fac8d2648e333e07c7f7479d856fde80_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

fac8d2648e333e07c7f7479d856fde80_NEIKI
Size

69KB
MD5

fac8d2648e333e07c7f7479d856fde80
SHA1

144d37f53aa20f317fb6b8b128c47203939cff86
SHA256

e84f545aa7503fddeceb9238ef898dcf4c0ff14fc34a44add630d46f58c8207e
SHA512

e9d50e447e0da521077ccc31c3774e05a8b6c88ad932f918882bafb466e62d1b8b6ef4db4f814bbe4e5bf6f767f71dec41231dafe2c0463c247510c460d3e7e4
SSDEEP

1536:j1ft1DHhFOJBGrAl1dPyJ74UgMx1l1MJ:j1VphFOJBGrAlTPyJMbMv8J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fac8d2648e333e07c7f7479d856fde80_NEIKI

Files

fac8d2648e333e07c7f7479d856fde80_NEIKI
.dll windows:4 windows x86 arch:x86

f8c9624359be12b2eab98d1b7539fc5f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

rtl60.bpl

@System@initialization$qqrv
@System@Finalization$qqrv
@System@UnregisterModule$qqrp17System@TLibModule
@System@RegisterModule$qqrp17System@TLibModule
@System@FindHInstance$qqrpv
@System@@LStrFromPChar$qqrr17System@AnsiStringpc
@System@@LStrAsg$qqrpvpxv
@System@@LStrClr$qqrpv
@System@@HandleFinally$qqrv
@System@IsMemoryManagerSet$qqrv
@System@SetMemoryManager$qqrrx21System@TMemoryManager
@System@IsMultiThread
@System@IsConsole
@System@ExitProc
@System@CmdLine
@System@IsLibrary
@System@MainInstance
@Types@initialization$qqrv
@Types@Finalization$qqrv
@Sysconst@initialization$qqrv
@Sysconst@Finalization$qqrv
@Sysutils@initialization$qqrv
@Sysutils@Finalization$qqrv
@Varutils@initialization$qqrv
@Varutils@Finalization$qqrv
@Variants@initialization$qqrv
@Variants@Finalization$qqrv
@Rtlconsts@initialization$qqrv
@Rtlconsts@Finalization$qqrv
@Typinfo@initialization$qqrv
@Typinfo@Finalization$qqrv
@Typinfo@DotSep
@Typinfo@BooleanIdents

borlndmm

ord2

kernel32

DeleteCriticalSection
FreeLibrary
GetCommandLineA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetVersion
HeapAlloc
HeapFree
LoadLibraryA

cc3260mt

@$bdele$qpv
@$bnew$qui
@_InitTermAndUnexPtrs$qv
__ErrorExit
__ErrorMessage
___CRTL_MEM_GetBorMemPtrs
___CRTL_MEM_UseBorMM
___CRTL_TLS_Alloc
___CRTL_TLS_ExitThread
___CRTL_TLS_Free
___CRTL_TLS_GetValue
___CRTL_TLS_InitThread
___CRTL_TLS_SetValue
____ExceptionHandler
__argv_default_expand
__free_heaps
__handle_exitargv
__handle_setargv
__handle_wexitargv
__handle_wsetargv
__lstrlwr
__max_flt
__startupd
__wargv_default_expand
_cos
_fabs
_log
_memcpy
_memmove
_sin
_sqrt
_strcat
_strchr
_strcpy
_stricmp
_strlen
_strstr

stlpmt45

ord2
ord467

dsound

ord11

xrcdbb

@CDB@COLLIDER@$bctr$qqsv
@CDB@COLLIDER@$bdtr$qqsv
@CDB@COLLIDER@ray_query$qqspx9CDB@MODELrx12%_vector3$f%t2f
@CDB@MODEL@$bctr$qqsv
@CDB@MODEL@$bdtr$qqsv
@CDB@MODEL@build$qqsp12%_vector3$f%ip7CDB@TRIipqqsp12%_vector3$f%ip7CDB@TRIipv$vpv

xrcoreb

@CLocatorAPI@exist$qqspcpxct2
@CLocatorAPI@exist$qqspxc
@CLocatorAPI@exist$qqspxct1
@CLocatorAPI@r_close$qqsrp7IReader
@CLocatorAPI@r_open$qqspxct1
@CLocatorAPI@update_path$qqspcpxct2
@CLocatorAPI@w_close$qqsrp7IWriter
@CLocatorAPI@w_open$qqspxct1
@CPU@GetCycleCount$qqrv
@CPU@cycles_overhead
@CPU@cycles_per_milisec
@IReader@close$qqsv
@IReader@open_chunk$qqsui
@IReader@r$qqspvi
@IReader@r_stringZ$qqspc
@IWriter@close_chunk$qqsv
@IWriter@open_chunk$qqsui
@Log$qqspxct1
@Msg$qpxce
@str_container@dock$qqspxc
@xrDebug@error$qqslpxct2i
@xrDebug@fail$qqspxct1i
@xrDebug@fail$qqspxct1t1i
@xrDebug@fail$qqspxct1t1t1i
@xrDebug@fatal$qpxce
@xrMemory@mem_alloc$qqsui
@xrMemory@mem_free$qqspv
@xr_strcmp$qqspxct1
_Core
_Debug
_Memory
_Random
_g_pStringContainer
_xr_FS

vorbisfile

ord3
ord4
ord6
ord8
ord10
ord11
ord16
ord21

Exports

Exports

@@Editor@Finalize
@@Editor@Initialize
@CSoundRender_Environment@$bctr$qqsv
@CSoundRender_Environment@$bdtr$qqsv
@CSoundRender_Environment@clamp$qqsooo
@CSoundRender_Environment@lerp$qqsr24CSoundRender_Environmentt1f
@CSoundRender_Environment@load$qqsp7IReader
@CSoundRender_Environment@save$qqsp7IWriter
@CSoundRender_Environment@set_default$qqsooo
@CSoundRender_Environment@set_identity$qqsooo
@CSoundRender_Source@$bctr$qqsv
@CSoundRender_Source@$bdtr$qqsv
@CSoundRender_Source@LoadWave$qqspxci
@CSoundRender_Source@decompress$qqsui
@CSoundRender_Source@file_name$qqsv
@CSoundRender_Source@game_type$qqsv
@CSoundRender_Source@length_ms$qqsv
@CSoundRender_Source@load$qqspxci
@CSoundRender_Source@unload$qqsv
@SoundEnvironment_LIB@Append$qqsp24CSoundRender_Environment
@SoundEnvironment_LIB@Get$qqsi
@SoundEnvironment_LIB@Get$qqspxc
@SoundEnvironment_LIB@GetID$qqspxc
@SoundEnvironment_LIB@Library$qqsv
@SoundEnvironment_LIB@Load$qqspxc
@SoundEnvironment_LIB@Remove$qqsi
@SoundEnvironment_LIB@Remove$qqspxc
@SoundEnvironment_LIB@Save$qqspxc
@SoundEnvironment_LIB@Unload$qqsv
_Sound
___CPPdebugHook
_psSoundCacheSizeMB
_psSoundCull
_psSoundDoppler
_psSoundFlags
_psSoundFreq
_psSoundModel
_psSoundOcclusionScale
_psSoundRolloff
_psSoundTargets
_psSoundVEffects
_psSoundVMaster
_psSoundVMusic

Sections

.text
Size: 48KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f8c9624359be12b2eab98d1b7539fc5f

Headers

File Characteristics

Imports

rtl60.bpl

borlndmm

kernel32

cc3260mt

stlpmt45

dsound

xrcdbb

xrcoreb

vorbisfile

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 52KB

.data Size: 9KB - Virtual size: 12KB

.tls Size: 512B - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 8KB

.edata Size: 2KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 4KB

.reloc Size: 2KB - Virtual size: 4KB

.text
Size: 48KB - Virtual size: 52KB

.data
Size: 9KB - Virtual size: 12KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 8KB

.edata
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

.reloc
Size: 2KB - Virtual size: 4KB