ebc07e349674858c4cbb48e5187580d0_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ebc07e349674858c4cbb48e5187580d0_NEIKI
Size

234KB
MD5

ebc07e349674858c4cbb48e5187580d0
SHA1

970f7a848ef05c4bdfaabd8ce10cd89353d0e474
SHA256

4030ca325bb9c003f681bc0456b650423106f47d639ace16c06e0f33fe86adf7
SHA512

0c0516dd4d8c62b3a92910cf5db2c9a93f10643ba32ee03e318a95bf2b4203ca81613207514396f2897d935a9e3461d3bb09f57633a702d45b01ef45d2032c89
SSDEEP

6144:4RUPfy7/ZKbGInMrQAkvGXsuU3HtrOx5gABN:4RcfyrOGLQx+XJU96EsN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebc07e349674858c4cbb48e5187580d0_NEIKI

Files

ebc07e349674858c4cbb48e5187580d0_NEIKI
.exe windows:5 windows x86 arch:x86

3c6e5793e514214727b5614fbe758755

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
CreateFileW
GetFileSize
ReadFile
CloseHandle
VirtualAlloc
GetModuleHandleA
GetProcAddress
VirtualFree
GetProcessHeap
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE