Static task
static1
Behavioral task
behavioral1
Sample
a52f73299543023c23e78dfc7e647060_NEIKI.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a52f73299543023c23e78dfc7e647060_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
a52f73299543023c23e78dfc7e647060_NEIKI
-
Size
2.1MB
-
MD5
a52f73299543023c23e78dfc7e647060
-
SHA1
84d58788e8b9871902cf7f913c3a882799e8538d
-
SHA256
a2b015f41225335e0ade4ee2e9f24da61acce65c04db54d4d06334d1c8acbee7
-
SHA512
214b564ef5e9a80c9fded4694beb1a0167b7237d86b9fddc5a90d66154a9b30718c3673990b24c5058439042114bf4f0df36c22fb16a98a15ead364689a4eddd
-
SSDEEP
49152:u0UIxlucLIOR5RvTuWMQIH6oTqMiG0sM6ek:u0UGlucLIg5YWMB9rDek
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a52f73299543023c23e78dfc7e647060_NEIKI
Files
-
a52f73299543023c23e78dfc7e647060_NEIKI.exe windows:4 windows x86 arch:x86
0dcc71f38db3cff3e5b259e9f91f8a65
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
kernel32
GetCommandLineA
GetTickCount
lstrlenA
GetFileAttributesA
DeleteFileA
CloseHandle
GetModuleFileNameA
FindClose
FindFirstFileA
SetFileAttributesA
lstrcmpA
WritePrivateProfileStringA
WritePrivateProfileSectionA
GetPrivateProfileSectionA
GetShortPathNameA
GetVersionExA
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcpyA
GlobalAlloc
GlobalFree
FreeLibrary
GetProcAddress
MoveFileExA
CreateMutexA
CreateDirectoryA
RemoveDirectoryA
GetProcessHeap
HeapFree
GetTempFileNameA
GetWindowsDirectoryA
GetTempPathA
HeapAlloc
GetDiskFreeSpaceA
GetCurrentDirectoryA
MoveFileA
GetVolumeInformationA
GetModuleHandleA
CompareFileTime
GetLocalTime
lstrcatA
GetFileInformationByHandle
CreateFileA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetSystemDirectoryA
CreateProcessA
GetCurrentProcessId
GetCurrentProcess
OutputDebugStringA
lstrcpynA
SetErrorMode
GetLastError
LoadLibraryA
GetDriveTypeA
GetStringTypeW
GetCurrentThreadId
TlsSetValue
FlushFileBuffers
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEndOfFile
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetOEMCP
GetACP
TerminateProcess
LCMapStringW
GetStringTypeA
GetCPInfo
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
SetStdHandle
GetFullPathNameA
SetLastError
TlsAlloc
GetStdHandle
SetHandleCount
RtlUnwind
DeleteCriticalSection
InitializeCriticalSection
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetSystemTime
InterlockedDecrement
InterlockedIncrement
HeapReAlloc
CreateThread
LeaveCriticalSection
GetEnvironmentVariableA
TlsGetValue
ExitThread
GetFileType
ReadFile
WriteFile
SetFilePointer
GetStartupInfoA
GetVersion
ExitProcess
EnterCriticalSection
user32
SetForegroundWindow
FindWindowA
MessageBoxA
GetMessageA
SetDlgItemTextA
KillTimer
PostQuitMessage
SetTimer
SetCursor
LoadIconA
GetDlgItem
GetWindowTextA
SendMessageA
EndDialog
EnableWindow
TranslateMessage
DialogBoxParamA
PeekMessageA
ShowWindow
DispatchMessageA
DestroyWindow
SetWindowTextA
GetClientRect
CreateWindowExA
LoadCursorA
DefWindowProcA
UpdateWindow
GetWindowRect
GetSysColorBrush
RegisterClassA
SystemParametersInfoA
SetFocus
LoadStringA
GetDesktopWindow
IsWindow
gdi32
CreateFontIndirectA
CreateFontA
shell32
ShellExecuteExA
SHGetFileInfoA
SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ