22d2e5d7d018ac6e00368201138a67d0_NEIKI

Sharing

Copy URL

Twitter E-mail

General

Target

22d2e5d7d018ac6e00368201138a67d0_NEIKI
Size

211KB
MD5

22d2e5d7d018ac6e00368201138a67d0
SHA1

ca5d8e59071dc47d9636f9fa551a0360363b7058
SHA256

8c0e6bcb1d5eda7c97f91bd9153bab7c2de2a1d2f4f43114f74f94096fccf76c
SHA512

81b43c615751b45b72c56fbe6cb8f104e5b924b320be693c255c4efb2992884ccf076998e1a95754f50bd8bd6ad7f2472d3510a543a2c21dac3266c9879ee377
SSDEEP

6144:f4KdmpK+ZChUsAdTO23BKIhUCDAfeHJei9v:/k0WsAdd0Ih53nv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22d2e5d7d018ac6e00368201138a67d0_NEIKI

Files

22d2e5d7d018ac6e00368201138a67d0_NEIKI
.exe windows:5 windows x86 arch:x86

2869678fcc1755969994fa450400ba7e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

t:\outlook\x86\ship\0\cnfnot32.pdb

Imports

msvcr90

_controlfp_s
_invoke_watson
_crt_debugger_hook
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_setmbcp
_ismbblead
abort
_expand
_msize
_mbschr
_CxxThrowException
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
isdigit
isspace
_strdup
_splitpath_s
_makepath_s
malloc
free
_wcsicmp
_stricmp
strncpy_s
memmove
wcschr
_vsnprintf
memcpy
__CxxFrameHandler3
wcsncpy_s
??3@YAXPAX@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
memset
_vsnwprintf
?_type_info_dtor_internal_method@type_info@@QAEXXZ

shell32

SHGetFolderPathA

ole32

OleLoad
GetClassFile
OleCreateLinkToFile
OleSetContainedObject
StgOpenStorageOnILockBytes
StgIsStorageILockBytes
CoBuildVersion
CoRegisterClassObject
CoRevokeClassObject
OleSave
ReadClassStg

kernel32

LoadLibraryExW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GetModuleHandleW
GetFileAttributesW
GetVersion
lstrlenA
GetProcessHeap
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
LoadLibraryA
FreeLibrary
GetSystemDefaultLCID
WriteFile
WideCharToMultiByte
GetCurrentProcessId
CloseHandle
MultiByteToWideChar
GetACP
SystemTimeToFileTime
FileTimeToSystemTime
GetTickCount
IsDBCSLeadByte
lstrlenW
RaiseException
GetSystemTime
GetTimeFormatW
GetDateFormatW
FileTimeToLocalFileTime
lstrcmpiA
GetFileAttributesA
GetFileTime
DeleteFileA
GetTempPathA
ReadFile
SetCurrentDirectoryA
GetCurrentDirectoryA
CompareFileTime
WaitForSingleObject
IsBadReadPtr
GetProfileStringA
GetCurrentThreadId
FreeResource
LockResource
LoadResource
FindResourceW
GlobalAddAtomA
GetCurrentThread
TlsSetValue
SizeofResource
TlsGetValue
LocalAlloc
LocalFree
FindResourceA
TlsAlloc
lstrcmpA
lstrcmpW
VirtualProtect
QueryPerformanceCounter
GetSystemTimeAsFileTime
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

user32

GetMessageTime
CallWindowProcA
DefWindowProcA
IsWindowUnicode
GetWindowLongA
IsDialogMessageA
IsDialogMessageW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetWindowLongW
SetWindowLongW
GetMenu
IsWindowEnabled
GetLastActivePopup
GetForegroundWindow
RegisterClassA
CreateWindowExW
GetDlgCtrlID
GetTopWindow
AdjustWindowRectEx
GetClassInfoA
GetClassInfoW
RemovePropA
GetPropA
SetPropA
SetWindowsHookExA
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuA
GetNextDlgTabItem
GetCursorPos
ValidateRect
GetKeyState
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxA
TranslateAcceleratorA
GetDesktopWindow
BringWindowToTop
IsWindowVisible
LoadAcceleratorsA
DestroyMenu
LoadMenuA
WinHelpA
SetMenu
EndDialog
TabbedTextOutA
DrawTextA
GrayStringA
DrawTextW
GetMessagePos
ModifyMenuW
TabbedTextOutW
GetClassNameA
UnregisterClassA
UnregisterClassW
BeginDeferWindowPos
EndDeferWindowPos
DeferWindowPos
GetAsyncKeyState
SendDlgItemMessageA
DrawFocusRect
DrawIcon
CharPrevA
DestroyWindow
IsCharAlphaNumericA
CharNextA
MapDialogRect
MessageBoxW
GetSysColor
ShowWindow
LoadMenuW
GetSystemMetrics
PeekMessageA
CreateWindowExA
MessageBeep
IsWindow
SetCursor
SetForegroundWindow
GetFocus
IsIconic
ScreenToClient
SetFocus
EnableWindow
RedrawWindow
GetClientRect
MoveWindow
PostMessageA
SetRectEmpty
LoadIconA
LoadCursorA
RegisterClassW
DefWindowProcW
PostQuitMessage
LoadStringW
LoadStringA
GetDlgItem
GetWindowTextLengthA
GetWindowTextW
GetWindowTextA
SetWindowTextA
SetWindowTextW
DialogBoxIndirectParamW
GetWindow
SendMessageA
GetDC
ReleaseDC
SetWindowLongA
GetWindowThreadProcessId
GetParent
MonitorFromWindow
GetMonitorInfoA
SystemParametersInfoA
GetWindowRect
OffsetRect
SetWindowPos
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
CreateDialogIndirectParamW

gdi32

SetTextColor
SetMapMode
GetClipBox
PtVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SetBkColor
RestoreDC
SaveDC
DeleteDC
PatBlt
GetTextMetricsA
CreateFontIndirectA
GetObjectA
GetStockObject
GetObjectW
GetDeviceCaps
CreateFontIndirectW
RectVisible
DeleteObject
GetTextExtentPointW
ExtTextOutW
TextOutW

Exports

Exports

_GetAllocCounters@0

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 18KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2869678fcc1755969994fa450400ba7e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr90

shell32

ole32

kernel32

advapi32

user32

gdi32

Exports

Exports

Sections

.text Size: 113KB - Virtual size: 112KB

.data Size: 18KB - Virtual size: 19KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 71KB - Virtual size: 72KB

.text
Size: 113KB - Virtual size: 112KB

.data
Size: 18KB - Virtual size: 19KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 71KB - Virtual size: 72KB