f0a2f3942e2c1bca30dd04a6702dc4d0_NEIKI | Triage

Sharing

General

Target

f0a2f3942e2c1bca30dd04a6702dc4d0_NEIKI
Size

75KB
MD5

f0a2f3942e2c1bca30dd04a6702dc4d0
SHA1

bd06bb2a8459f4f0d25c857f58cfe5f13d2e5fa6
SHA256

5819ff0e841ec0ed2001121801bc8489940443d2b15079327988bdf91ba6bbab
SHA512

f196d6f9e5c6f088ce404f9963485fa35585e7f443ac783f690d4e374a1f410b179d1aeafa12a058f63f5882a62cf79a4b48c190f970a7e6482a6b877fc690f6
SSDEEP

1536:qjUMUbaCG/p1HwRZM0ODVQzog/UjmCzhXV8EYh5JgLqxmPlMrSITl:4UMUbaCG/PQRZM0OEo0U3DDjPlML

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0a2f3942e2c1bca30dd04a6702dc4d0_NEIKI

Files

f0a2f3942e2c1bca30dd04a6702dc4d0_NEIKI
.dll windows:4 windows x86 arch:x86

d158f314547a26352d3c827bcf503b67

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

fopen
floor
calloc
fscanf
fclose
free
fseek
_initterm
malloc
_adjust_fdiv
_unlink
_flushall

kernel32

DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress

Exports

Exports

_toolref_cbox
fncb_unfold
m_main
xreal
xshort

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 371B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 406B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ