3c54c22df23fe6b5a7fd7dff986c6230_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

3c54c22df23fe6b5a7fd7dff986c6230_NEIKI
Size

254KB
MD5

3c54c22df23fe6b5a7fd7dff986c6230
SHA1

430fb5ce3ba7d8cf1ed07ada007f390415221f70
SHA256

a3db92a0a82e420ffa4c8532a3ad97ff39e6ef764d415884db20939ffff4c17c
SHA512

0a7e569a2e8790f03fd7347f735e70bead22876fc87659594921285f475a4fd3b14bf2db4dcf23448b55db199491fd7eafc3b6fa1636325c08cc43486820e25f
SSDEEP

6144:lgHziz4bMcn/wiBKtYGLjhvQeElHvohTr:lgHz2SwiBGLN6Ro

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c54c22df23fe6b5a7fd7dff986c6230_NEIKI

Files

3c54c22df23fe6b5a7fd7dff986c6230_NEIKI
.exe windows:6 windows x64 arch:x64

c8f72c956bd34dfe52a06ac3a20d2f3d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\AFDK\AFDK\x64\Release\AFDK.pdb

Imports

kernel32

GetProcAddress
InitializeCriticalSectionEx
RaiseException
DecodePointer
GetModuleHandleW
MultiByteToWideChar
WriteConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetFileType
EnumSystemLocalesW
CreateFileW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateProcessW
CreateMutexW
ExitProcess
GetProcessHeap
LocalFree
HeapAlloc
HeapFree
WriteFile
ReadFile
CopyFileW
GetCurrentProcessId
GetLastError
GetCurrentProcess
CloseHandle
GetUserDefaultLCID
IsValidLocale
RtlUnwind
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
RtlPcToFileHeader
RtlUnwindEx
OutputDebugStringW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
WideCharToMultiByte
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleFileNameW

advapi32

RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW

shell32

SHGetSpecialFolderPathW

oleaut32

VariantClear

crypt32

CryptBinaryToStringA
CryptStringToBinaryA

Sections

.text
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8f72c956bd34dfe52a06ac3a20d2f3d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

oleaut32

crypt32

Sections

.text Size: 149KB - Virtual size: 148KB

.rdata Size: 86KB - Virtual size: 86KB

.data Size: 5KB - Virtual size: 12KB

.pdata Size: 8KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 149KB - Virtual size: 148KB

.rdata
Size: 86KB - Virtual size: 86KB

.data
Size: 5KB - Virtual size: 12KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 3KB