d4e3e4d6a4895131bbd8b44cb614b830_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target
d4e3e4d6a4895131bbd8b44cb614b830_NEIKI
Size 1.6MB
Sample240508-rfxffaaf52
SHA256 5b9ad31e5835f27acf721a47d5934d72d6e483d97aa8b072b870fa35a9d7c657
MD5 d4e3e4d6a4895131bbd8b44cb614b830
SHA1 26a1191b297747af11754d398b48b6212bbf0a7c
SHA512 82c841365d129efabbcbc51db1423f7d8169f425136bc5ac05c6eddbde60947008b2ffda05ac7b139afb191a367035aa44e45abaaf7ad09b063789128df18e8b
SSDEEP 49152:zCN4VBvjBmrsbZKunF+M4ye9uB1838IS1TLM7+f6HhxsSpV3hIztE6FM:zCiB1mrUKunFLW9uB1838IS1TL2+fyoh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4e3e4d6a4895131bbd8b44cb614b830_NEIKI

File Explorer

d4e3e4d6a4895131bbd8b44cb614b830_NEIKI

.exe 1.6MB

d4e3e4d6a4895131bbd8b44cb614b830_NEIKI

IMPHASH ebb6fd0fb77f466ad9eac6458c53e44b
SHA256 5b9ad31e5835f27acf721a47d5934d72d6e483d97aa8b072b870fa35a9d7c657
MD5 d4e3e4d6a4895131bbd8b44cb614b830
SHA1 26a1191b297747af11754d398b48b6212bbf0a7c
SHA512 82c841365d129efabbcbc51db1423f7d8169f425136bc5ac05c6eddbde60947008b2ffda05ac7b139afb191a367035aa44e45abaaf7ad09b063789128df18e8b
SSDEEP 49152:zCN4VBvjBmrsbZKunF+M4ye9uB1838IS1TLM7+f6HhxsSpV3hIztE6FM:zCiB1mrUKunFLW9uB1838IS1TL2+fyoh
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1218179

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ipworks9

IPWorks_MCast_Do IPWorks_MCast_Set IPWorks_MCast_Destroy IPWorks_MCast_Create

ipworksssl9

IPWorksSSL_FTPS_Create IPWorksSSL_FTPS_Destroy IPWorksSSL_FTPS_GetLastError IPWorksSSL_FTPS_Set IPWorksSSL_FTPS_Do

plusnative

SK_ApiContextSetFieldInt SK_ApiResultCodeToString SK_PLUS_SystemIdentifierAlgorithmAddCurrentIdentifiers SK_ApiContextSetFieldString SK_ApiContextInitialize SK_XmlDocumentDispose SK_XmlNodeGetValueString SK_PLUS_LicenseGetXmlDocument SK_XmlDocumentDecryptRsa SK_CallXmlWebService SK_SOLO_CheckInstallationStatusGetRequest SK_XmlNodeGetValueInt SK_PLUS_SystemIdentifierCompare SK_PLUS_LicenseFileLoad SK_StringDispose

kernel32

GetCPInfo GetOEMCP SetErrorMode GetTempFileNameA GetFileAttributesExA GetFileAttributesA GetFileSizeEx GetWindowsDirectoryA GetNumberFormatA SetEndOfFile VirtualProtect FindResourceExW RtlUnwind GetSystemTimeAsFileTime EncodePointer DecodePointer RaiseException HeapSetInformation GetStartupInfoW ExitThread CreateThread GetStringTypeW HeapReAlloc VirtualAlloc GetSystemInfo VirtualQuery ExitProcess HeapSize HeapQueryInformation SetStdHandle GetFileType UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsValidCodePage IsProcessorFeaturePresent GetConsoleCP GetConsoleMode SetHandleCount GetStdHandle LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate CompareStringW WriteConsoleW SetEnvironmentVariableA CreateFileW FlushFileBuffers lstrcmpiA GlobalFlags lstrcpyA GetSystemDirectoryW InterlockedIncrement TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue GetModuleFileNameW ReleaseActCtx CreateActCtxW GlobalGetAtomNameA GlobalFindAtomA InitializeCriticalSectionAndSpinCount LoadLibraryW lstrcmpW FindResourceA FreeResource GlobalAddAtomA WritePrivateProfileStringA GetModuleHandleA GlobalDeleteAtom GetCurrentThread GetUserDefaultUILanguage GetFullPathNameA GetSystemDefaultUILanguage GetLocaleInfoA LoadLibraryExA CompareStringA GetModuleHandleW ActivateActCtx DeactivateActCtx GetCurrentThreadId ResumeThread SetThreadPriority CopyFileA GlobalSize lstrlenW MulDiv SetLastError DeleteCriticalSection GetPrivateProfileIntA GetPrivateProfileStringA QueryDosDeviceA DefineDosDeviceA DeviceIoControl QueryPerformanceCounter ResetEvent GetExitCodeThread TerminateThread GetSystemDirectoryA GlobalFree OpenEventA GetCurrentProcessId WaitForMultipleObjects SetEvent CreateMutexA WaitForSingleObject FlushViewOfFile UnmapViewOfFile GetTempPathA OpenFileMappingA CreateEventA ReleaseMutex LocalAlloc lstrcmpA GetVersion lstrlenA LocalFree GetModuleFileNameA CreateFileMappingA MapViewOfFile InterlockedExchange InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetTickCount InterlockedDecrement SearchPathA GlobalAlloc GlobalLock GlobalUnlock TerminateProcess GetVersionExA LoadLibraryA GetProcAddress HeapFree GetProcessHeap HeapAlloc OpenProcess FreeLibrary GetFileTime CompareFileTime Sleep GetCurrentDirectoryA GetEnvironmentVariableA GetTimeZoneInformation FileTimeToLocalFileTime FileTimeToSystemTime FindFirstFileA FindClose GetCommandLineA GetFileSize LockFile UnlockFile FormatMessageA MultiByteToWideChar GetACP CreateFileA WriteFile GetLastError CloseHandle DeleteFileA SetFilePointer WideCharToMultiByte ReadFile FindResourceW LoadResource LockResource SizeofResource GetVolumeInformationA GetCurrentProcess ConvertDefaultLocale DuplicateHandle GetProfileIntA

user32

GetKeyboardState GetKeyboardLayout MapVirtualKeyA ToAsciiEx CopyAcceleratorTableA DrawFocusRect DrawFrameControl DrawEdge DrawIconEx DrawStateA MessageBeep LoadMenuW SetClassLongA GetAsyncKeyState NotifyWinEvent CreatePopupMenu DestroyAcceleratorTable SetParent SetWindowRgn IsZoomed OffsetRect IsRectEmpty IntersectRect UnregisterClassA CopyImage CharUpperA DestroyIcon WaitMessage ReleaseCapture WindowFromPoint SetCapture InvalidateRect RealChildWindowFromPoint LoadCursorW SetLayeredWindowAttributes EnumDisplayMonitors SetRectEmpty DeleteMenu LoadCursorA GetSysColorBrush EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA FillRect SystemParametersInfoA DestroyMenu GetMenuItemInfoA InflateRect ShowWindow MoveWindow SetWindowTextA IsDialogMessageA CheckDlgButton LoadIconA SendDlgItemMessageA IsChild GetCapture GetClassLongA GetClassNameA SetPropA GetPropA RemovePropA SetFocus GetWindowTextLengthA GetWindowTextA GetForegroundWindow BeginDeferWindowPos EndDeferWindowPos GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MonitorFromWindow GetWindowRgn MapWindowPoints IsMenu TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar RedrawWindow UpdateWindow CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor AdjustWindowRectEx GetWindowRect ScreenToClient EqualRect DeferWindowPos GetScrollInfo SetScrollInfo SetWindowPlacement GetWindowPlacement GetDlgCtrlID DefWindowProcA CallWindowProcA GetMenu SetWindowLongA SetWindowPos CopyRect PtInRect GetWindow GetDesktopWindow SetActiveWindow CreateDialogIndirectParamA DestroyWindow IsWindow GetDlgItem GetNextDlgTabItem EndDialog ShowOwnedPopups SetCursor SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuA EnableMenuItem CheckMenuItem PostMessageA GetWindowThreadProcessId GetParent GetWindowLongA GetLastActivePopup IsWindowEnabled SetWindowsHookExA CallNextHookEx GetMessageA GetActiveWindow IsWindowVisible GetKeyState GetCursorPos ValidateRect GetMenuState GetMenuStringA GetMenuItemID InsertMenuA GetMenuItemCount GetSubMenu RemoveMenu wsprintfA PeekMessageA TranslateMessage DispatchMessageA OpenClipboard EmptyClipboard SetClipboardData CloseClipboard DestroyCursor MapDialogRect SubtractRect MapVirtualKeyExA GetKeyNameTextA IsCharLowerA GetDoubleClickTime CharUpperBuffA CopyIcon RegisterClipboardFormatA LoadImageW GetUpdateRect FrameRect PostQuitMessage LoadIconW EnableWindow SetTimer GetClientRect IsIconic GetSystemMenu SendMessageA AppendMenuA DrawIcon IsClipboardFormatAvailable SetMenuDefaultItem PostThreadMessageA CreateMenu GetMonitorInfoA KillTimer GetSystemMetrics RegisterWindowMessageA MessageBoxA UpdateLayeredWindow UnionRect MonitorFromPoint TranslateMDISysAccel DrawMenuBar DefMDIChildProcA DefFrameProcA GetNextDlgGroupItem GetIconInfo EnableScrollBar HideCaret InvertRect GetMenuDefaultItem UnpackDDElParam ReuseDDElParam LoadMenuA LoadImageA LoadAcceleratorsA InsertMenuItemA TranslateAcceleratorA LockWindowUpdate BringWindowToTop SetCursorPos SetRect CreateAcceleratorTableA ScrollWindow LoadAcceleratorsW WinHelpA

gdi32

SetTextAlign GetLayout SetLayout ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC CreatePatternBrush GetStockObject SelectPalette TextOutA GetObjectType CreatePen CreateSolidBrush CreateHatchBrush CreateDIBitmap CreateCompatibleBitmap CreateRectRgnIndirect GetTextMetricsA EnumFontFamiliesA GetTextCharsetInfo SetRectRgn CombineRgn PatBlt DPtoLP CreateDIBSection CreateRoundRectRgn CreatePolygonRgn MoveToEx GetTextColor Polyline Ellipse Polygon CreatePalette GetPaletteEntries GetNearestPaletteIndex RealizePalette GetSystemPaletteEntries OffsetRgn GetRgnBox SetDIBColorTable StretchBlt SetPixel Rectangle EnumFontFamiliesExA LPtoDP GetWindowOrgEx GetViewportOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries GetTextFaceA SetPixelV RectVisible PtVisible GetBkColor LineTo GetPixel GetWindowExtEx GetViewportExtEx CreateRectRgn IntersectClipRect ExcludeClipRect GetClipBox SetMapMode SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC GetTextExtentPoint32A ExtTextOutA BitBlt CreateCompatibleDC CreateFontIndirectA GetObjectA SetBkColor SetTextColor CreateBitmap SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject CreateDCA CopyMetaFileA CreateEllipticRgn GetDeviceCaps SelectClipRgn DeleteObject Escape

msimg32

AlphaBlend TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegQueryValueA RegSetValueExA RegQueryValueExA RegCreateKeyExA RegDeleteValueA RegDeleteKeyA RegOpenKeyA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegEnumValueA RegCloseKey RegEnumKeyA RegEnumKeyExA GetUserNameA RegOpenKeyExA

shell32

SHAppBarMessage SHGetFileInfoA DragFinish DragQueryFileA SHGetDesktopFolder SHBrowseForFolderA ShellExecuteA SHGetSpecialFolderLocation SHGetPathFromIDListA

comctl32

ImageList_GetIconSize

shlwapi

PathFindFileNameA PathStripToRootA PathIsUNCA PathFindExtensionA PathRemoveFileSpecW

ole32

CoInitializeEx CoUninitialize CoInitialize CoCreateInstance OleDuplicateData CoTaskMemAlloc OleDestroyMenuDescriptor CoTaskMemFree CoCreateGuid OleTranslateAccelerator IsAccelerator OleLockRunning RevokeDragDrop CoLockObjectExternal RegisterDragDrop OleGetClipboard DoDragDrop OleCreateMenuDescriptor ReleaseStgMedium CreateStreamOnHGlobal

oleaut32

VariantTimeToSystemTime SysStringLen SysAllocStringLen VariantInit SysFreeString VariantChangeType VariantClear SystemTimeToVariantTime VarBstrFromDate SysAllocString

ws2_32

closesocket bind WSAGetLastError getpeername recv send connect sendto gethostname WSAStartup getsockname

gdiplus

GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdipCreateFromHDC GdiplusShutdown GdipGetImageWidth GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree GdipGetImageHeight GdipGetImagePixelFormat GdipGetImagePaletteSize GdipGetImagePalette GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipDrawImageI GdiplusStartup

imm32

ImmGetOpenStatus ImmReleaseContext ImmGetContext

winmm

PlaySoundA

generic

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=152, version=20115,

count=49, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=204, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=8, id=171, productName=VS2010 build 30319, version=30319,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=5, id=147, productName=VS2008 build 21022, version=21022,

count=843, id=1, productName=Unmarked objects,

count=54, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=411, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,