ecd8080d759c475ed877d6f6db30bae0_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

ecd8080d759c475ed877d6f6db30bae0_NEIKI
Size

152KB
MD5

ecd8080d759c475ed877d6f6db30bae0
SHA1

b09928c345c1e95c9427f8bed4729f82b40fa742
SHA256

f2c00d7abbe2025138a66b4e43058a4d4f03b9a06f807ff38f3448458eb5836f
SHA512

893c96b455424e806c80a9482cce84b86dad065e6965d7723a572d8ed31a9b7a790a7703a63b923e7d7635ee481fc686729507c5ac56ce926ee77246eaa7b8c0
SSDEEP

3072:AaI0jf4VlQhdv/HAFHJ7AZTHXhiqdI7EJC:J9PCJiXu7EJC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ecd8080d759c475ed877d6f6db30bae0_NEIKI

Files

ecd8080d759c475ed877d6f6db30bae0_NEIKI
.exe windows:6 windows x64 arch:x64

fde62cefd7c611f7d5531325518a44b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

llama

ggml_scale
ggml_argsort
ggml_mul_mat_id
ggml_mul_mat
ggml_timestep_embedding
ggml_rms_norm
ggml_norm
ggml_leaky_relu
ggml_cpy
ggml_concat
ggml_pad
ggml_upscale
ggml_cont
ggml_view_2d
ggml_permute
ggml_format_name
ggml_dup
ggml_add
ggml_acc
ggml_mul
ggml_div
ggml_sqr
ggml_sum_rows
ggml_time_us
ggml_backend_compare_graph_backend
ggml_backend_reg_init_backend
ggml_pool_2d
ggml_im2col
ggml_clamp
ggml_backend_reg_get_name
ggml_backend_reg_get_count
ggml_backend_is_cpu
ggml_backend_cpu_init
ggml_backend_supports_op
ggml_backend_graph_compute
ggml_backend_synchronize
ggml_backend_tensor_get
ggml_backend_tensor_set
ggml_backend_free
ggml_backend_name
ggml_backend_buffer_free
ggml_backend_alloc_ctx_tensors
ggml_internal_get_type_traits
ggml_quantize_chunk
ggml_quantize_requires_imatrix
ggml_quantize_free
ggml_graph_overhead_custom
ggml_graph_overhead
ggml_new_graph_custom
ggml_new_graph
ggml_rope
ggml_soft_max_ext
ggml_build_forward_expand
ggml_diag_mask_inf
ggml_unary
ggml_flash_attn_ext
ggml_repeat
ggml_arange
ggml_get_rows
ggml_group_norm
ggml_transpose
ggml_get_next_tensor
ggml_get_first_tensor
ggml_new_tensor_4d
ggml_new_tensor_3d
ggml_new_tensor_2d
ggml_new_tensor_1d
ggml_new_tensor
ggml_free
ggml_init
ggml_tensor_overhead
ggml_is_quantized
ggml_op_desc
ggml_type_name
ggml_row_size
ggml_blck_size
ggml_nbytes
ggml_nrows
ggml_nelements
ggml_print_backtrace
ggml_fp16_to_fp32

msvcp140

?_Random_device@std@@YAIXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_hardware_concurrency
_Thrd_join
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__current_exception
__C_specific_handler
memset
memmove
memcpy
memcmp
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_purecall
__current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_c_exit
__p___argv
__p___argc
_beginthreadex
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
terminate
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
exit
abort
_set_app_type
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
fflush
__stdio_common_vsprintf_s
__stdio_common_vsprintf
__stdio_common_vfprintf
_set_fmode

api-ms-win-crt-math-l1-1-0

_fdsign
sqrtf
__setusermatherr

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_set_new_mode
free

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fde62cefd7c611f7d5531325518a44b7

Headers

DLL Characteristics

File Characteristics

Imports

llama

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Sections

.text Size: 120KB - Virtual size: 119KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 664B

.text
Size: 120KB - Virtual size: 119KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 664B