3e68b6898cbdbd466f5f9e367233c800_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

3e68b6898cbdbd466f5f9e367233c800_NEIKI
Size

148KB
MD5

3e68b6898cbdbd466f5f9e367233c800
SHA1

984324838f90defe587c0b5f4a33803e624ac86a
SHA256

7d5b560c92307f3737290d6d09720769c276fc93c00fe8a1e9ab08591ed035da
SHA512

5f63170789d58b10c09f978d1e2a8e36e1dd6e4698ea21d737228466d08cd1ca0c9f149bc5c42f474292444f2fdd6a2bb6713ff4d1a23965922fdcb82b73a838
SSDEEP

3072:iFHOUN2lbB6pF6XTrXSNele+Z9SDADeak7dJHB/AdGA:i3N2lbB6WX63+SsQLH5Adv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e68b6898cbdbd466f5f9e367233c800_NEIKI

Files

3e68b6898cbdbd466f5f9e367233c800_NEIKI
.exe windows:4 windows x86 arch:x86

e3b4f5c0866471323c0125454c6b2c66

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEvent
OpenEventA
MultiByteToWideChar
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrlenA
WaitForSingleObject
CreateThread
CreateEventA
InterlockedIncrement
lstrcpynA
lstrcpyA
GetModuleFileNameA
lstrcatA
IsDBCSLeadByte
CloseHandle
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
Sleep
GetCurrentThreadId
GetCommandLineA
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FlushFileBuffers
SetStdHandle
SetFilePointer
InterlockedDecrement
WideCharToMultiByte
lstrcmpiA
GetModuleHandleA
GetProcAddress
GetVersionExA
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
GetACP
FreeLibrary
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
LoadLibraryA
LCMapStringW
FreeEnvironmentStringsW
LCMapStringA
IsBadCodePtr
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
WriteFile
HeapSize
GetCurrentProcess
IsBadReadPtr
GetSystemTimeAsFileTime
LocalFree
HeapAlloc
RtlUnwind
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetStartupInfoA
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId

user32

PostThreadMessageA
DefWindowProcA
DispatchMessageA
GetMessageA
CreateWindowExA
RegisterClassA
CharNextA

advapi32

RegQueryInfoKeyA
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey
IsTextUnicode

ole32

CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysFreeString
SysAllocString
VariantClear

shlwapi

PathFindExtensionA

Sections

.text
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3b4f5c0866471323c0125454c6b2c66

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

Sections

.text Size: 72KB - Virtual size: 69KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 56KB - Virtual size: 53KB

.text
Size: 72KB - Virtual size: 69KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 56KB - Virtual size: 53KB