34cbfb53509e335e4ceef7b26914a200_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

34cbfb53509e335e4ceef7b26914a200_NEIKI
Size

67KB
MD5

34cbfb53509e335e4ceef7b26914a200
SHA1

7b85d543c7efd06364299c0f4b0288c32ac99d05
SHA256

22495cdbaa32ce93d75bcfa2c4dda8d1b42d3d84de7a4bdb490bb82e7e024ce4
SHA512

db6d3ecc0d1e42fffe0239a3b4e71f6dbd79fcbb961bbe50c223ad568d87b4c25f82e91878c479371d30a285d90f64d7e2a3b0232718d7c66d9115d00a31956c
SSDEEP

1536:rw8u2WMlBQb8zVdSyZG2rEgQAXIbXlca6yIEIuJ9xQ:r0MlBQb8zVd9ZGAGAYbua6yIEIuJH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34cbfb53509e335e4ceef7b26914a200_NEIKI

Files

34cbfb53509e335e4ceef7b26914a200_NEIKI
.dll windows:4 windows x86 arch:x86

8462e9f249f805ad320221a0f046a5e7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

rtl60.bpl

@System@initialization$qqrv
@System@Finalization$qqrv
@System@UnregisterModule$qqrp17System@TLibModule
@System@RegisterModule$qqrp17System@TLibModule
@System@FindHInstance$qqrpv
@System@@LStrFromPChar$qqrr17System@AnsiStringpc
@System@@LStrAsg$qqrpvpxv
@System@@LStrClr$qqrpv
@System@@HandleFinally$qqrv
@System@IsMemoryManagerSet$qqrv
@System@SetMemoryManager$qqrrx21System@TMemoryManager
@System@IsMultiThread
@System@IsConsole
@System@ExitProc
@System@CmdLine
@System@IsLibrary
@System@MainInstance
@Types@initialization$qqrv
@Types@Finalization$qqrv
@Sysconst@initialization$qqrv
@Sysconst@Finalization$qqrv
@Sysutils@initialization$qqrv
@Sysutils@Finalization$qqrv
@Varutils@initialization$qqrv
@Varutils@Finalization$qqrv
@Variants@initialization$qqrv
@Variants@Finalization$qqrv
@Rtlconsts@initialization$qqrv
@Rtlconsts@Finalization$qqrv
@Typinfo@initialization$qqrv
@Typinfo@Finalization$qqrv
@Typinfo@DotSep
@Typinfo@BooleanIdents

borlndmm

ord2

kernel32

DeleteCriticalSection
FreeLibrary
GetCommandLineA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetVersion
HeapAlloc
HeapFree
LoadLibraryA

cc3260mt

@$bdele$qpv
@$bnew$qui
@_InitTermAndUnexPtrs$qv
__ErrorExit
__ErrorMessage
___CRTL_MEM_GetBorMemPtrs
___CRTL_MEM_UseBorMM
___CRTL_TLS_Alloc
___CRTL_TLS_ExitThread
___CRTL_TLS_Free
___CRTL_TLS_GetValue
___CRTL_TLS_InitThread
___CRTL_TLS_SetValue
____ExceptionHandler
__argv_default_expand
__free_heaps
__handle_exitargv
__handle_setargv
__handle_wexitargv
__handle_wsetargv
__lstrlwr
__max_flt
__startupd
__wargv_default_expand
_cos
_log
_memcpy
_memmove
_sin
_sqrt
_strcat
_strchr
_strcmp
_strcpy
_stricmp
_strlen
_strstr

stlpmt45

ord2
ord467

dsound

ord11

xrcdbb

@CDB@COLLIDER@$bctr$qqsv
@CDB@COLLIDER@$bdtr$qqsv
@CDB@COLLIDER@ray_query$qqspx9CDB@MODELrx12%_vector3$f%t2f
@CDB@MODEL@$bctr$qqsv
@CDB@MODEL@$bdtr$qqsv
@CDB@MODEL@build$qqsp12%_vector3$f%ip7CDB@TRIipqqsp12%_vector3$f%ip7CDB@TRIipv$vpv

xrcoreb

@CLocatorAPI@exist$qqspcpxct2
@CLocatorAPI@exist$qqspxct1
@CLocatorAPI@r_close$qqsrp7IReader
@CLocatorAPI@r_open$qqspxct1
@CLocatorAPI@update_path$qqspcpxct2
@CLocatorAPI@w_close$qqsrp7IWriter
@CLocatorAPI@w_open$qqspxct1
@CPU@GetCycleCount$qqrv
@CPU@cycles_overhead
@CPU@cycles_per_milisec
@IReader@close$qqsv
@IReader@open_chunk$qqsui
@IReader@r$qqspvi
@IReader@r_stringZ$qqspc
@IWriter@close_chunk$qqsv
@IWriter@open_chunk$qqsui
@Msg$qpxce
@str_container@dock$qqspxc
@xrDebug@error$qqslpxct2i
@xrDebug@fail$qqspxct1i
@xrDebug@fail$qqspxct1t1i
@xrDebug@fail$qqspxct1t1t1i
@xrDebug@fatal$qpxce
@xrMemory@mem_alloc$qqsui
@xrMemory@mem_free$qqspv
_Core
_Debug
_Memory
_Random
_g_pStringContainer
_xr_FS

vorbisfile

ord3
ord6
ord8
ord10
ord11
ord16
ord21

Exports

Exports

@@Editor@Finalize
@@Editor@Initialize
@CSoundRender_Environment@$bctr$qqsv
@CSoundRender_Environment@$bdtr$qqsv
@CSoundRender_Environment@clamp$qqsooo
@CSoundRender_Environment@lerp$qqsr24CSoundRender_Environmentt1f
@CSoundRender_Environment@load$qqsp7IReader
@CSoundRender_Environment@save$qqsp7IWriter
@CSoundRender_Environment@set_default$qqsooo
@CSoundRender_Environment@set_identity$qqsooo
@CSoundRender_Source@$bctr$qqsv
@CSoundRender_Source@$bdtr$qqsv
@CSoundRender_Source@LoadWave$qqspxci
@CSoundRender_Source@decompress$qqsui
@CSoundRender_Source@load$qqspxci
@CSoundRender_Source@unload$qqsv
@SoundEnvironment_LIB@Append$qqsp24CSoundRender_Environment
@SoundEnvironment_LIB@Get$qqsi
@SoundEnvironment_LIB@Get$qqspxc
@SoundEnvironment_LIB@GetID$qqspxc
@SoundEnvironment_LIB@Library$qqsv
@SoundEnvironment_LIB@Load$qqspxc
@SoundEnvironment_LIB@Remove$qqsi
@SoundEnvironment_LIB@Remove$qqspxc
@SoundEnvironment_LIB@Save$qqspxc
@SoundEnvironment_LIB@Unload$qqsv
_Sound
___CPPdebugHook
_psSoundCacheSizeMB
_psSoundCull
_psSoundDoppler
_psSoundFlags
_psSoundFreq
_psSoundModel
_psSoundOcclusionScale
_psSoundRolloff
_psSoundTargets
_psSoundVEffects
_psSoundVMaster
_psSoundVMusic

Sections

.text
Size: 47KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8462e9f249f805ad320221a0f046a5e7

Headers

File Characteristics

Imports

rtl60.bpl

borlndmm

kernel32

cc3260mt

stlpmt45

dsound

xrcdbb

xrcoreb

vorbisfile

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 48KB

.data Size: 8KB - Virtual size: 12KB

.tls Size: 512B - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 8KB

.edata Size: 2KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 4KB

.text
Size: 47KB - Virtual size: 48KB

.data
Size: 8KB - Virtual size: 12KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 8KB

.edata
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 4KB