9db864549441f7b09f62e1c89595c350_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

9db864549441f7b09f62e1c89595c350_NEIKI
Size

18KB
MD5

9db864549441f7b09f62e1c89595c350
SHA1

b85006a6911e4cd0219edbf6a5539a9019163931
SHA256

73d51642506a1e0c2e95a558696d66d28dc47a8da9ef4a0b50c29373e746b220
SHA512

5dfcd33aee710c8dee5779e75025e74d9ed3f58d3e77373eb7ba4c8ee6003745f01c7361ca6569b82ee19ae8d4d140dec18d7cd278928fe1836ae3171d87f0e9
SSDEEP

192:jvtpL5yBvrshJaDu2/ti2GimcJyWGv69TW+CkPtVkaopmhh6zVvwpy9MsPZkGh90:j7cRsza91iDcJ196+vKw8VVPZZ9cB

Score

1^/10

Malware Config

Signatures

Files

9db864549441f7b09f62e1c89595c350_NEIKI
.exe windows:5 windows x86 arch:x86

f10f2120bcbd0834b30344d4c7967ff3

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

23/08/2013, 00:00

Not After

23/09/2024, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G1,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

24/10/2007, 22:01

Not After

24/10/2017, 22:01

Subject

CN=StartCom Class 2 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:df
Certificate

Issuer

CN=StartCom Class 2 Primary Intermediate Object CA,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

31/03/2014, 19:39

Not After

01/04/2016, 01:01

Subject

CN=The Document Foundation,O=The Document Foundation,L=Berlin,ST=Berlin,C=DE,1.2.840.113549.1.9.1=#0c1b696e666f40646f63756d656e74666f756e646174696f6e2e6f7267,2.5.4.13=#13106c35525a41476b33653437554a4a5079

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

c4:85:a2:6b:05:26:97:d5:71:08:92:9c:89:8f:5b:36:2a:4d:bb:29
Signer

Actual PE Digest

c4:85:a2:6b:05:26:97:d5:71:08:92:9c:89:8f:5b:36:2a:4d:bb:29

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\cygwin64\home\buildslave\r\workdir\LinkTarget\Executable\python.pdb

Imports

msvcr110

__crtTerminateProcess
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
__crtUnhandledException
_calloc_crt
__dllonexit
_onexit
_invoke_watson
_controlfp_s
_except_handler4_common
_crt_debugger_hook
_commode
_fmode
__winitenv
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
memset
_snwprintf
exit
??3@YAXPAX@Z
_unlock
??2@YAPAXI@Z

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
CreateFileW
CloseHandle
ReadFile
SetLastError
SetEnvironmentVariableW
GetEnvironmentVariableW
CreateProcessW
GetModuleFileNameW
WaitForSingleObject
GetLastError
GetExitCodeProcess
DecodePointer

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 674B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f10f2120bcbd0834b30344d4c7967ff3

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45Certificate

Extended Key Usages

Key Usages

24Certificate

Key Usages

0d:dfCertificate

Extended Key Usages

Key Usages

c4:85:a2:6b:05:26:97:d5:71:08:92:9c:89:8f:5b:36:2a:4d:bb:29Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr110

kernel32

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 892B

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 1024B - Virtual size: 674B

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:40:5c:1f:0e:d2:58:88:2b:e5:4d:86:86:ba:11:ea:45
Certificate

24
Certificate

0d:df
Certificate

c4:85:a2:6b:05:26:97:d5:71:08:92:9c:89:8f:5b:36:2a:4d:bb:29
Signer

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 892B

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 1024B - Virtual size: 674B