0bb4c5d94879478247d934e90fde6920_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0bb4c5d94879478247d934e90fde6920_NEIKI
Size

151KB
MD5

0bb4c5d94879478247d934e90fde6920
SHA1

50e48a558e40692f04cb4027eb33775209c0d644
SHA256

b35b48e98bb94fb57649d2e923318603cc464c1c2c2eadfb169798bc5375324a
SHA512

977da5d724a295ec4a7a2344c433ce6f750791005f25b45cc489ef884215a369def211a603ee1275851b6915c79f9882b575b5f21b083dcbc06e8035945c4c82
SSDEEP

3072:OeEohik9KawvtUOJATuuPcqAKD27snAgy:Oej3/wlUOJATJPc827snpy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0bb4c5d94879478247d934e90fde6920_NEIKI

Files

0bb4c5d94879478247d934e90fde6920_NEIKI
.exe windows:1 windows x86 arch:x86

5f3116d80bafb9b1b009ce41379e0270

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptBinaryToStringW

kernel32

GetProcAddress
LoadLibraryA
RtlUnwind
VirtualProtect
GetModuleHandleA
CloseHandle
GetLastError

crtdll

__GetMainArgs
exit
raise
signal

advapi32

SetServiceStatus
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA

ulib

?Put@ARRAY@@UAEEPAVOBJECT@@@Z
??0DSTRING@@QAE@XZ

ntdll

RtlFreeHeap

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 40B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 250B - Virtual size: 250B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ