d4907b85a6ccb128ee4bfcb1cef4b710_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target
d4907b85a6ccb128ee4bfcb1cef4b710_NEIKI
Size 289KB
Sample240509-dat68shc25
SHA256 5e737f13bd75610db1e7acc2a2a0c5c09a9c67cea96b04e66c80dc23b58c6d7c
MD5 d4907b85a6ccb128ee4bfcb1cef4b710
SHA1 d126c04398f4ee75b9becbcc5d212bf4794dc738
SHA512 145a2e2465220f98f64fe5dc4281ec85e7fad63d02e8bcedbbcd7d969dd811c5487409814dda46df448155cea5c1d27fd062c4020ceca0556080691876d12944
SSDEEP 3072:UxtJ4JN17yFtOKrhzzQ4WCIzTyWgkWcqK02CtaXJpQRFN+vf1db/uLoY46HGST8g:UIE5rNPIzTyJkXql7uJCbohCXnLOg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4907b85a6ccb128ee4bfcb1cef4b710_NEIKI

File Explorer

d4907b85a6ccb128ee4bfcb1cef4b710_NEIKI

.exe 289KB

d4907b85a6ccb128ee4bfcb1cef4b710_NEIKI

IMPHASH e197ea177eda5ae1f15cdef5824d80ec
SHA256 5e737f13bd75610db1e7acc2a2a0c5c09a9c67cea96b04e66c80dc23b58c6d7c
MD5 d4907b85a6ccb128ee4bfcb1cef4b710
SHA1 d126c04398f4ee75b9becbcc5d212bf4794dc738
SHA512 145a2e2465220f98f64fe5dc4281ec85e7fad63d02e8bcedbbcd7d969dd811c5487409814dda46df448155cea5c1d27fd062c4020ceca0556080691876d12944
SSDEEP 3072:UxtJ4JN17yFtOKrhzzQ4WCIzTyWgkWcqK02CtaXJpQRFN+vf1db/uLoY46HGST8g:UIE5rNPIzTyJkXql7uJCbohCXnLOg
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28972

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\AFDK\AFDK\x64\Release\AFDK.pdb

kernel32

GetProcAddress InitializeCriticalSectionEx RaiseException DecodePointer GetModuleHandleW MultiByteToWideChar SetEndOfFile WriteConsoleW HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetTimeZoneInformation SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW CreateFileW DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CreateProcessW ExitProcess GetProcessHeap LocalFree HeapAlloc HeapFree WriteFile ReadFile CopyFileW GetCurrentProcessId GetLastError GetModuleFileNameA GetCurrentProcess CreateThread CloseHandle GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW RtlUnwind GetCommandLineW GetCommandLineA GetStdHandle GetModuleHandleExW LoadLibraryExW FreeLibrary RtlPcToFileHeader RtlUnwindEx OutputDebugStringW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread InitializeCriticalSectionAndSpinCount SetLastError WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleFileNameW

user32

DispatchMessageA TranslateMessage UnhookWindowsHookEx SetWindowsHookExA GetKeyNameTextA CallNextHookEx GetMessageA GetKeyState

advapi32

RegCreateKeyExW RegCloseKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegOpenKeyExW RegSetValueExW

shell32

SHGetSpecialFolderPathW

oleaut32

VariantClear

crypt32

CryptBinaryToStringA CryptStringToBinaryA

Sharing

General

Malware Config

Signatures

File Explorer

d4907b85a6ccb128ee4bfcb1cef4b710_NEIKI

kernel32

user32

advapi32

shell32

oleaut32

crypt32

generic