00d138e4876c8d157d10c1c1f482acb0_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

00d138e4876c8d157d10c1c1f482acb0_NEIKI
Size

63KB
MD5

00d138e4876c8d157d10c1c1f482acb0
SHA1

d2fbf217dced4579ac65cce3535a763c15f6fe09
SHA256

1cf4007a2e8915dac5665a448321788a674282bbb464792dc37edcc1e50ae207
SHA512

fbe7627c537eb54b62bc56d7cde376f9bf750e5a2a314c2101a5683a94f5532f7c6586639755fa1285b6f2e25b0c5c81de918e7e7bece21c098c233307266033
SSDEEP

768:i0ZfvRNCiZs7XE4e1qzha2kYpUy+lisqAD:lCzcQzh6Ypz+li

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00d138e4876c8d157d10c1c1f482acb0_NEIKI

Files

00d138e4876c8d157d10c1c1f482acb0_NEIKI
.exe windows:6 windows x86 arch:x86

6c75ba146776d2017d224a09b2c70d28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\CPPSolution\WinSys\Debug\AccessMAC.pdb

Imports

kernel32

GetProcessHeap
LocalFree
FormatMessageW
GetModuleFileNameW
FreeLibrary
HeapFree
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
WideCharToMultiByte
MultiByteToWideChar
VirtualQuery
HeapAlloc
LoadLibraryExW
GetProcAddress
GetLastError
RaiseException
IsDebuggerPresent
DecodePointer
EncodePointer
GetModuleHandleW

msvcp120d

?_Debug_message@std@@YAXPB_W0I@Z
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
??0_Container_base12@std@@QAE@XZ

iphlpapi

GetAdaptersAddresses

msvcr120d

??1type_info@@UAE@XZ
_XcptFilter
_amsg_exit
__wgetmainargs
exit
_CrtSetCheckCount
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__winitenv
_fmode
_commode
_CRT_RTC_INITW
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
wcscpy_s
_wmakepath_s
_wsplitpath_s
strlen
memcpy
memmove
printf
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
_onexit
__dllonexit
_calloc_dbg
_CrtDbgReportW
_unlock
_lock
__CxxFrameHandler3
_CxxThrowException
_except_handler4_common
_hypot
__set_app_type

Sections

.textbss
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c75ba146776d2017d224a09b2c70d28

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp120d

iphlpapi

msvcr120d

Sections

.textbss Size: - Virtual size: 64KB

.text Size: 43KB - Virtual size: 42KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 1024B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.textbss
Size: - Virtual size: 64KB

.text
Size: 43KB - Virtual size: 42KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 1024B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB