Behavioral task
behavioral1
Sample
ed2c0db5a9ec93e65c0b767979703160_NEIKI.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ed2c0db5a9ec93e65c0b767979703160_NEIKI.exe
Resource
win10v2004-20240226-en
General
-
Target
ed2c0db5a9ec93e65c0b767979703160_NEIKI
-
Size
4.2MB
-
MD5
ed2c0db5a9ec93e65c0b767979703160
-
SHA1
4172425f15d278bf31bf91a7d91ed458517d149d
-
SHA256
8f0e0c7b03657220d305480ace13ad6edd4c666ac909b2efce4f804533a1b580
-
SHA512
4284119c12cb9418db47c21f7328d3311af777d088cf7050940c3c49016aaa52f55094be0be0d66311262f100234292e65978addfdbfe84c3c59318197c97bf9
-
SSDEEP
98304:uidvas8y8o9RBWITY3SwHoG/+Lon0r7jQi7GkrJ6FD+Rv2crun2BX7IY64l:uidCssoNc3jokWon0rfQi7GkkFD+RLuC
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource ed2c0db5a9ec93e65c0b767979703160_NEIKI unpack001/out.upx
Files
-
ed2c0db5a9ec93e65c0b767979703160_NEIKI.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 563KB - Virtual size: 564KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 500KB - Virtual size: 499KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ