Static task
static1
Behavioral task
behavioral1
Sample
b37c2bf1ede4ac77fe4951086c728440_NEIKI.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b37c2bf1ede4ac77fe4951086c728440_NEIKI.exe
Resource
win10v2004-20240508-en
General
-
Target
b37c2bf1ede4ac77fe4951086c728440_NEIKI
-
Size
80KB
-
MD5
b37c2bf1ede4ac77fe4951086c728440
-
SHA1
6bd1d43a6aefa0f78d5ab727c3cea58fea404754
-
SHA256
cf85d5ffb4876673dfe1536e28717fc52c7d34165b7faa6f0eda994019dcbc46
-
SHA512
d77dea5e9a72751c392836bd6fb810e53abdddcc8c65db5afb3cd84e3ac2f7b01c91ee5e34aed8390e4d58a697b2d2a2d7d3efda5cc3fdd4014e4f184deeb669
-
SSDEEP
768:kd4jJdi3Sdc2lLSmvJDnKZaKuzRL/DQsq+mI1Ac98iZ0F8rtAoeLAodcbVL2OmjV:kd41hWSJBBQIN0FUSqoybF2Hjkh6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b37c2bf1ede4ac77fe4951086c728440_NEIKI
Files
-
b37c2bf1ede4ac77fe4951086c728440_NEIKI.exe windows:4 windows x86 arch:x86
fbbecbd2d3a2049b3d6743399056a75b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryDosDeviceA
GetLastError
DefineDosDeviceA
Sleep
CreateFileA
CloseHandle
GetVersionExA
DeviceIoControl
SetLastError
GetOEMCP
VirtualAlloc
VirtualFree
FlushFileBuffers
SetStdHandle
LoadLibraryA
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
ExitProcess
GetCPInfo
GetACP
GlobalAddAtomA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
GetProcAddress
GetEnvironmentStringsW
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
WriteFile
SetFilePointer
GetStringTypeA
GetStringTypeW
user32
wsprintfA
MessageBoxA
wvsprintfA
LoadStringA
advapi32
RegEnumKeyExA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegDeleteKeyA
RegSetValueExA
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ