PyInit__cobyla
Behavioral task
behavioral1
Sample
c08d880f835bc4d2a31f19da8a59a5c0_NEIKI.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c08d880f835bc4d2a31f19da8a59a5c0_NEIKI.dll
Resource
win10v2004-20240426-en
General
-
Target
c08d880f835bc4d2a31f19da8a59a5c0_NEIKI
-
Size
171KB
-
MD5
c08d880f835bc4d2a31f19da8a59a5c0
-
SHA1
fba963640d24ab47b85e1f06716b8ebea8fbadc8
-
SHA256
00191ec88d600294460fe2f825fe1bc28330ebc33576e536f0154c46984c969b
-
SHA512
e35219a61d49bf3c3d5dbae2e4b5a6b7a9b20fe7376731b6ffc42a2a693e8a51fdfc6cb6d24f757bf6e3fb871d27434dda8b360c1113d9ad716867ccd9c7835c
-
SSDEEP
3072:OphGg3AYoKM2I7TOVNwruwwAhmgjPkdJJPTHMBybwwfhMFN24mJBBHS:8/o7aVe6ww8Fjsdv7MYUwfhMTn
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c08d880f835bc4d2a31f19da8a59a5c0_NEIKI
Files
-
c08d880f835bc4d2a31f19da8a59a5c0_NEIKI.dll windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
Exports
Exports
Sections
UPX0 Size: - Virtual size: 280KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 169KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE