cd0a1ce64e40403e73955178ef1f5490_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

cd0a1ce64e40403e73955178ef1f5490_NEIKI
Size

2.6MB
MD5

cd0a1ce64e40403e73955178ef1f5490
SHA1

acf846ccb8c81426731c1ffdb1e406a0f90c4d29
SHA256

adfb96ed20c88bedb20e06237aaa6baddab73e88879ee889a652ce2a227bfe81
SHA512

bf92805456a8c29119581ea2aa51f0e104ffbe84c452454dba64c117febb35d3827960f7ffc21a9f4f644c38969aa1a8d4587a044a87ef5ea0e1c3f12d4ffc61
SSDEEP

49152:04W+J/pHuR7n20mT4FE2LnYUxfApPDJTikFtNf+FpPDJTikFtNf+:nIxIpPx7fipPx7f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd0a1ce64e40403e73955178ef1f5490_NEIKI

Files

cd0a1ce64e40403e73955178ef1f5490_NEIKI
.exe windows:6 windows x64 arch:x64

662a62fd620166dd48a80e96ad92b33b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vssvc.pdb

Imports

advapi32

GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
AddAccessAllowedAce
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
ConvertSidToStringSidW
LookupAccountSidW
GetLengthSid
AllocateAndInitializeSid
FreeSid
RegEnumValueW
RegQueryInfoKeyW
RegDeleteValueW
EqualDomainSid
GetSidSubAuthorityCount
AccessCheck
IsValidSid
LookupAccountNameW
AddAccessAllowedAceEx
AddAccessDeniedAceEx
AddAce
GetAce
GetAclInformation
SetSecurityDescriptorGroup
CopySid
SetSecurityDescriptorOwner
EqualSid
ConvertStringSidToSidW
CreateWellKnownSid
AdjustTokenPrivileges
PrivilegeCheck
LookupPrivilegeValueW
CheckTokenMembership
DuplicateToken
ReportEventW
DeregisterEventSource
GetTokenInformation
OpenThreadToken
OpenProcessToken
RegisterEventSourceW

kernel32

InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
EncodePointer
GetTimeZoneInformation
GetDiskFreeSpaceW
SetErrorMode
GetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentThreadId
CloseHandle
GetComputerNameW
GetComputerNameExW
GetVolumeInformationW
DefineDosDeviceW
GetEnvironmentVariableW
GetSystemWindowsDirectoryW
FindClose
FindVolumeClose
FindNextFileW
FindFirstFileW
FindNextVolumeW
FindFirstVolumeW
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsW
CreateThread
SetLastError
GetVersionExW
MultiByteToWideChar
FormatMessageW
GetCurrentThread
LoadLibraryExW
FreeLibrary
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetVolumePathNamesForVolumeNameW
ReadFile
DeleteFileW
MoveFileExW
GetFileAttributesW
WriteFile
SetFileAttributesW
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
CreateEventW
OpenThread
CreateWaitableTimerW
SetEvent
SetWaitableTimer
CancelWaitableTimer
HeapSetInformation
GetCommandLineW
CompareStringW
LocalFree
LocalAlloc
CreateFileW
ResetEvent
DeviceIoControl
GetVolumeNameForVolumeMountPointW
GetDriveTypeW
QueryDosDeviceW
SetVolumeMountPointW
GetVolumePathNameW
GetSystemDirectoryW
lstrlenW
RaiseException
DeleteVolumeMountPointW
CreateDirectoryW
HeapAlloc
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
FlushFileBuffers
GetTickCount64
GetOverlappedResult
WaitForMultipleObjects
SetThreadPriority
ResumeThread

user32

LoadStringW
RegisterDeviceNotificationW
UnregisterDeviceNotification

msvcrt

wcsncmp
memcmp
memset
_snwscanf_s
_wcslwr
_wcsupr
wcsnlen
strncmp
_ultow_s
wcscpy_s
wcscat_s
swprintf_s
_purecall
_vsnwprintf
free
realloc
_wcsicmp
memmove
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UEAA@XZ
wcschr
_vscwprintf
memcpy
_beginthreadex
towupper
iswspace
wcsrchr
_errno
malloc
_wcsnicmp
qsort
wcsstr
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
wcstoul
iswdigit
_vsnprintf
?terminate@@YAXXZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
memmove_s
??0exception@@QEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
_CxxThrowException
_callnewh
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
__CxxFrameHandler3

atl

ord23
ord32
ord17
ord20
ord16
ord58
ord30

ole32

CoImpersonateClient
CoTaskMemRealloc
CoSetProxyBlanket
StringFromCLSID
CoGetObjectContext
CoFreeUnusedLibraries
CLSIDFromString
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoDisconnectContext
CoRevertToSelf

shlwapi

SHDeleteKeyW

oleaut32

SysAllocStringLen
LoadRegTypeLi
VariantClear
GetErrorInfo
SysFreeString
SysAllocString
VariantChangeType
SysStringLen
VariantInit
VariantCopy

rpcrt4

I_RpcBindingInqLocalClientPID
UuidToStringW
RpcStringFreeW

ntdll

NtClose
NtCreateSymbolicLinkObject
RtlInitUnicodeString
NtThawTransactions
NtFreezeTransactions
NtQuerySystemInformation
RtlNtStatusToDosErrorNoTeb
NtQueryVolumeInformationFile
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlNtStatusToDosError
NtThawRegistry
NtFreezeRegistry
NtAllocateUuids
NtResetEvent
LdrGetDllHandle
LdrGetProcedureAddress
RtlInitAnsiString
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlLengthSid
RtlAllocateAndInitializeSid
NtDeleteKey
NtAdjustPrivilegesToken
NtSetValueKey
NtQueryValueKey
NtSetSecurityObject
NtOpenProcessToken
RtlAddAccessAllowedAceEx
RtlLengthSecurityDescriptor
RtlFreeHeap
RtlAllocateHeap
NtOpenFile
RtlStringFromGUID
RtlFreeUnicodeString
RtlGUIDFromString
NtDeviceIoControlFile
NtWaitForSingleObject
NtCreateEvent
NtQueryKey
NtEnumerateKey
NtQueryAttributesFile
NtOpenKey
RtlCreateAcl
NtUnloadKey
RtlFreeSid
RtlSetDaclSecurityDescriptor
NtDeleteValueKey
NtLoadKey
NtOpenThreadToken
NtCreateKey
EtwTraceMessage

vssapi

?LoadVssSnapshotSetDescription@@YAJPEBGPEAPEAVIVssSnapshotSetDescription@@U_GUID@@@Z
CreateWriter
?CreateVssSnapshotSetDescription@@YAJU_GUID@@JPEAPEAVIVssSnapshotSetDescription@@@Z
CreateWriterEx
VssFreeSnapshotPropertiesInternal

netapi32

NetShareGetInfo
NetLocalGroupGetMembers
NetShareEnum
NetShareDel
NetApiBufferFree
NetShareAdd

clusapi

OpenCluster
OpenClusterResource
GetClusterResourceState
CloseClusterResource
ClusterResourceControl
CloseCluster
GetNodeClusterState

xolehlp

ord9
ord8

resutils

ResUtilGetResourceName
ResUtilEnumResourcesEx

setupapi

SetupDiCallClassInstaller
CM_Get_Parent
SetupDiGetDeviceInstallParamsW
SetupDiSetClassInstallParamsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW

vsstrace

ord7
ord4
ord6
ord3
ord5
ord8
ord1
ord2
ord11
ord10
ord9

authz

AuthzRegisterSecurityEventSource
AuthzUnregisterSecurityEventSource
AuthzReportSecurityEventFromParams

virtdisk

GetStorageDependencyInformation

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

662a62fd620166dd48a80e96ad92b33b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

atl

ole32

shlwapi

oleaut32

rpcrt4

ntdll

vssapi

netapi32

clusapi

xolehlp

resutils

setupapi

vsstrace

authz

virtdisk

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.data Size: 5KB - Virtual size: 8KB

.pdata Size: 40KB - Virtual size: 40KB

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 1.1MB - Virtual size: 1.1MB

.text
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 5KB - Virtual size: 8KB

.pdata
Size: 40KB - Virtual size: 40KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 1.1MB - Virtual size: 1.1MB