596c9be6c4b74acaa5168ee5a662f280_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

596c9be6c4b74acaa5168ee5a662f280_NEIKI
Size

148KB
MD5

596c9be6c4b74acaa5168ee5a662f280
SHA1

57445dbde0ccf3127f8c36ac78dbedddb48760c8
SHA256

767a0344f84469eb242915197ec621df5b17e41210e509f3a1ef10af2c3285d5
SHA512

1e65f19d4b06424c075792b78d4c17081825d7320dcd0af9ecac46ee637685c0d2c2add6bb8c5e6c9706ba567ff4263c8fee10c320c2b38df662d21725a18650
SSDEEP

3072:dFugOVIc1+I8X9ySrCunXB/52jQgSJpJePVSnRB:dFZOngIedrNnXBQERJpJBv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
596c9be6c4b74acaa5168ee5a662f280_NEIKI

Files

596c9be6c4b74acaa5168ee5a662f280_NEIKI
.exe windows:1 windows x86 arch:x86

04abc6c8fed72932301f16b8ca3d23a0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
RtlUnwind
DuplicateHandle
GetModuleHandleA
CloseHandle
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetLastError
CreateFileA
CreateEventA
WaitForSingleObject
SetLastError
lstrcpyA
lstrcmpA
lstrcatA
lstrcmpiA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter

crtdll

__GetMainArgs
exit
raise
signal

advapi32

RegOpenKeyExA
RegQueryValueExA

framedyn

?Left@CHString@@QBE?AV1@H@Z

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ