99675d5379ace99694243c70f9956270_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

99675d5379ace99694243c70f9956270_NEIKI
Size

1.7MB
MD5

99675d5379ace99694243c70f9956270
SHA1

59e2265af493e6dc43893b69f9356bed1b4ce8c1
SHA256

e07b49748f41582f24e000ba9f2e82fb888aa02e7ecb1f9c2a96bb26a257c31e
SHA512

a24a73d42945c4603e420d501ef0935900da65ceda7e3b6cf2c74c501ec3d3fbf6db84a63b8d478d75729a2c86f1c408d47f6746652a9066320fdf7183d4a1ad
SSDEEP

24576:ndmTGrnAguvgVxYEjUfxg8prD4ZgR3G+062rQ:nwfeVf6D4ZgH92

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99675d5379ace99694243c70f9956270_NEIKI

Files

99675d5379ace99694243c70f9956270_NEIKI
.dll windows:6 windows x86 arch:x86

194626d43f26c1982a95631fc6459d5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Clon_\OneDrive\Masaüstü\Hile Koruması\crysus\Debug\Crysus.pdb

Imports

kernel32

OpenProcess
K32EnumProcesses
K32EnumProcessModules
K32GetModuleFileNameExA
ReadProcessMemory
Process32First
Process32Next
FindNextFileA
GetTickCount
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ResumeThread
FindFirstFileExW
GetTimeZoneInformation
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
DeleteFileW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
WaitForSingleObject
Module32Next
Module32First
CreateToolhelp32Snapshot
LoadLibraryExA
GetProcAddress
FreeLibrary
GetModuleHandleA
GetCurrentProcessId
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
CloseHandle
FindFirstFileA
FindClose
CreateThread
TerminateProcess
GetCurrentProcess
FindNextFileW
Sleep
GetLocaleInfoW
LCMapStringW
FormatMessageA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LocalFree
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
RaiseException
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
VirtualQuery
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
HeapValidate
GetSystemInfo
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetStdHandle
WriteConsoleW
GetCurrentThread
HeapReAlloc
HeapSize
HeapQueryInformation
WriteFile
OutputDebugStringW
SetConsoleCtrlHandler
GetTempPathW
GetDateFormatW
GetTimeFormatW
CompareStringW
SetEndOfFile

user32

LoadCursorA
SetWindowLongA
GetWindowLongA
GetClientRect
EndPaint
BeginPaint
UpdateWindow
GetSystemMetrics
ShowWindow
DestroyWindow
LoadImageA
RegisterClassExA
UnregisterClassA
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
FindWindowA
FindWindowExA
SendMessageA
WindowFromPoint
GetWindowTextA
MessageBoxA
CreateWindowExA

gdi32

SelectObject
GetStockObject
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
GetObjectA

advapi32

SetSecurityInfo
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
GetLengthSid
FreeSid
AllocateAndInitializeSid
AddAccessDeniedAce
AddAccessAllowedAce
OpenProcessToken
GetUserNameA

shell32

ShellExecuteA

Exports

Exports

Crysus

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 265B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

194626d43f26c1982a95631fc6459d5a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 260KB - Virtual size: 260KB

.data Size: 14KB - Virtual size: 21KB

.idata Size: 6KB - Virtual size: 5KB

.00cfg Size: 512B - Virtual size: 265B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 45KB - Virtual size: 45KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 260KB - Virtual size: 260KB

.data
Size: 14KB - Virtual size: 21KB

.idata
Size: 6KB - Virtual size: 5KB

.00cfg
Size: 512B - Virtual size: 265B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 45KB - Virtual size: 45KB