InstallAvCrypt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dacdc4204974035b495698e1e6de02e0_NEIKI.exe
Resource
win7-20240221-en
General
-
Target
dacdc4204974035b495698e1e6de02e0_NEIKI
-
Size
5.9MB
-
MD5
dacdc4204974035b495698e1e6de02e0
-
SHA1
ee3f46e8f9e7539cbee614faaf15af6ec3180f07
-
SHA256
6badfc713ecea281aecb89bdcddafea95465e94098557bc679cdb85a70d67555
-
SHA512
cb967f8049017233e24cd5397454593d256c716534fb820cc9e9e9be581807af5993c15711dc91cf611a0cf4759e5c7b07a4e29daf2e67d433ce6e480bcc46e9
-
SSDEEP
98304:t/TX7JvnzWR4DNnbx5SoesNLWE4iMgFWEWqFGIBGKKDO9uAqB/Ob1R/CHpS2q:tr5niaDVbx5p1Rqi+FqkkrUAqw
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dacdc4204974035b495698e1e6de02e0_NEIKI
Files
-
dacdc4204974035b495698e1e6de02e0_NEIKI.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ