de2db94fe92fd7f8165167d835c15610_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

de2db94fe92fd7f8165167d835c15610_NEIKI
Size

208KB
MD5

de2db94fe92fd7f8165167d835c15610
SHA1

70438749217aa24dbdd0f414666edfe6edcf37fd
SHA256

f305258f01da64dec8cb91d697d46e3b916f09b67018a53675a87750ebf4d83b
SHA512

73cb9e860422c03d78a6a36596d9e3ad52462c1153271087f20a84e6eddb0387c7878c00a39e00cdc33df9adbf9f6b1d2d8605124aa38cf2072bd1acdbf1ad7b
SSDEEP

3072:VlYUaeN4hBoxT3O14cHydiFlqan0pMwmQIN3C9ISE0qJiNlUdp34UZN:Vl474CSgqXKQISzqJBpz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de2db94fe92fd7f8165167d835c15610_NEIKI

Files

de2db94fe92fd7f8165167d835c15610_NEIKI
.exe windows:5 windows x86 arch:x86

887216cd14dc07ac5c7539304e24449b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\PMS\pms4\Project(20130805)\_NewAgent_dll\bin\Release\HanAgent.pdb

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

user32

GetMessageW

gdi32

DeleteObject

advapi32

AdjustTokenPrivileges

shell32

ShellExecuteW

ws2_32

WSAStartup

Sections

.text
Size: 82KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE