c8773aea70085abf9005dc9309886520_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c8773aea70085abf9005dc9309886520_NEIKI
Size

119KB
MD5

c8773aea70085abf9005dc9309886520
SHA1

1054e0c206045693b719866da00bc46b25f16bc1
SHA256

f4e1183d4e833067bb667c6bab684fc4d2e8eed98b7675ec92652abb6cf0b24e
SHA512

b5b50720a50409697a3a2ac23cb09b64c7c34bd31d2082dba1edd405c4693e8b3309f45646ebc21a0d88554e11f70166a08fb25cdaa044411308565f288c7ff1
SSDEEP

3072:JZVKm9RhBEnKuJs8qv3r78EPtNt8v5EgT56nLlGAziEXpgf:JZs8fsmPLSv5E4snUAGEXyf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8773aea70085abf9005dc9309886520_NEIKI

Files

c8773aea70085abf9005dc9309886520_NEIKI
.exe windows:4 windows x86 arch:x86

6bc7485f4c74b3913bdb6a0c796a1684

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WerGetFlagsWorker
TermsrvAppInstallMode
WerRegisterMemoryBlockWorker
WerGetFlags
GetNamedPipeServerProcessId
GetConsoleKeyboardLayoutNameA
BeginUpdateResourceA
timeEndPeriod
LZSeek
LocalShrink

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE