1d01b7da4b8e9fa63ccf16212c8e6cd0_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

1d01b7da4b8e9fa63ccf16212c8e6cd0_NEIKI
Size

2.1MB
MD5

1d01b7da4b8e9fa63ccf16212c8e6cd0
SHA1

ff5535c62f9ca35ef6d869f12acfde689bdfc0c8
SHA256

26cd50aaf5dd4ab0d6c7154239d257d1a919373ba2e76e20dd2d39823418d63a
SHA512

988272e36e7463366906f069d1c0c4586df19a6fd8d25303d43dfc7841e4439d9b785091a85d657c156db306902926ddbaadb9f29c4a4dab700af3f3c18c02e4
SSDEEP

49152:k4W+J/pHuR7n20mT4FE2LnwUxfcdzBoqvMpRx31Y2JXD:Xsx4tvk3eW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d01b7da4b8e9fa63ccf16212c8e6cd0_NEIKI

Files

1d01b7da4b8e9fa63ccf16212c8e6cd0_NEIKI
.exe windows:6 windows x64 arch:x64

662a62fd620166dd48a80e96ad92b33b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vssvc.pdb

Imports

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAce
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
ConvertSidToStringSidW
LookupAccountSidW
GetLengthSid
AllocateAndInitializeSid
FreeSid
RegEnumValueW
RegQueryInfoKeyW
RegDeleteValueW
EqualDomainSid
GetSidSubAuthorityCount
AccessCheck
IsValidSid
LookupAccountNameW
AddAccessAllowedAceEx
AddAccessDeniedAceEx
AddAce
GetAce
GetAclInformation
SetSecurityDescriptorGroup
CopySid
SetSecurityDescriptorOwner
EqualSid
ConvertStringSidToSidW
CreateWellKnownSid
AdjustTokenPrivileges
PrivilegeCheck
LookupPrivilegeValueW
CheckTokenMembership
DuplicateToken
ReportEventW
DeregisterEventSource
GetTokenInformation
OpenThreadToken
OpenProcessToken
RegisterEventSourceW

kernel32

InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
EncodePointer
GetTimeZoneInformation
GetDiskFreeSpaceW
SetErrorMode
GetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentThreadId
CloseHandle
GetComputerNameW
GetComputerNameExW
GetVolumeInformationW
DefineDosDeviceW
GetEnvironmentVariableW
GetSystemWindowsDirectoryW
FindClose
FindVolumeClose
FindNextFileW
FindFirstFileW
FindNextVolumeW
FindFirstVolumeW
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
CreateThread
SetLastError
GetVersionExW
MultiByteToWideChar
FormatMessageW
GetCurrentThread
LoadLibraryExW
FreeLibrary
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetVolumePathNamesForVolumeNameW
ReadFile
DeleteFileW
MoveFileExW
GetFileAttributesW
WriteFile
SetFileAttributesW
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
CreateEventW
OpenThread
CreateWaitableTimerW
SetEvent
SetWaitableTimer
CancelWaitableTimer
HeapSetInformation
GetCommandLineW
CompareStringW
LocalFree
LocalAlloc
CreateFileW
ResetEvent
DeviceIoControl
GetVolumeNameForVolumeMountPointW
GetDriveTypeW
QueryDosDeviceW
SetVolumeMountPointW
GetVolumePathNameW
GetSystemDirectoryW
lstrlenW
RaiseException
DeleteVolumeMountPointW
CreateDirectoryW
HeapAlloc
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
FlushFileBuffers
GetTickCount64
GetOverlappedResult
WaitForMultipleObjects
SetThreadPriority
ResumeThread

user32

LoadStringW
RegisterDeviceNotificationW
UnregisterDeviceNotification

msvcrt

wcsncmp
memcmp
memset
_snwscanf_s
_wcslwr
_wcsupr
wcsnlen
strncmp
_ultow_s
wcscpy_s
wcscat_s
swprintf_s
_purecall
_vsnwprintf
free
realloc
_wcsicmp
memmove
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
wcschr
_vscwprintf
memcpy
_beginthreadex
towupper
iswspace
wcsrchr
_errno
malloc
_wcsnicmp
qsort
wcsstr
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
wcstoul
iswdigit
_vsnprintf
?terminate@@YAXXZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
memmove_s
??0exception@@QEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
_callnewh
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
__CxxFrameHandler3

atl

ord23
ord32
ord17
ord20
ord16
ord58
ord30

ole32

CoImpersonateClient
CoTaskMemRealloc
CoSetProxyBlanket
StringFromCLSID
CoGetObjectContext
CoFreeUnusedLibraries
CLSIDFromString
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoDisconnectContext
CoRevertToSelf

shlwapi

SHDeleteKeyW

oleaut32

SysAllocStringLen
LoadRegTypeLi
VariantClear
GetErrorInfo
SysFreeString
SysAllocString
VariantChangeType
SysStringLen
VariantInit
VariantCopy

rpcrt4

I_RpcBindingInqLocalClientPID
UuidToStringW
RpcStringFreeW

ntdll

NtClose
NtCreateSymbolicLinkObject
RtlInitUnicodeString
NtThawTransactions
NtFreezeTransactions
NtQuerySystemInformation
RtlNtStatusToDosErrorNoTeb
NtQueryVolumeInformationFile
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlNtStatusToDosError
NtThawRegistry
NtFreezeRegistry
NtAllocateUuids
NtResetEvent
LdrGetDllHandle
LdrGetProcedureAddress
RtlInitAnsiString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlLengthSid
RtlAllocateAndInitializeSid
NtDeleteKey
NtAdjustPrivilegesToken
NtSetValueKey
NtQueryValueKey
NtSetSecurityObject
NtOpenProcessToken
RtlAddAccessAllowedAceEx
RtlLengthSecurityDescriptor
RtlFreeHeap
RtlAllocateHeap
NtOpenFile
RtlStringFromGUID
RtlFreeUnicodeString
RtlGUIDFromString
NtDeviceIoControlFile
NtWaitForSingleObject
NtCreateEvent
NtQueryKey
NtEnumerateKey
NtQueryAttributesFile
NtOpenKey
RtlCreateAcl
NtUnloadKey
RtlFreeSid
RtlSetDaclSecurityDescriptor
NtDeleteValueKey
NtLoadKey
NtOpenThreadToken
NtCreateKey
EtwTraceMessage

vssapi

?LoadVssSnapshotSetDescription@@YAJPEBGPEAPEAVIVssSnapshotSetDescription@@U_GUID@@@Z
CreateWriter
?CreateVssSnapshotSetDescription@@YAJU_GUID@@JPEAPEAVIVssSnapshotSetDescription@@@Z
CreateWriterEx
VssFreeSnapshotPropertiesInternal

netapi32

NetShareGetInfo
NetLocalGroupGetMembers
NetShareEnum
NetShareDel
NetApiBufferFree
NetShareAdd

clusapi

OpenCluster
OpenClusterResource
GetClusterResourceState
CloseClusterResource
ClusterResourceControl
CloseCluster
GetNodeClusterState

xolehlp

ord9
ord8

resutils

ResUtilGetResourceName
ResUtilEnumResourcesEx

setupapi

SetupDiCallClassInstaller
CM_Get_Parent
SetupDiGetDeviceInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW

vsstrace

ord7
ord4
ord6
ord3
ord5
ord8
ord1
ord2
ord11
ord10
ord9

authz

AuthzRegisterSecurityEventSource
AuthzUnregisterSecurityEventSource
AuthzReportSecurityEventFromParams

virtdisk

GetStorageDependencyInformation

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

662a62fd620166dd48a80e96ad92b33b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

atl

ole32

shlwapi

oleaut32

rpcrt4

ntdll

vssapi

netapi32

clusapi

xolehlp

resutils

setupapi

vsstrace

authz

virtdisk

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.data Size: 5KB - Virtual size: 8KB

.pdata Size: 40KB - Virtual size: 40KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 5KB - Virtual size: 8KB

.pdata
Size: 40KB - Virtual size: 40KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 572KB - Virtual size: 576KB