55b0fb487a9409df495232905b6a0fc0_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

55b0fb487a9409df495232905b6a0fc0_NEIKI
Size

207KB
MD5

55b0fb487a9409df495232905b6a0fc0
SHA1

6828c44ee040a68fb78cc20501293e53bd37e965
SHA256

75f9d2ffe84853f4b20543ade99feafd802b04893e91ce53e58bcb37ce2a9df3
SHA512

2d2ac314cf156f584fb4b556f57debffc384ef6f70c550489ce4551541070b077547cb06104d9e26fc55f186f175355764ff6d98ec6c3008cd7e2a5df0295ea1
SSDEEP

6144:pAGxcylfXqgO7gV/PpBV+UdvrEFp7hKDF:Z9fX77/PpBjvrEH7QF

Score

1^/10

Malware Config

Signatures

Files

55b0fb487a9409df495232905b6a0fc0_NEIKI
.dll regsvr32 windows:5 windows x86 arch:x86

d49433205f73b780f5f579ac3c0b96bc

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

43:1c:a9:8e:10:65:f3:97:e4:f2:d0:96:c0:0a:49:ad:f4:0a:e7:20
Signer

Actual PE Digest

43:1c:a9:8e:10:65:f3:97:e4:f2:d0:96:c0:0a:49:ad:f4:0a:e7:20

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

wlidNSP.pdb

Imports

kernel32

HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RtlUnwind
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetACP
GetOEMCP
IsValidCodePage
HeapSize
WriteFile
LoadLibraryA
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
GetCurrentThreadId
GetCurrentProcess
GetModuleFileNameW
LocalFree
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCPInfo
InitializeCriticalSection
SetEvent
OpenEventW
WaitForMultipleObjects
CreateEventW
OutputDebugStringW
GetLocalTime
CreateFileW
SetEndOfFile
ReadFile

advapi32

RegOpenCurrentUser
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ws2_32

WSCUnInstallNameSpace
WSCInstallNameSpace
WSASetLastError

psapi

GetModuleBaseNameW

rpcrt4

RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
NdrAsyncClientCall
RpcAsyncCompleteCall
RpcAsyncCancelCall
RpcAsyncInitializeHandle
RpcBindingFree

shlwapi

PathFileExistsW
PathCombineW

Exports

Exports

DllRegisterServer
DllUnregisterServer
NSPCleanup
NSPStartup

Sections

.text
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d49433205f73b780f5f579ac3c0b96bc

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:05:a2:30:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

43:1c:a9:8e:10:65:f3:97:e4:f2:d0:96:c0:0a:49:ad:f4:0a:e7:20Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ws2_32

psapi

rpcrt4

shlwapi

Exports

Exports

Sections

.text Size: 107KB - Virtual size: 107KB

.data Size: 5KB - Virtual size: 14KB

.rsrc Size: 1024B - Virtual size: 992B

.reloc Size: 10KB - Virtual size: 10KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

43:1c:a9:8e:10:65:f3:97:e4:f2:d0:96:c0:0a:49:ad:f4:0a:e7:20
Signer

.text
Size: 107KB - Virtual size: 107KB

.data
Size: 5KB - Virtual size: 14KB

.rsrc
Size: 1024B - Virtual size: 992B

.reloc
Size: 10KB - Virtual size: 10KB