirectory
FMFileExists
FMFileHasExt
FMFlush
FMFullName
FMGetDiskFreeSpace
FMGetEOF
FMGetPhysSize
FMGetRootPathName
FMISetTime
FMInstall
FMLocateExt
FMLocateName
FMNewToOld
FMOpen
FMOpenCreate
FMRead
FMRename
FMSameFile
FMSeek
FMSeqRead
FMSeqWrite
FMSetEOF
FMSysTime
FMTell
FMTime
FMTransFSpec
FMUninstall
FMWInitFS
FMWrite
FileSpec5to6
FormatDateTime
LABdivCpZ
LzwCmClose
LzwCmOpen
LzwCmStrip
LzwDeChunk
LzwDeClose
LzwDeOpen
MFHandle
MFInstallSFM
MFUninstallSFM
MMAllocLargest
MMGetPointer
MMGlobalFixAlloc
MMGlobalFixFree
MMGlobalFixReAlloc
MMResizeHandle
StartTranslation
SwapBitField
TransFileSpec
TransText
VDICheckFile
VMBuildLangPath
VMErrorStr
VMFreeDLLResHdl
VMGetDLLResHdl
VMGetSystemVersion
VMRevision
VMSetDLLLanguage
addABC
lsprintf
lvsprintf
swapb
swapw
vmemcmp
vmemcpy
vmemset
vrGetItLockIt
vrGetResource
vrGetShortInt
vrLoadString
vrLockResource
vrUnlockResource
vstrcat
vstrcmp
vstrcmpi
vstrcpy
vstrlen
vstrncmp
vstrncmpi
vstrncpy
vwordset

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

364c8c5173a421dab8280b2cb9c50328

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

mpr

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 2KB

.text Size: 188KB - Virtual size: 188KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 188KB - Virtual size: 188KB