0d11e173e7d04f14356842fe2959d240_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

0d11e173e7d04f14356842fe2959d240_NEIKI
Size

198KB
MD5

0d11e173e7d04f14356842fe2959d240
SHA1

0b2dcfe76c60334c39a1fdb9c7babe37412ec387
SHA256

8bd3e790d7ef2b9d72de5840225f6e3383b0e85407148f78e0ff7cbebd5d798a
SHA512

b65dbd1d00c66b13b7abc6454dbf273a9f46fb8ec1b7b8e2358ad6f414938669e4919c230d02a2736946d4e98c91b7adbec2d9579e34931770d47c6cc4fb9733
SSDEEP

3072:e1TlCN3DeL0dA/VkvpS6zpQDt0v2E6LGHxdOWTtDwqytR2TBf9AqqpUwI8zx:wlGXd4OvDzewKLGHj0qTBlznBcx

Score

1^/10

Malware Config

Signatures

Files

0d11e173e7d04f14356842fe2959d240_NEIKI
.exe windows:5 windows x86 arch:x86

8f2701ffdbdff91f3f18c5e5c24cf9f2

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2013, 12:00

Not After

15/01/2038, 12:00

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:b2:f5:71:1b:e4:5b:62:df:5c:35:c2:9a:e1:b3:7c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

25/09/2023, 00:00

Not After

23/09/2024, 23:59

Subject

CN=成都娄外科技有限公司,O=成都娄外科技有限公司,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e0:23:e5:3b:c9:7c:11:89:da:4a:4b:84:71:bc:a1:7e:e0:2d:62:94:90:ae:bb:00:52:ae:d0:4b:6e:7b:72:ab
Signer

Actual PE Digest

e0:23:e5:3b:c9:7c:11:89:da:4a:4b:84:71:bc:a1:7e:e0:2d:62:94:90:ae:bb:00:52:ae:d0:4b:6e:7b:72:ab

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\python-dev\porting\cpython\lib\distutils\command\wininst-10.0.pdb

Imports

comctl32

CreatePropertySheetPageA
PropertySheetA

kernel32

FreeLibrary
SetStdHandle
GetStdHandle
LocalFree
FormatMessageA
GetTempFileNameA
GetTempPathA
GetModuleHandleA
GetVersionExA
ResumeThread
SetPriorityClass
GetCurrentProcess
GetCurrentThread
SetThreadPriority
CreateProcessA
GetModuleFileNameA
RemoveDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetModuleFileNameW
SetEndOfFile
CreateFileW
GetFileSize
HeapSize
WriteConsoleW
FlushFileBuffers
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
LCMapStringW
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
SetConsoleCtrlHandler
RtlUnwind
GetConsoleMode
GetConsoleCP
SetHandleCount
FatalAppExitA
DeleteCriticalSection
SetFilePointer
ReadFile
DeleteFileA
LoadLibraryA
GetProcAddress
MultiByteToWideChar
lstrlenA
CompareStringW
UnmapViewOfFile
CreateFileA
GetLastError
DosDateTimeToFileTime
SetFileTime
CloseHandle
CreateFileMappingA
MapViewOfFile
GetFileAttributesA
CreateDirectoryA
SetLastError
InitializeCriticalSectionAndSpinCount
GetProcessHeap
Sleep
SetEnvironmentVariableA
SetEnvironmentVariableW
WriteFile
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
EnterCriticalSection
LeaveCriticalSection
GetTimeFormatA
GetDateFormatA
HeapReAlloc
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
WideCharToMultiByte
GetTimeZoneInformation
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
HeapCreate
HeapDestroy

user32

wsprintfA
GetFocus
MessageBoxA
SetCursor
GetDlgItem
SendDlgItemMessageA
GetParent
PostMessageA
GetWindowRect
MoveWindow
LoadCursorA
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
DefWindowProcA
BeginPaint
GetSystemMetrics
EndPaint
PeekMessageA
TranslateMessage
DispatchMessageA
GetDC
ReleaseDC
SendMessageA
SetDlgItemTextA

gdi32

CreateFontA
SelectObject
SetBkMode
TextOutA
SetTextColor
DeleteObject
CreateDIBitmap
CreateSolidBrush

advapi32

RegSetValueExA
RegCloseKey
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueA

shell32

ShellExecuteA

ole32

CoCreateInstance
CoInitialize
CoUninitialize

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8f2701ffdbdff91f3f18c5e5c24cf9f2

Code Sign

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5cCertificate

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

02:b2:f5:71:1b:e4:5b:62:df:5c:35:c2:9a:e1:b3:7cCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

e0:23:e5:3b:c9:7c:11:89:da:4a:4b:84:71:bc:a1:7e:e0:2d:62:94:90:ae:bb:00:52:ae:d0:4b:6e:7b:72:abSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 134KB - Virtual size: 134KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 4KB - Virtual size: 19KB

.rsrc Size: 5KB - Virtual size: 4KB

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:b2:f5:71:1b:e4:5b:62:df:5c:35:c2:9a:e1:b3:7c
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

e0:23:e5:3b:c9:7c:11:89:da:4a:4b:84:71:bc:a1:7e:e0:2d:62:94:90:ae:bb:00:52:ae:d0:4b:6e:7b:72:ab
Signer

.text
Size: 134KB - Virtual size: 134KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 4KB - Virtual size: 19KB

.rsrc
Size: 5KB - Virtual size: 4KB