PyInit_pyexpat
Behavioral task
behavioral1
Sample
5a72ae028432326b64be88382203ada0_NEIKI.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
5a72ae028432326b64be88382203ada0_NEIKI.dll
Resource
win10v2004-20240419-en
General
-
Target
5a72ae028432326b64be88382203ada0_NEIKI
-
Size
73KB
-
MD5
5a72ae028432326b64be88382203ada0
-
SHA1
11d1b38f967c233ba1df40a91016574a1d172cd0
-
SHA256
4e650ca4983d368a72694268eea65dd54b9e53bb6a17bc5ad2ddeedde69e8a57
-
SHA512
ed5f73ee1432aad33586260bcd9056a65c70b73d750d59c8da46d45a5b158cb5d0787fd188e6329b3d597acfbe844d2d865d2461a4a349c7fc19aa9a5f7dc88d
-
SSDEEP
1536:XA2CIfW+qprnXhaDzKzjqxoegCq4+MGU+Inouy8YIjLhopW7SyNxy:XxC8Wbpjo/KHqxXgC8MXoutYIjLhoYs
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a72ae028432326b64be88382203ada0_NEIKI
Files
-
5a72ae028432326b64be88382203ada0_NEIKI.dll windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 128KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 57KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE