Static task
static1
Behavioral task
behavioral1
Sample
2aeece38c112ce31b8deb244a8a7eaf0_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2aeece38c112ce31b8deb244a8a7eaf0_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
2aeece38c112ce31b8deb244a8a7eaf0_NEIKI
-
Size
133KB
-
MD5
2aeece38c112ce31b8deb244a8a7eaf0
-
SHA1
780f77066341a7592390dcea4e0b52d59ce98c3a
-
SHA256
b8171f0d6f5227c57446de718ac7fdaac3e38ff913a0ff5bbea49e4567cd2aea
-
SHA512
1509f26fc0e4017120fd652bc42185320fbc9b68ff6b2354b79d5b714dacfe69c72d7572cf173dfc567213665ac8adad8372a66b8e3295af86649f61799da82a
-
SSDEEP
3072:4ApYW1LDxZG3yhsDaLssAZiXRl6NPbU9fdETi3i+zUevX1x:9pBhAZiXRl6WlWOZUevXD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2aeece38c112ce31b8deb244a8a7eaf0_NEIKI
Files
-
2aeece38c112ce31b8deb244a8a7eaf0_NEIKI.exe windows:1 windows x86 arch:x86
524680b995bebe66b0934014c8549a64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CryptStringToBinaryA
shlwapi
PathAddExtensionW
PathFileExistsW
user32
FindWindowW
GetDC
GetParent
LoadCursorW
LoadIconW
MapDialogRect
RegisterClassW
ReleaseDC
wsprintfW
KillTimer
kernel32
CloseHandle
CreateFileW
CreateMutexA
CreateMutexW
DeleteFileW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
GetComputerNameW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileTime
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
LoadLibraryA
OpenProcess
QueryPerformanceCounter
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
WriteFile
lstrlenW
GetVersionExW
rpcrt4
UuidToStringW
advapi32
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
gdi32
BitBlt
CreateCompatibleBitmap
DeleteObject
SelectObject
CreateCompatibleDC
Sections
AUTO Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DGROUP Size: 117KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ