ad7623d108f74cc40863cbb67d292da0_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

ad7623d108f74cc40863cbb67d292da0_NEIKI
Size

80KB
MD5

ad7623d108f74cc40863cbb67d292da0
SHA1

7e8adfc7a156afb6f57204c3820966ffa3cf1ba0
SHA256

04389dd8f6482cdec98e4907ac2fd2647f02fbee85c507e02d4239763effb6fd
SHA512

458a34e3c9cfae40a9d2c07de6860b444d1e6223a4a41fba048ec9ebde58c14f7b842502d580754898db1b8ff590b0d814da39de39b31ffb1b07c8de7ce742ed
SSDEEP

1536:WqomL0wSIc0G7PocATdTyISA2J+SWfghGTcmXrioQ+sT:WDmL0wF7G7Po7RTpE0SWfghGTcmXrOT

Score

1^/10

Malware Config

Signatures

Files

ad7623d108f74cc40863cbb67d292da0_NEIKI
.dll regsvr32 windows:4 windows x86 arch:x86

fe571d720b3a86013117884118b7ebd2

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ac:f8:f0:b5:f9:b4:9d:e1:88:b7:7b:5c:78:de:4b:54
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

16/12/2021, 00:00

Not After

27/01/2024, 23:59

Subject

CN=SAITO-KIKAKU CORPORATION,O=SAITO-KIKAKU CORPORATION,ST=Fukui,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

9d:47:08:02:bf:52:1e:30:e4:9c:d5:6b:67:de:6f:4e:18:a5:6f:f7
Signer

Actual PE Digest

9d:47:08:02:bf:52:1e:30:e4:9c:d5:6b:67:de:6f:4e:18:a5:6f:f7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapDestroy
GetLocaleInfoA
SetFilePointer
SetStdHandle
GetCurrentProcess
GetCurrentThreadId
MultiByteToWideChar
CloseHandle
LoadLibraryExA
FindResourceA
LoadResource
GetLastError
SizeofResource
lstrlenW
lstrcpynA
lstrcmpiA
FreeLibrary
IsDBCSLeadByte
lstrcatA
WideCharToMultiByte
lstrcpyA
lstrlenA
DisableThreadLibraryCalls
GetModuleFileNameA
LoadLibraryA
GetModuleHandleA
GetProcAddress
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLocaleInfoW
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
TerminateProcess
VirtualAlloc
VirtualFree
HeapCreate
ExitProcess
GetVersion
GetCommandLineA
HeapReAlloc
HeapAlloc
HeapFree

user32

wsprintfA
CharNextA

advapi32

RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoGetMalloc
StringFromIID
CoTaskMemFree

oleaut32

SetErrorInfo
LoadRegTypeLi
VarI4FromStr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe571d720b3a86013117884118b7ebd2

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

ac:f8:f0:b5:f9:b4:9d:e1:88:b7:7b:5c:78:de:4b:54Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

9d:47:08:02:bf:52:1e:30:e4:9c:d5:6b:67:de:6f:4e:18:a5:6f:f7Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 38KB - Virtual size: 38KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 15KB - Virtual size: 20KB

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 4KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

ac:f8:f0:b5:f9:b4:9d:e1:88:b7:7b:5c:78:de:4b:54
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

9d:47:08:02:bf:52:1e:30:e4:9c:d5:6b:67:de:6f:4e:18:a5:6f:f7
Signer

.text
Size: 38KB - Virtual size: 38KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 15KB - Virtual size: 20KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 4KB