00b2bd7fed258eda24a236b2b3fca800_NEIKI | Triage

Sharing

Copy URL Twitter E-mail

General

Target

00b2bd7fed258eda24a236b2b3fca800_NEIKI
Size

71KB
MD5

00b2bd7fed258eda24a236b2b3fca800
SHA1

487f02f1db06257b5871012a3fce237e21c39715
SHA256

e748594eee41913efcb19ce57e61f3a4ba065c445faa31666c9c75b929ab0d38
SHA512

b1bb8d6bee6b8c2d182e646f2d667ca427adb2f86cbcbf638eb497395489cc3ed4774b5800d1bcf4cb8dc01d9c7afd5353cda21a353b707b91d41d1c098cacfc
SSDEEP

1536:1KqTpxSKWAUy9xGHVSYyzNZuO0mRc2DjQdguHXOyV8:rgaukc2D7Am

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00b2bd7fed258eda24a236b2b3fca800_NEIKI

Files

00b2bd7fed258eda24a236b2b3fca800_NEIKI
.exe windows:4 windows x86 arch:x86

e95e3c19c1b1846eddfe9b97188d572c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
CreateFileA
CreateMutexA
CreateProcessA
CreateProcessW
DeleteFileA
ExitProcess
GetCommandLineW
GetModuleFileNameA
GetProcessHeap
GetStartupInfoA
GetStartupInfoW
HeapAlloc
ReadFile
SetFileAttributesA
SetFilePointer
WriteFile

ntdll

NtFlushInstructionCache
NtOpenKey
NtProtectVirtualMemory

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 704B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE