ef8d91d9c37240bdefe6214afe4a5110_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ef8d91d9c37240bdefe6214afe4a5110_NEIKI
Size

904KB
MD5

ef8d91d9c37240bdefe6214afe4a5110
SHA1

1f3a1ffe8749f0e686a5fa0d409103fa3487d81b
SHA256

1a82d770a276d6c3654f30d37f289e385ae9d29bd130a5da0d3934fd3b1b2e92
SHA512

8e5d1d30ad1a08fda3ab72d5744df0d6f19d7efd26357ac3477ba5d359d53746ed5ed91f61d67c5503d4bbcdb00cc22a1cf714e9dccb6e352cde204a096d6a3a
SSDEEP

12288:QrCx2W2Q6Y2BVQ428W+vqWt0S9SiPYZZz1SHU1vOjYt/8DIhd0:Rx2WeBVl2b+vhOUpkpSHU1r/eIhd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef8d91d9c37240bdefe6214afe4a5110_NEIKI

Files

ef8d91d9c37240bdefe6214afe4a5110_NEIKI
.exe windows:5 windows x86 arch:x86

53e92335e74fd01f0d86758a87341ec2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteW

iphlpapi

GetAdaptersInfo

ws2_32

gethostbyaddr

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 64KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 3KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 585KB - Virtual size: 585KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

sfekeir
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE