1b40f9c84194b81c9ff7af479257d590_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1b40f9c84194b81c9ff7af479257d590_NEIKI
Size

119KB
MD5

1b40f9c84194b81c9ff7af479257d590
SHA1

1f1b7bce1d84c28f4f6a8829617236239218ceeb
SHA256

ada1071e362202e49e14002afe6f8e779c53a8c3c85d5b254b62f149bcabcab1
SHA512

4a44319dce4ecb9c0b90cdaade70d6791c0f2993b96fbdd4089525502aac5e87681304593005fecf856db8a6d5dedfc9e049e73cdccb6aa2057df4221f6352b5
SSDEEP

3072:29uSbSoetygwxWViWYNi6jz9PMXhQpPg/elHe0:29FbEvwovYNiix+aPgmFX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b40f9c84194b81c9ff7af479257d590_NEIKI

Files

1b40f9c84194b81c9ff7af479257d590_NEIKI
.exe windows:4 windows x86 arch:x86

568322d3632cdf98bae7b1c98d4c762a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetCurrentDirectoryA
GetStateFolder
SetFileAttributesW
DosPathToSessionPathW
ContinueDebugEvent
QuirkIsEnabledForPackage4Worker
SetSystemFileCacheSize
lstrcpyA
OpenConsoleWStub
RegUnLoadKeyW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE