cac14346c34beb19e8541b158a5e9180_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

cac14346c34beb19e8541b158a5e9180_NEIKI
Size

404KB
MD5

cac14346c34beb19e8541b158a5e9180
SHA1

fdce3949c4e43b042711eafe6b21e77ffbfe9cfd
SHA256

d53022f6640c5dd1da3112078b859c41dd5aa4a92faea50bfc63a6574f77cd91
SHA512

242ab99fe658b7ca228d76df333ce384ac2fff1f7efc95bf551ffafd27a552c2da8eeeac6d6a285af5120a80a137047c2e1e96d23b1df8c8d08b0a0a6e735980
SSDEEP

6144:9S0XYsnltNqDMcU8ZXuJG+/+p4TBfzzBSG6eW:EtsltEA18ZXCY4TxmeW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cac14346c34beb19e8541b158a5e9180_NEIKI

Files

cac14346c34beb19e8541b158a5e9180_NEIKI
.exe windows:5 windows x86 arch:x86

c5796bb7c566079e5a495fa2fe7e4f28

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
LookupAccountSidW
GetTokenInformation
AdjustTokenPrivileges
StartServiceW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfig2W
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
EnumServicesStatusW
DeleteService
ControlService
CloseServiceHandle
ChangeServiceConfigW

user32

MessageBoxA
CharNextW
LoadStringW
SetWindowLongW
GetWindowLongW
CreateWindowExW
mouse_event
keybd_event
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
SystemParametersInfoW
ShowWindow
SetWindowsHookExW
SetWindowTextW
SetTimer
SetThreadDesktop
SetCursorPos
ReleaseDC
RegisterClassW
PostMessageW
PeekMessageW
OpenInputDesktop
MsgWaitForMultipleObjects
MessageBoxW
LoadStringW
KillTimer
IsWindowVisible
IsWindow
GetWindowThreadProcessId
GetWindowTextW
GetSystemMetrics
GetMessageW
GetKeyState
GetIconInfo
GetForegroundWindow
GetDesktopWindow
GetDC
GetCursorPos
GetClassNameW
GetClassInfoW
GetAsyncKeyState
ExitWindowsEx
EnumWindows
EnableWindow
DispatchMessageW
DestroyWindow
DestroyIcon
DefWindowProcW
CloseDesktop
CharUpperW
CharLowerW
CallNextHookEx

kernel32

Sleep
VirtualFree
VirtualAlloc
lstrlenW
lstrcpynW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
SetCurrentDirectoryW
GetCurrentDirectoryW
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
GetModuleHandleW
FreeLibrary
lstrlenA
lstrlenW
lstrcpyW
lstrcmpiW
lstrcatW
WriteFile
WriteConsoleInputW
WideCharToMultiByte
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
UnmapViewOfFile
TerminateProcess
SleepEx
Sleep
SetThreadPriority
SetLastError
SetFileTime
SetFilePointer
SetFileAttributesW
SetEvent
SetEndOfFile
SetConsoleScreenBufferSize
SetConsoleCtrlHandler
SetConsoleActiveScreenBuffer
ResumeThread
ResetEvent
RemoveDirectoryW
ReadFile
ReadConsoleOutputCharacterA
ReadConsoleOutputAttribute
QueryDosDeviceW
PeekNamedPipe
OpenProcess
MoveFileExW
MoveFileW
MapViewOfFile
LocalFree
LocalFileTimeToFileTime
LoadLibraryW
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
GlobalMemoryStatus
GetVolumeInformationW
GetVersionExW
GetTickCount
GetThreadPriority
GetThreadLocale
GetStdHandle
GetLongPathNameW
GetProcessTimes
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLogicalDriveStringsW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeThread
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
GetConsoleScreenBufferInfo
GetConsoleOutputCP
GetComputerNameW
GetCPInfoExW
GetCPInfo
GetACP
GenerateConsoleCtrlEvent
InterlockedExchangeAdd
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FreeConsole
FormatMessageW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExpandEnvironmentStringsW
ExitProcess
EnumSystemLocalesW
EnumCalendarInfoW
EnterCriticalSection
DosDateTimeToFileTime
DeleteFileW
DeleteCriticalSection
CreateProcessW
CreatePipe
CreateFileMappingW
CreateFileW
CreateEventW
CreateDirectoryW
CreateConsoleScreenBuffer
CopyFileW
CompareStringW
CloseHandle
AllocConsole
Sleep
GetLogicalDriveStringsW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetConsoleWindow

gdi32

SelectPalette
SelectObject
RealizePalette
GetObjectW
GetDeviceCaps
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt

mpr

WNetCancelConnection2W

ole32

CoCreateGuid
IsEqualGUID

msvcrt

strchr
atoi
swprintf
memset
memcpy
free
realloc
malloc

ws2_32

WSAIoctl
WSACleanup
WSAStartup
gethostname
gethostbyname
socket
shutdown
setsockopt
sendto
send
select
recvfrom
recv
inet_ntoa
ioctlsocket
connect
closesocket

iphlpapi

GetNetworkParams

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathIsDirectoryW
StrToIntW

psapi

GetModuleFileNameExW

shell32

SHGetFileInfoW
ShellExecuteW

winmm

timeGetTime

Sections

.text
Size: 321KB - Virtual size: 321KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 20KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c5796bb7c566079e5a495fa2fe7e4f28

Headers

File Characteristics

Imports

oleaut32

advapi32

user32

kernel32

gdi32

mpr

ole32

msvcrt

ws2_32

iphlpapi

shlwapi

psapi

shell32

winmm

Sections

.text Size: 321KB - Virtual size: 321KB

.itext Size: 2KB - Virtual size: 1KB

.data Size: 22KB - Virtual size: 22KB

.bss Size: - Virtual size: 20KB

.idata Size: 9KB - Virtual size: 8KB

.didata Size: 512B - Virtual size: 384B

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 23KB - Virtual size: 23KB

.rsrc Size: 24KB - Virtual size: 24KB

.text
Size: 321KB - Virtual size: 321KB

.itext
Size: 2KB - Virtual size: 1KB

.data
Size: 22KB - Virtual size: 22KB

.bss
Size: - Virtual size: 20KB

.idata
Size: 9KB - Virtual size: 8KB

.didata
Size: 512B - Virtual size: 384B

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 23KB - Virtual size: 23KB

.rsrc
Size: 24KB - Virtual size: 24KB