edd4872f406973b3ac2a4157ef842770_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

edd4872f406973b3ac2a4157ef842770_NEIKI
Size

4.8MB
MD5

edd4872f406973b3ac2a4157ef842770
SHA1

d5bd03d4c1c5d78da93d5f003ad414cae7b9ef6c
SHA256

a80b96b8fa6dc1c16540c92439bf059aec4ce2ebe103b7bfe48355fbc7216c7d
SHA512

c317e7d84274b50802c034876aecc828e5f6c6f51fa39d79257380167a8a484909b4a07eb9eab4ef8bf204808680d30d2c2f0308abc280a6c48527e320841d09
SSDEEP

98304:OUwGeQ7+SqudqpnoHz5GuZPQLq30QckVMzv3zRVbAy/4qO6S:OU4Q9qpnoTNZIG3nDY1AqO6S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edd4872f406973b3ac2a4157ef842770_NEIKI

Files

edd4872f406973b3ac2a4157ef842770_NEIKI
.exe windows:6 windows x86 arch:x86

6e61df670bfbbd20ff13d82b5d9f53c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetGetUserW
WNetGetUniversalNameW
WNetGetConnectionW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx

shell32

ord680
SHFileOperationW
SHGetFileInfoW
SHGetFolderPathW
CommandLineToArgvW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSEnumerateProcessesW
WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsA

secur32

GetUserNameExW

iphlpapi

GetAdaptersInfo

dbghelp

StackWalk
SymSetOptions
SymGetOptions
SymFunctionTableAccess
SymGetModuleInfo
SymInitialize
SymUnDName
SymLoadModule
SymGetSymFromAddr
UnDecorateSymbolName

advapi32

EqualSid
BuildTrusteeWithSidW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetEffectiveRightsFromAclW
SetEntriesInAclW
MapGenericMask
GetLengthSid
FreeSid
CopySid
CheckTokenMembership
AllocateAndInitializeSid
AccessCheck
ConvertStringSidToSidW
ConvertSidToStringSidW
RegGetValueW
GetUserNameW
LookupAccountNameW
LookupAccountSidW
RevertToSelf
IsValidSid
ImpersonateSelf
GetTokenInformation
OpenThreadToken
OpenProcessToken
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

user32

LoadStringW
LoadStringA
GetDesktopWindow
wsprintfA

kernel32

GetCPInfo
LoadLibraryExW
GetModuleHandleExW
CreateThread
ExitThread
ResumeThread
ExitProcess
RaiseException
FreeLibraryAndExitThread
HeapReAlloc
GetFileType
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
ReadConsoleW
RtlUnwind
GetProcAddress
GetStringTypeW
GetLocaleInfoW
DecodePointer
EncodePointer
TlsFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCommandLineW
LocalFree
FreeConsole
GetUserDefaultLangID
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexA
FormatMessageA
OpenMutexA
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetStdHandle
OutputDebugStringA
AllocConsole
WriteConsoleW
GetTickCount
CompareStringW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
VerSetConditionMask
HeapAlloc
HeapFree
GetProcessHeap
Sleep
GetCurrentProcess
GetCurrentThread
GetSystemInfo
GetComputerNameExW
GetVersionExA
GetModuleFileNameW
GetModuleHandleA
TlsGetValue
VerifyVersionInfoW
GetACP
GetUserDefaultLocaleName
GetThreadContext
VirtualQueryEx
FreeLibrary
GetModuleFileNameA
LoadLibraryA
lstrcpynA
lstrcpyA
lstrcatA
LoadLibraryW
SetEvent
ResetEvent
CreateEventA
CreateFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileSizeEx
LockFile
ReadFile
SetFilePointerEx
UnlockFile
WriteFile
CreateDirectoryW
DeleteFileW
GetDriveTypeW
GetFileInformationByHandle
GetVolumePathNameW
RemoveDirectoryW
SetFileAttributesW
SetFileTime
GetTempPathW
GetBinaryTypeW
CopyFileW
MoveFileW
MoveFileExW
FileTimeToSystemTime
SystemTimeToFileTime
FindFirstFileExW
FindNextFileW
GetComputerNameW
FormatMessageW
GlobalMemoryStatusEx
GetCurrentThreadId
TerminateProcess
GetExitCodeProcess
CreateProcessW
SetPriorityClass
OpenProcess
FoldStringW
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoA
GetSystemDefaultLCID
GetCurrentProcessId
GetModuleHandleW
CreateToolhelp32Snapshot
Process32First
Process32Next
K32GetModuleFileNameExW
CreateFileA
FindFirstFileA
FindNextFileA
GetFileSize
GetStringTypeExW
LCMapStringW
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsSetValue

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 326KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 347KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e61df670bfbbd20ff13d82b5d9f53c6

Headers

DLL Characteristics

File Characteristics

Imports

mpr

ole32

shell32

version

wtsapi32

secur32

iphlpapi

dbghelp

advapi32

user32

kernel32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 326KB - Virtual size: 326KB

.data Size: 67KB - Virtual size: 81KB

.rsrc Size: 347KB - Virtual size: 347KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 326KB - Virtual size: 326KB

.data
Size: 67KB - Virtual size: 81KB

.rsrc
Size: 347KB - Virtual size: 347KB