7781a52e521d4dbe102c0b3d3f72ffb0_NEIKI

Sharing

Copy URL

Twitter E-mail

General

Target

7781a52e521d4dbe102c0b3d3f72ffb0_NEIKI
Size

1.1MB
MD5

7781a52e521d4dbe102c0b3d3f72ffb0
SHA1

007486d0d00782be98425fe5264a3fdede98593f
SHA256

27744c112a316e5d7efd0e90876f928f9900bae10a91cbb34fba303cbaffb762
SHA512

d09972d75b21c42581e564933ba7666c3d087c180a8dffffac1f43a397fdf830a63bd0f62baeefa62238a57e56b31d780c787157dda99ea9f7de1031e8ba65bb
SSDEEP

24576:Q1Q+4oiTdQaxF5gUiAA4LYtAoonybkBfCweDmogOo:Q1NfiTdQcF5Fi0LYtAoongofC+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7781a52e521d4dbe102c0b3d3f72ffb0_NEIKI

Files

7781a52e521d4dbe102c0b3d3f72ffb0_NEIKI
.exe windows:6 windows x64 arch:x64

a794e34e28a2327d1a363e71d8c8450e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

kanata.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

kernel32

IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCommandLineW
SetLastError
GetModuleFileNameW
GetLastError
lstrlenW
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
SetPriorityClass
SetHandleInformation
AttachConsole
GetTempPathW
GetTempFileNameW
CloseHandle
CreateActCtxW
ActivateActCtx
GetModuleHandleW
GetStdHandle
GetConsoleMode
WideCharToMultiByte
DeleteFileW
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapFree
HeapReAlloc
GetFileType
GetFileInformationByHandleEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFinalPathNameByHandleW
SwitchToThread
GetConsoleScreenBufferInfo
Sleep
GetModuleHandleA
GetProcAddress
GetCurrentThread
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceFrequency
FormatMessageW
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcessId
CreateMutexA
ReleaseMutex
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
CreateFileW
SetFileInformationByHandle
GetFileInformationByHandle
GetFullPathNameW
FindFirstFileW
FindClose
ReadConsoleW
CreateThread
ExitProcess
QueryPerformanceCounter
HeapAlloc
GetProcessHeap
SetConsoleMode
GetSystemTimePreciseAsFileTime
SystemTimeToFileTime
SetConsoleTextAttribute
InitializeSListHead
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent

shell32

SHGetKnownFolderPath

ole32

CoInitialize
CoTaskMemFree

winmm

timeBeginPeriod

ws2_32

recv
send
closesocket
WSACleanup
WSAStartup
bind
WSAGetLastError
WSASocketW
WSADuplicateSocketW
getpeername
accept
listen

comctl32

InitCommonControlsEx

user32

TranslateMessage
IsDialogMessageW
GetAncestor
DefWindowProcW
DispatchMessageW
ShowWindow
CallNextHookEx
SendInput
GetMessageW
SetWindowsHookExW
PostMessageW
UnhookWindowsHookEx
RegisterClassExW
LoadCursorW

ntdll

RtlNtStatusToDosError
NtWriteFile
NtReadFile

vcruntime140

memset
memmove
__CxxFrameHandler3
__current_exception_context
__current_exception
memcmp
__C_specific_handler
memcpy

api-ms-win-crt-math-l1-1-0

__setusermatherr
roundf

api-ms-win-crt-runtime-l1-1-0

_cexit
__p___argv
__p___argc
_exit
_c_exit
_initialize_onexit_table
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_register_onexit_function
_initialize_narrow_environment
terminate
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 800KB - Virtual size: 799KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a794e34e28a2327d1a363e71d8c8450e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

kernel32

shell32

ole32

winmm

ws2_32

comctl32

user32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 800KB - Virtual size: 799KB

.rdata Size: 264KB - Virtual size: 264KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 23KB - Virtual size: 23KB

.rsrc Size: 1024B - Virtual size: 528B

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 800KB - Virtual size: 799KB

.rdata
Size: 264KB - Virtual size: 264KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 23KB - Virtual size: 23KB

.rsrc
Size: 1024B - Virtual size: 528B

.reloc
Size: 13KB - Virtual size: 12KB