c978bfb6473e672f565be026b7d6e0e0_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c978bfb6473e672f565be026b7d6e0e0_NEIKI
Size

66KB
MD5

c978bfb6473e672f565be026b7d6e0e0
SHA1

23e0c207a4c4f083ccfaa39e962e06befa364a35
SHA256

9e8328be48ef6decb7057b02787d1deea493d08d1e640dfed4017fb4e814d8e3
SHA512

8f9c2707245fce0e0b28b83194dc4ac676a40d58996e01190111c1dd33672053ceac0371d4b152d58f4a6b5b19858d09ad54669a1bc3f1cb400643c7ef3c3a19
SSDEEP

1536:iVouPQy66sgG7V2zZoL6WUZxdyfb54THJwkU+qggAx/EFi0:iVdPB6xhL6WUX0upwR+qDA1EFi0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c978bfb6473e672f565be026b7d6e0e0_NEIKI

Files

c978bfb6473e672f565be026b7d6e0e0_NEIKI
.exe windows:4 windows x86 arch:x86

2479b5d8b21f005bb2e0b18dbd765906

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

K32InitializeProcessForWsWatch
GetNumaHighestNodeNumber
UnregisterApplicationRecoveryCallback
CreateProcessAsUserW
WerSetFlags
GetNamedPipeInfo
OpenFileMappingW
GetCurrentThreadStackLimits
RegQueryInfoKeyW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 51KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE