8ece80bc9dc19abf2e1c199b140b9260_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8ece80bc9dc19abf2e1c199b140b9260_NEIKI
Size

2.3MB
MD5

8ece80bc9dc19abf2e1c199b140b9260
SHA1

1528f323b5d4e7a2f15978885c1e07c9613a1f34
SHA256

811151d6e5e6e9b8eb714cd5cefc1438eaa54d94aad7e4714ddc7c0862793e79
SHA512

5a212298f7ccd1c655ef5363240ddbd9a2ea0ab7c3356e8ae5b5c00aec8bdd66810c97e5cf3f590e3cf2007e8043aa019ad8d97226a4fbfcb70979c589f6748e
SSDEEP

49152:nyroBrGvXbsqvRq1ZRgvqA11hteI2TNjAAcxw2JV3VFDS7c7/JAw3DsfurxMN:HBrSsq5q/4f11hsI2TN0LzVlw7qlTiN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ece80bc9dc19abf2e1c199b140b9260_NEIKI

Files

8ece80bc9dc19abf2e1c199b140b9260_NEIKI
.exe windows:4 windows x86 arch:x86

7c2116af86cf5b29bc6a7e0377601029

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

lz32

LZInit
LZClose
LZCopy

comctl32

ord17

kernel32

HeapAlloc
GetProcessHeap
GetLastError
ExitProcess
GetThreadContext
CreateFileA
SetThreadContext
SetFilePointer
lstrlenA
lstrcpynA
SetErrorMode
FreeLibrary
GetCurrentProcess
GlobalLock
WaitForSingleObject
WriteFile
GlobalAlloc
Sleep
CreateProcessA
ReadFile
GlobalUnlock
FlushInstructionCache
GetCommandLineA
GetProcAddress
RemoveDirectoryA
VirtualProtectEx
GlobalFree
GetTempFileNameA
LoadLibraryA
MoveFileA
GetModuleFileNameA
DuplicateHandle
CloseHandle
GetTempPathA
WriteProcessMemory
ResumeThread
DeleteFileA
lstrcpyA
GetModuleHandleA
GetStartupInfoA

user32

wsprintfA
MessageBoxA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ