a502ae61f84c68579b12089f53a97ed0_NEIKI

Sharing

Copy URL

Twitter E-mail

General

Target

a502ae61f84c68579b12089f53a97ed0_NEIKI
Size

356KB
MD5

a502ae61f84c68579b12089f53a97ed0
SHA1

d8797a17a304859abf93874d33ee55d9fb6feabe
SHA256

931ef10831c0a2c4681bfca7d19972b79d61a03fda7e9e011176c0a50cb5d7cd
SHA512

8bb1c28c4a16644c1fb3b4b03583b89b5c62c8e3dc197fb3687ed15d72d81cd4951f8fb5ee6d49e2efc609470cfff7ed15a4087503f5105ab9a39621d3411d19
SSDEEP

6144:D7F9F8+N9D6+UEVfbbFB5Hze3B2jdYbRsb/z2DV09f:D7F9F8gLfb/5HzeR88sb/CDA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a502ae61f84c68579b12089f53a97ed0_NEIKI

Files

a502ae61f84c68579b12089f53a97ed0_NEIKI
.exe windows:4 windows x86 arch:x86

665fb9d148db3a7944a936873bd3375f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\development2\ftpsync4\SrvCtrl\Release\SrvCtrl.pdb

Imports

kernel32

SetErrorMode
HeapAlloc
HeapFree
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
GetProcessHeap
GetStartupInfoA
SetStdHandle
GetFileType
ExitProcess
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetFileTime
GetStringTypeA
GetStringTypeW
Sleep
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
GetFileAttributesA
FileTimeToLocalFileTime
CreateFileA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
FileTimeToSystemTime
GetThreadLocale
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetTickCount
WritePrivateProfileStringA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
GetCurrentProcessId
FreeResource
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GetVersionExA
GetModuleFileNameW
GetCurrentThreadId
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
Process32First
Process32Next
CreateToolhelp32Snapshot
Module32First
CompareStringW
CompareStringA
GetVersion
InterlockedExchange
GetWindowsDirectoryA
SetLastError
GetProcAddress
LoadLibraryA
SetCurrentDirectoryA
WaitForSingleObject
GetExitCodeProcess
TerminateProcess
CloseHandle
LockResource
CreateThread
LocalAlloc
FormatMessageA
LocalLock
LocalFree
GetModuleHandleA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
IsDBCSLeadByte
lstrcmpiA
lstrlenA
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
IsValidCodePage
MultiByteToWideChar

user32

CopyAcceleratorTableA
ReleaseCapture
SetCapture
UnregisterClassA
GetSysColorBrush
DestroyMenu
RegisterClipboardFormatA
SetWindowContextHelpId
MapDialogRect
GetDesktopWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
PostQuitMessage
GetWindowThreadProcessId
IsWindowEnabled
MoveWindow
SetWindowTextA
IsDialogMessageA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
EnableMenuItem
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetFocus
IsWindow
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetMenu
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetWindowLongA
PostMessageA
CharNextA
GetSysColor
FillRect
GetClientRect
RedrawWindow
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
PostThreadMessageA
GetNextDlgGroupItem
InvalidateRgn
SetRect
GetDlgItem
IsRectEmpty
SetTimer
KillTimer
EnableWindow
SendMessageA
ShowWindow
FindWindowA
DrawIcon
AppendMenuA
GetSystemMenu
IsIconic
LoadIconA
GetSystemMetrics
SetRectEmpty
InflateRect
DrawFocusRect
GetWindowRect
InvalidateRect
GetParent
MessageBeep
SetCursor
CopyIcon
LoadCursorA
CharUpperA
LoadBitmapA
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
ValidateRect
GetCursorPos
PeekMessageA
GetKeyState
GetClassNameA

gdi32

CreateSolidBrush
CreateRectRgnIndirect
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
CreateBitmap
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
CreatePen
GetWindowExtEx
GetViewportExtEx
DeleteObject
MoveToEx
LineTo
GetClipBox
SetMapMode
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
GetDeviceCaps
GetStockObject
CreateFontIndirectA
GetObjectA
SetPixel
BitBlt
Rectangle
CreateCompatibleDC
CreateCompatibleBitmap
PtVisible

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

QueryServiceStatus
RegQueryValueA
RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
GetUserNameA
ChangeServiceConfigA
StartServiceA
ControlService
RegDeleteKeyA
OpenSCManagerA
OpenServiceA
QueryServiceConfigA
CloseServiceHandle
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA

shell32

ShellExecuteA
ShellExecuteExA

comctl32

ord17

shlwapi

PathIsDirectoryA
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathFileExistsA
PathIsUNCA

oledlg

ord8

ole32

CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
StringFromGUID2
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter

oleaut32

SysFreeString
VarUI4FromStr
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
UnRegisterTypeLi
RegisterTypeLi
VariantClear
VariantChangeType
VariantInit
SysAllocStringLen
SysAllocStringByteLen
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect

Sections

.text
Size: 244KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

665fb9d148db3a7944a936873bd3375f

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 244KB - Virtual size: 240KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 32KB - Virtual size: 29KB

.text
Size: 244KB - Virtual size: 240KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 32KB - Virtual size: 29KB