a8017f418a65d24b6ad1ae78fcbb5ed0_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

a8017f418a65d24b6ad1ae78fcbb5ed0_NEIKI
Size

5.4MB
MD5

a8017f418a65d24b6ad1ae78fcbb5ed0
SHA1

f95c9b0f44fab5e9ebf086fdd3327d0120fd193c
SHA256

180a71a7f9ff3bc94c5e5a8aaf1180e9670c0a2c5d7a81dcd9f461559b40c382
SHA512

1d7d8669b2a282f915f06be320a607fd32b02b7c5441cc6139ab718e564a97683f6f6a9eda8383a8f1b185e123f01b51bebbaab90c8df2385d6f3ce026b912a0
SSDEEP

98304:UtLK3BDhtvS0Hpe4zLpaAKQkroGIeQHj3D:lBnvjeQpaAvkt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8017f418a65d24b6ad1ae78fcbb5ed0_NEIKI

Files

a8017f418a65d24b6ad1ae78fcbb5ed0_NEIKI
.exe windows:6 windows x64 arch:x64

fab403a881d1d6b1eefa16116bfb261c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

osppsvc.pdb

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
ConvertStringSidToSidW
RegSetKeySecurity
RegCreateKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyW
RegSetValueExW
RegDeleteKeyW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptGenRandom
CryptAcquireContextW
CryptReleaseContext
CryptGenKey
CryptExportKey
CryptVerifySignatureA
CryptSignHashA
CryptImportKey
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegEnumKeyExW
GetTokenInformation
EqualSid
OpenProcessToken
ConvertSidToStringSidW
LookupAccountNameW
RegOpenKeyW
RegCreateKeyW

kernel32

RegisterWaitForSingleObject
CreateTimerQueue
CreateTimerQueueTimer
GetModuleHandleExW
UnregisterWaitEx
DeleteTimerQueue
DecodePointer
DeleteTimerQueueEx
EncodePointer
FileTimeToSystemTime
CreateMutexW
OpenMutexW
ReleaseMutex
GetTickCount
CreateSemaphoreW
ExpandEnvironmentStringsW
MultiByteToWideChar
CreateFileW
GetFileSize
ReadFile
QueueUserWorkItem
GetCurrentProcessId
OpenProcess
WriteFile
GetFileAttributesW
SetFileAttributesW
ChangeTimerQueueTimer
CreateDirectoryW
GetFileSizeEx
GetSystemInfo
SystemTimeToFileTime
CompareFileTime
GetSystemTimeAsFileTime
CreateEventW
GetModuleHandleA
lstrcmpiW
GetPrivateProfileStringW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetSystemDirectoryW
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
RaiseException
InitializeCriticalSectionAndSpinCount
GetProcAddress
LoadLibraryW
FreeLibrary
Sleep
GetVersionExW
WaitForSingleObject
SetEvent
InitializeCriticalSection
GetVersion
VirtualProtect
VirtualAlloc
SetLastError
VirtualFree
GetLocalTime
DeleteFileW
FlushFileBuffers
CopyFileW
MoveFileExW
SetFilePointer
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetVersionExA
WideCharToMultiByte
GetSystemTime
GetComputerNameW
DeviceIoControl
ReleaseSemaphore
HeapSetInformation
LeaveCriticalSection
EnterCriticalSection
DeleteTimerQueueTimer
GetCurrentThreadId
LocalFree
DeleteCriticalSection
SetThreadPriority
GetThreadPriority
GetCurrentProcess
DuplicateHandle
GetCurrentThread
GetLastError
OpenThread
CloseHandle
LocalAlloc
GetProcessHeap
HeapFree
HeapAlloc
lstrlenW
LCMapStringW

msvcrt

_vscwprintf
__setusermatherr
time
srand
rand
_itow
_ui64tow
memcmp
_wtoi
free
malloc
memset
memcpy
_wtof
_vsnwprintf
memmove
swscanf
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
_amsg_exit
_initterm
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
wcsncmp
_wcsnicmp
_purecall
sscanf
wcschr
_wcsicmp

rpcrt4

UuidToStringW
RpcStringFreeW
UuidFromStringW
UuidCreate
RpcRevertToSelfEx
RpcImpersonateClient
RpcRaiseException
RpcMgmtStopServerListening
RpcServerUnregisterIf
I_RpcMapWin32Status
I_RpcBindingInqLocalClientPID
RpcServerInqCallAttributesW
RpcServerListen
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
NdrServerCallAll
NdrServerCall2

ntdll

NtQueryObject
RtlInitUnicodeString
RtlEqualUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlInstallFunctionTableCallback
RtlDeleteFunctionTable
RtlFreeHeap
RtlAllocateHeap

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 460KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 584KB - Virtual size: 588KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fab403a881d1d6b1eefa16116bfb261c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

rpcrt4

ntdll

ole32

Sections

.text Size: 4.3MB - Virtual size: 4.3MB

.data Size: 460KB - Virtual size: 460KB

.pdata Size: 73KB - Virtual size: 73KB

.rsrc Size: 26KB - Virtual size: 26KB

.reloc Size: 584KB - Virtual size: 588KB

.text
Size: 4.3MB - Virtual size: 4.3MB

.data
Size: 460KB - Virtual size: 460KB

.pdata
Size: 73KB - Virtual size: 73KB

.rsrc
Size: 26KB - Virtual size: 26KB

.reloc
Size: 584KB - Virtual size: 588KB