24b383147362dbc7bc14c57956159080_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

24b383147362dbc7bc14c57956159080_NEIKI
Size

1.9MB
MD5

24b383147362dbc7bc14c57956159080
SHA1

e5ea809210a6ce984dc53c196073758cbae1a042
SHA256

533894e3e1215971733565f5076782e23c90fe8b5a87e77f7c6e41b97b3f0f6a
SHA512

631895ecbc98f99ecd77b521f525783d5dadd846da04bcf73bfb1ce1850fd66f0d609a3becc0a5f929a5d1b14d699509f216ba267d55018e5cc33f347e36f482
SSDEEP

49152:4MrryeS60IC6WHwYHBX+mI76QotAtB9hLGrnH:U60IC64N+p76QotAtBbin

Score

1^/10

Malware Config

Signatures

Files

24b383147362dbc7bc14c57956159080_NEIKI
.exe windows:5 windows x86 arch:x86

664f8d20620907707c926809602ee26f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

64:21:e8:8d:19:0b:38:94:bc:76:d9:9c:3b:b7:e9:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02/04/2014, 00:00

Not After

02/07/2015, 23:59

Subject

CN=NPCORE\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=NPCORE\, Inc.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c5:62:31:00:17:fc:25:b3:b8:f8:88:4c:a1:11:0b:3f:98:e0:c8:ad
Signer

Actual PE Digest

c5:62:31:00:17:fc:25:b3:b8:f8:88:4c:a1:11:0b:3f:98:e0:c8:ad

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Z:\Projects\ZombieZero\Programs32\Encryptor.pdb

Imports

kernel32

SetFilePointer
lstrcpyA
OutputDebugStringA
GetProcessHeap
CreateDirectoryA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetCurrentThreadId
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceA
lstrcpynA
GetModuleFileNameA
WritePrivateProfileStringA
InterlockedDecrement
CreateFileA
ReadFile
CloseHandle
lstrlenA
MulDiv
MultiByteToWideChar
lstrlenW
LocalFree
FormatMessageA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
CopyFileA
GlobalFree
SetLastError
GetLastError
GetProcAddress
GetModuleHandleA
FreeLibrary
InterlockedExchange
CompareStringA
LoadLibraryExA
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
GlobalDeleteAtom
FreeResource
GetCurrentProcessId
GetModuleFileNameW
SetThreadPriority
ResumeThread
WaitForSingleObject
SetEvent
CreateEventA
GlobalAddAtomA
GetVersionExA
lstrcmpW
LoadLibraryA
GlobalFindAtomA
GlobalGetAtomNameA
FileTimeToSystemTime
FileTimeToLocalFileTime
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LocalAlloc
GetModuleHandleW
InterlockedIncrement
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetThreadLocale
GetCurrentDirectoryA
GlobalFlags
WriteFile
lstrcmpA
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetCurrentProcess
FindClose
FindFirstFileA
GetVolumeInformationA
GetFullPathNameA
GetCPInfo
GetOEMCP
GetFileAttributesA
GetFileSizeEx
GetFileTime
SetErrorMode
GetTickCount
GetProfileIntA
Sleep
SearchPathA
GetTempFileNameA
GetTempPathA
LoadLibraryW
GetSystemDirectoryW
VirtualProtect
FindResourceExA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCommandLineA
GetStartupInfoA
HeapAlloc
RtlUnwind
RaiseException
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
ExitProcess
ExitThread
CreateThread
HeapSize
GetSystemTimeAsFileTime
SetStdHandle
GetFileType
GetACP
IsValidCodePage
GetStdHandle
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
CompareStringW
GetConsoleCP
GetConsoleMode
GetTimeFormatA
GetDateFormatA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA

user32

SetRectEmpty
InflateRect
GetNextDlgGroupItem
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableA
CharNextA
DeleteMenu
WaitMessage
ReleaseCapture
WindowFromPoint
SetCapture
LoadCursorA
GetSysColorBrush
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
CheckDlgButton
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
SetWindowPlacement
GetDlgCtrlID
DefWindowProcA
GetMenu
LoadMenuA
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
InsertMenuItemA
InvalidateRect
UpdateWindow
GetClientRect
DrawStateA
ShowOwnedPopups
SetCursor
GetMessageA
TranslateMessage
DispatchMessageA
IsWindowVisible
PeekMessageA
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetCursorPos
GetFocus
GetWindowRect
PtInRect
GetSysColor
EndPaint
BeginPaint
LoadAcceleratorsA
ReuseDDElParam
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GetParent
FindWindowExA
UnpackDDElParam
RegisterClipboardFormatA
OpenClipboard
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
GetWindowThreadProcessId
GetLastActivePopup
MessageBoxA
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
GetSystemMenu
SetWindowRgn
RedrawWindow
SetTimer
KillTimer
NotifyWinEvent
GetAsyncKeyState
IsZoomed
CharUpperA
UnionRect
EnableScrollBar
UpdateLayeredWindow
IsWindowEnabled
GetNextDlgTabItem
EndDialog
RegisterWindowMessageA
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
PostQuitMessage
PostMessageA
GetMenuState
DestroyMenu
IsMenu
CreatePopupMenu
GetMenuItemInfoA
SetMenuDefaultItem
GetMenuDefaultItem
UnregisterClassA
DestroyIcon
TranslateAcceleratorA
OffsetRect
BringWindowToTop
SetWindowsHookExA
UnhookWindowsHookEx
SetWindowLongA
CallWindowProcA
CallNextHookEx
GetKeyState
GetWindowLongA
EnableWindow
LoadIconA
MessageBeep
RemoveMenu
GetSubMenu
GetMenuItemCount
InsertMenuA
GetMenuItemID
AppendMenuA
GetMenuStringA
CopyImage
LoadImageA
SetClipboardData
CloseClipboard
EmptyClipboard
DrawEdge
DrawFrameControl
DrawFocusRect
DrawIcon
GetWindowRgn
SubtractRect
MapVirtualKeyExA
IsCharLowerA
GetUpdateRect
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
CreateMenu
DestroyCursor
IsClipboardFormatAvailable
GetDoubleClickTime
GetIconInfo
GetKeyNameTextA
PostThreadMessageA
CreateAcceleratorTableA
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyA
ToAsciiEx
CharUpperBuffA
LockWindowUpdate
CopyIcon
FrameRect
SetCursorPos
SetClassLongA
DestroyAcceleratorTable
SetParent
GetClassNameA
DrawIconEx
SendMessageA

gdi32

SetBkMode
SetBkColor
SaveDC
CopyMetaFileA
RestoreDC
SetPolyFillMode
GetTextFaceA
SetPixelV
EnumFontFamiliesExA
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
GetSystemPaletteEntries
GetNearestPaletteIndex
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
RoundRect
SetPaletteEntries
GetPaletteEntries
CreatePalette
ExtFloodFill
Rectangle
Polygon
Ellipse
Polyline
CreatePolygonRgn
CreateEllipticRgn
SetPixel
StretchBlt
RealizePalette
SetDIBColorTable
OffsetRgn
GetTextCharsetInfo
EnumFontFamiliesA
CreateDIBitmap
CreateDIBSection
CreateCompatibleBitmap
CreateRoundRectRgn
DPtoLP
PatBlt
GetMapMode
CombineRgn
SetRectRgn
CreateFontIndirectA
GetTextMetricsA
GetTextExtentPoint32A
GetRgnBox
CreateRectRgnIndirect
GetTextColor
GetBkColor
GetDCOrgEx
CreateHatchBrush
CreateSolidBrush
CreatePen
GetObjectType
SelectPalette
GetStockObject
CreateCompatibleDC
CreateBitmap
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
GetObjectA
CreateRectRgn
SelectClipRgn
DeleteObject
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetROP2
GetDeviceCaps

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegEnumKeyExA
RegOpenKeyExA

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
DragFinish
DragQueryFileA
SHAppBarMessage
ShellExecuteA

comctl32

ImageList_GetIconSize
InitCommonControlsEx

shlwapi

PathFindExtensionA
PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
PathFindFileNameA
PathFileExistsA

oledlg

ord8

ole32

OleUninitialize
CoRevokeClassObject
CoRegisterMessageFilter
OleGetClipboard
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
CoFreeUnusedLibraries
OleLockRunning
RegisterDragDrop
CoLockObjectExternal
CreateStreamOnHGlobal
OleDestroyMenuDescriptor
OleInitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoCreateInstance
CLSIDFromString
OleIsCurrentClipboard
CLSIDFromProgID
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
RevokeDragDrop
OleFlushClipboard
DoDragDrop
CoUninitialize
CoInitializeEx

oleaut32

VariantCopy
VariantInit
SysStringLen
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString
VariantChangeType
VariantClear
SysAllocStringLen
SysAllocStringByteLen
SysFreeString

gdiplus

GdipCloneImage
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdiplusShutdown
GdipGetImageGraphicsContext
GdipDrawImageI

wininet

HttpOpenRequestA
InternetConnectA
HttpSendRequestA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetOpenA
InternetGetLastResponseInfoA
InternetCloseHandle
HttpQueryInfoA
InternetQueryDataAvailable
InternetSetOptionExA

ws2_32

inet_addr

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundA

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 297KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 31KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

664f8d20620907707c926809602ee26f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

64:21:e8:8d:19:0b:38:94:bc:76:d9:9c:3b:b7:e9:f8Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

c5:62:31:00:17:fc:25:b3:b8:f8:88:4c:a1:11:0b:3f:98:e0:c8:adSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

wininet

ws2_32

oleacc

imm32

winmm

iphlpapi

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 297KB - Virtual size: 297KB

.data Size: 31KB - Virtual size: 64KB

.rsrc Size: 82KB - Virtual size: 81KB

.reloc Size: 156KB - Virtual size: 156KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

64:21:e8:8d:19:0b:38:94:bc:76:d9:9c:3b:b7:e9:f8
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

c5:62:31:00:17:fc:25:b3:b8:f8:88:4c:a1:11:0b:3f:98:e0:c8:ad
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 297KB - Virtual size: 297KB

.data
Size: 31KB - Virtual size: 64KB

.rsrc
Size: 82KB - Virtual size: 81KB

.reloc
Size: 156KB - Virtual size: 156KB