28357ec9d4088797ab3fd0c6199bc600_NEIKI | Triage

Sharing

General

Target

28357ec9d4088797ab3fd0c6199bc600_NEIKI
Size

119KB
MD5

28357ec9d4088797ab3fd0c6199bc600
SHA1

8cef6dedd93269d18da0b8df494db7df066045eb
SHA256

aa5fe7a03fb6e05a88d9d5d22e852d7bf23fb1819abec6d6c04e33d967aa8fa4
SHA512

8cef982bfd078b18ab86878248b39604ccc47a26db7ca0e89dc19ead2d2672590401aa5d408f2d86e1c944f7009f8d023c408efbc7c009d05935fac0ce0016c9
SSDEEP

3072:AfBJh6KemXlyMUyV/ZDx84fi1MzPZGv2YQKefix:Qh6W7V84GMzPhKefA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28357ec9d4088797ab3fd0c6199bc600_NEIKI

Files

28357ec9d4088797ab3fd0c6199bc600_NEIKI
.exe windows:4 windows x86 arch:x86

b6bb9dd8979d62e1a71ac6707b00b2f4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemWindowsDirectoryW
IsWow64Process2
IsValidNLSVersion
Heap32ListNext
AppPolicyGetMediaFoundationCodecLoading
SetSystemTime
BaseVerifyUnicodeString
QuirkIsEnabledForPackage2Worker
CreateHardLinkTransactedW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE