c9759a300249770e9a5d2ff7e1cc5410_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

c9759a300249770e9a5d2ff7e1cc5410_NEIKI
Size

84KB
MD5

c9759a300249770e9a5d2ff7e1cc5410
SHA1

b6e6def0bb4ecb56c69aeb849e34bb0e481adc15
SHA256

333c8c5d96c9d94ffa8b53e01186acca480568d9b3e5c5baf0548911b81cdb33
SHA512

50f6bd838fab413069e405554e94d253f555e6c57d5f9bc354d3cdb4596a856e40d5098d9c3ffcff402f68963cf21affdc15d4c213675e468631fc399fbb4a59
SSDEEP

1536:typ+V3b1sD7XRGIrnxi0HBIpPp640Zsyb914:typ+V3b1s/RGIrnxi0HBIpPp640ZsoX4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9759a300249770e9a5d2ff7e1cc5410_NEIKI

Files

c9759a300249770e9a5d2ff7e1cc5410_NEIKI
.dll windows:4 windows x86 arch:x86

69a746e5c9a0d340f16a8a59e7c42fc3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\dev\servermain\Steam\src\drm_rel_ceg3.1\Release\survey.pdb

Imports

rpcrt4

UuidCreate

kernel32

LoadResource
FindResourceW
GetLastError
HeapAlloc
GetProcessHeap
HeapFree
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
CloseHandle
SizeofResource
GetFileInformationByHandle
CreateFileW
LockResource
FindNextFileW
FindFirstFileW
lstrcpyW
lstrcmpiW
GetVolumePathNameW
lstrlenW
GetWindowsDirectoryW
GetSystemDirectoryW
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
DebugBreak
LocalFree
FindClose

version

VerQueryValueW

advapi32

RegQueryValueExW
GetSecurityInfo
ConvertStringSidToSidA
GetAce
RegCreateKeyExW
RegSetValueW
RegCloseKey
RegOpenKeyExW
GetAclInformation
EqualSid

ole32

StringFromGUID2

Exports

Exports

_runfunc@20

Sections

.text
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cegm
Size: 4KB - Virtual size: 39B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 732B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69a746e5c9a0d340f16a8a59e7c42fc3

Headers

File Characteristics

PDB Paths

Imports

rpcrt4

kernel32

version

advapi32

ole32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 49KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 328B

.cegm Size: 4KB - Virtual size: 39B

.rsrc Size: 4KB - Virtual size: 732B

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 52KB - Virtual size: 49KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 328B

.cegm
Size: 4KB - Virtual size: 39B

.rsrc
Size: 4KB - Virtual size: 732B

.reloc
Size: 8KB - Virtual size: 6KB