29f85affb4e59cd9e9eda2e0011c24f0_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

29f85affb4e59cd9e9eda2e0011c24f0_NEIKI
Size

528KB
MD5

29f85affb4e59cd9e9eda2e0011c24f0
SHA1

9149c24ba4baa63473be6ba88af254c56aeb5619
SHA256

d5357a0f4da6efee4abcce5c39c241f800053e65fa1b8678911b0b8bc5893a39
SHA512

3342b3ff236ab944bd47f12b3304810fe464112011174fdc9e04569c6bcdfa5330ced2bb814b6f206a38475e6cf3e035a86fb4f6c7117a76d1e40d0470540fb5
SSDEEP

12288:Kt50VzEgvd5iCmnPoqDDaveNw4lIPlGcD8s9:lVQ2d5iCeO4SwcV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29f85affb4e59cd9e9eda2e0011c24f0_NEIKI

Files

29f85affb4e59cd9e9eda2e0011c24f0_NEIKI
.exe windows:4 windows x86 arch:x86

4754bed3d2b84108516efa78fba0451c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFullPathNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
CreateThread
ExitThread
RtlUnwind
ExitProcess
TerminateProcess
HeapFree
HeapAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RaiseException
HeapReAlloc
HeapSize
GetACP
UnhandledExceptionFilter
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
FlushFileBuffers
VirtualFree
VirtualAlloc
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetCurrentProcess
SetErrorMode
GetProfileStringA
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcpynA
MulDiv
SetLastError
LocalFree
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GetModuleHandleA
GetProcAddress
GlobalUnlock
GlobalFree
GlobalLock
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThreadId
InterlockedExchange
IsBadWritePtr
ResumeThread
DeleteCriticalSection
InitializeCriticalSection
GetFileSize
GetCurrentThread
GetTickCount
InterlockedDecrement
DeleteFileA
CreateFileA
SetEvent
WaitForMultipleObjects
GetExitCodeThread
InterlockedIncrement
MoveFileExA
SetFilePointer
GetVolumeInformationA
WriteFile
CreateEventA
ReadFile
GetOverlappedResult
FindFirstFileA
FindClose
CreateDirectoryA
InterlockedExchangeAdd
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
lstrcatA
lstrlenA
WinExec
lstrcpyA
GetWindowsDirectoryA
Sleep
LoadLibraryA
FreeLibrary
TerminateThread
GetCommandLineA
WritePrivateProfileStringA
GetModuleFileNameA
FindResourceA
SizeofResource
LoadResource
LockResource
GetCurrentProcessId
GetPrivateProfileIntA
GetPrivateProfileStringA
GetDiskFreeSpaceExA
GetLastError
GetStartupInfoA
CreateProcessA
WaitForSingleObject
CloseHandle
HeapCreate

user32

ScreenToClient
AdjustWindowRectEx
SetFocus
MapWindowPoints
SendDlgItemMessageA
UpdateWindow
IsDialogMessageA
SetWindowTextA
ShowWindow
ClientToScreen
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
WindowFromPoint
GetSysColorBrush
LoadStringA
DestroyMenu
CharUpperA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetWindowTextLengthA
GetDlgCtrlID
CreateWindowExA
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetWindow
SetWindowPos
RegisterWindowMessageA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
CopyRect
EndDialog
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
PeekMessageA
GetCursorPos
SetWindowsHookExA
GetLastActivePopup
GetWindowLongA
PostQuitMessage
SetTimer
GetMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
KillTimer
LoadCursorA
CopyIcon
GetParent
GetDC
ReleaseDC
InflateRect
InvalidateRect
IsWindow
SetWindowLongA
SetCursor
PtInRect
ReleaseCapture
RedrawWindow
SetCapture
MessageBeep
CloseDesktop
keybd_event
CreateDesktopA
UnregisterClassA
HideCaret
ShowCaret
DestroyCursor
GetSysColor
MessageBoxA
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
GetWindowRect
EnableWindow
LoadIconA
GetTopWindow
GetCapture
WinHelpA
GetForegroundWindow
GetClassInfoA
GetWindowThreadProcessId
GetClassNameA
GetWindowTextA
FindWindowExA
wsprintfA
EnumDesktopWindows
EnumChildWindows
IsWindowEnabled
IsWindowVisible
SendMessageA
ExcludeUpdateRgn
DrawFocusRect
DefDlgProcA
CharNextA
IsWindowUnicode
PostMessageA
SetForegroundWindow

gdi32

SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
IntersectClipRect
GetDeviceCaps
CreateSolidBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetBkMode
SelectObject
RestoreDC
SaveDC
DeleteDC
SetBkColor
SetTextColor
GetClipBox
PatBlt
CreateBitmap
GetTextExtentPoint32A
GetObjectA
CreateFontIndirectA
DeleteObject
CreateDIBitmap
GetTextExtentPointA
BitBlt
CreateCompatibleDC
GetStockObject

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueExA
RegOpenKeyExA
RegQueryValueA
RegSetValueExA
RegCreateKeyExA
RegCloseKey

shell32

StrStrIA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetSpecialFolderPathA
ShellExecuteA

comctl32

ord17

iphlpapi

GetAdaptersInfo

ws2_32

accept
sendto
setsockopt
recvfrom
gethostname
inet_ntoa
bind
send
htons
inet_addr
socket
select
ioctlsocket
closesocket
gethostbyname
listen
WSAStartup
recv
WSACleanup
connect

wininet

InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetCloseHandle

Sections

.text
Size: 200KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 268KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4754bed3d2b84108516efa78fba0451c

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

iphlpapi

ws2_32

wininet

Sections

.text Size: 200KB - Virtual size: 199KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: 24KB - Virtual size: 44KB

.rsrc Size: 268KB - Virtual size: 265KB

.text
Size: 200KB - Virtual size: 199KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: 24KB - Virtual size: 44KB

.rsrc
Size: 268KB - Virtual size: 265KB