85cc1b76eb53df761f93e022fc0a4c80_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

85cc1b76eb53df761f93e022fc0a4c80_NEIKI
Size

56KB
MD5

85cc1b76eb53df761f93e022fc0a4c80
SHA1

76deb133ef651c537fc48f0685dd20cc18e487ac
SHA256

49fdc9a53f68dc9c232fc778c477f737db10e8902be63ab08c3f7c8be5598056
SHA512

2e4bf5372d9974b0f997dce31b83e37a226d5754a3d3ef8eac4e2d9fb7a52796a5dfb6065ef5787befd44b014b2567a2bf360530b60c4041994d5d2cee134c25
SSDEEP

768:qVeNwg1ycQtjc4fwY/Umqx2Zb+w+XuPi4kHZt21j:qVeag1etQmqx2ZbCePi4at6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85cc1b76eb53df761f93e022fc0a4c80_NEIKI

Files

85cc1b76eb53df761f93e022fc0a4c80_NEIKI
.dll windows:4 windows x86 arch:x86

9cefe45278ef54317816c739a2e36f30

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

GetUserNameA

secur32

ImpersonateSecurityContext
RevertSecurityContext
AcceptSecurityContext
InitializeSecurityContextW
CompleteAuthToken
FreeCredentialsHandle
DeleteSecurityContext
AcquireCredentialsHandleW
QuerySecurityPackageInfoW
FreeContextBuffer

kernel32

LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
Sleep
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
MultiByteToWideChar
GetLocaleInfoA

Exports

Exports

_Java_mks_frame_security_auth_sspi_SSPIAuth_acceptSecurityContext@20
_Java_mks_frame_security_auth_sspi_SSPIAuth_freeCredentialsHandle@16
_Java_mks_frame_security_auth_sspi_SSPIAuth_getCredentialsHandle@24
_Java_mks_frame_security_auth_sspi_SSPIAuth_getCredentialsUserName@20
_Java_mks_frame_security_auth_sspi_SSPIAuth_initSecurityContext@20

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9cefe45278ef54317816c739a2e36f30

Headers

File Characteristics

Imports

advapi32

secur32

kernel32

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 848B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 848B

.reloc
Size: 4KB - Virtual size: 3KB