3c0c34731ee8619fdd12f8918ea56470_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

3c0c34731ee8619fdd12f8918ea56470_NEIKI
Size

7.4MB
MD5

3c0c34731ee8619fdd12f8918ea56470
SHA1

5a9d396a461acdf5b01c381864db093235762a8e
SHA256

32fd9f1e9f68892e30af4f7f7744e27587c832d795316acc2f59a126398a43ed
SHA512

163e5f5925a5ca84fcf7c156b19eb8df9c3c939b4159d23e081090d64dff4dca84a978e337ce014002b34bf445585c2e84c66a68c7721abc4f1d1dab18f1143e
SSDEEP

98304:31AJwmv+Uty4fEKXq10BenEuppg/MRGgr5wSP+kYZX7WmR5kBGsNfRbObCdDzzIq:xmv+UtyWl1eEuppLr5vYZXKPB3bOsD5

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c0c34731ee8619fdd12f8918ea56470_NEIKI

Files

3c0c34731ee8619fdd12f8918ea56470_NEIKI
.exe windows:6 windows x64 arch:x64

dc7a2183f67acb61b685c9400113482a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

OpenProcessToken

bcrypt

BCryptGenRandom

kernel32

GetConsoleCP
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

ole32

CoWaitForMultipleHandles

user32

LoadStringW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

wtsapi32

WTSSendMessageW

Exports

Exports

DotNetRuntimeDebugHeader

Sections

.text
Size: - Virtual size: 471KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc7a2183f67acb61b685c9400113482a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

kernel32

ole32

user32

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 471KB

.managed Size: - Virtual size: 1.8MB

.rdata Size: - Virtual size: 2.0MB

.data Size: - Virtual size: 226KB

.pdata Size: - Virtual size: 174KB

_RDATA Size: - Virtual size: 252B

.vmp0 Size: - Virtual size: 3.7MB

.vmp1 Size: 7.4MB - Virtual size: 7.4MB

.reloc Size: 512B - Virtual size: 216B

.rsrc Size: 6KB - Virtual size: 5KB

.text
Size: - Virtual size: 471KB

.managed
Size: - Virtual size: 1.8MB

.rdata
Size: - Virtual size: 2.0MB

.data
Size: - Virtual size: 226KB

.pdata
Size: - Virtual size: 174KB

_RDATA
Size: - Virtual size: 252B

.vmp0
Size: - Virtual size: 3.7MB

.vmp1
Size: 7.4MB - Virtual size: 7.4MB

.reloc
Size: 512B - Virtual size: 216B

.rsrc
Size: 6KB - Virtual size: 5KB