eb5c50cf221037fede8d05c73d1f6890_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb5c50cf221037fede8d05c73d1f6890_NEIKI
Size

119KB
MD5

eb5c50cf221037fede8d05c73d1f6890
SHA1

f719db3a265e7b430ee7b9763718624e2f922de0
SHA256

743925c7fb0823a41b00835a4c1039247fb460b0cb8331f6e0f7defc07524e77
SHA512

d22e157950c9a60be603d92c299b05a334a5a25e41935f0009f41f621b9c4f141ce02dcff19ea550816272d651b03f24419c6bb6ead9261584d66e5c19323dfa
SSDEEP

3072:uKkuCFSbEpKwUlYRvwWGnfcyEFJCRHq4ideWu:ujVg9w9AfcV4MeWu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb5c50cf221037fede8d05c73d1f6890_NEIKI

Files

eb5c50cf221037fede8d05c73d1f6890_NEIKI
.exe windows:4 windows x86 arch:x86

6801b70b94c6ebabbbcdd14a5b6ed8d8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

_llseek
GlobalAlloc
ActivateActCtxWorker
GetFileAttributesExA
FileTimeToSystemTime
K32GetProcessImageFileNameA
LZOpenFileA
RegDeleteTreeA
DefineDosDeviceA
GetNumaNodeProcessorMaskEx
RegQueryValueExW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

rdata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 105KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE