C:\b\build\slave\Win\build\src\build\Release\chrome.exe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
99d7a7ed008228e3421fa3cb16fefde0_NEIKI.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
99d7a7ed008228e3421fa3cb16fefde0_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
99d7a7ed008228e3421fa3cb16fefde0_NEIKI
-
Size
749KB
-
MD5
99d7a7ed008228e3421fa3cb16fefde0
-
SHA1
c4cd79ca1739c768fc7636ca9996f975bb0a88f1
-
SHA256
649e0126c2afb7fea102eaae47631ae994ed44b354e332aa3184fabb17bd4144
-
SHA512
3b1083597eb8a66bc487a4dcb429b163775f78575f06138db5da90ec93726e6cd7eca9afce56ac6964feadaaca2ea6989b3880d26a8d2a471a7591626d2057e8
-
SSDEEP
12288:aHQ7uPzmnTW0c6TDHKDIvKlwRhR0+qs7100jimkolYiUZ4EyGtddyLqHVvSTuNZJ:uVii0RqLsPRlYiUZxyIH1KTuNZFSGfTH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99d7a7ed008228e3421fa3cb16fefde0_NEIKI
Files
-
99d7a7ed008228e3421fa3cb16fefde0_NEIKI.exe windows:5 windows x86 arch:x86
df04239642ddf7d530316ce60a9c4507
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathRemoveFileSpecW
kernel32
GetExitCodeProcess
WaitForSingleObject
DuplicateHandle
GetCurrentProcess
InterlockedCompareExchange
SizeofResource
LockResource
LoadResource
FindResourceW
VirtualFree
SetFilePointer
ReadFile
GetSystemInfo
FreeLibrary
VirtualAlloc
CreateFileW
SetEnvironmentVariableW
GetEnvironmentVariableW
CreateEventW
ExpandEnvironmentStringsW
ReleaseMutex
GetLastError
SetLastError
CreateProcessW
CreateMutexW
WriteFile
OutputDebugStringA
FormatMessageA
GetModuleHandleA
LocalFree
GetUserDefaultLangID
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcessTimes
GetFileAttributesW
CreateDirectoryW
GetTempPathW
GetLongPathNameW
GetCurrentDirectoryW
QueryDosDeviceW
MapViewOfFile
CreateFileMappingW
GetNativeSystemInfo
GetVersionExW
GetCurrentThreadId
SetInformationJobObject
ResumeThread
AssignProcessToJobObject
GetStdHandle
SetHandleInformation
LocalAlloc
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDirectoryW
GetWindowsDirectoryW
lstrlenW
IsDebuggerPresent
Sleep
CreateThread
OpenProcess
GetProcessId
InterlockedExchange
HeapSetInformation
SetEndOfFile
FlushFileBuffers
TerminateProcess
GetModuleHandleExW
SetUnhandledExceptionFilter
UnregisterWaitEx
RegisterWaitForSingleObject
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
InterlockedIncrement
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ResetEvent
SetEvent
WaitForMultipleObjects
CreateRemoteThread
VirtualFreeEx
VirtualAllocEx
VirtualProtect
FormatMessageW
VirtualQueryEx
WriteProcessMemory
VirtualProtectEx
TerminateJobObject
InitializeCriticalSection
SignalObjectAndWait
GetProcessHandleCount
GetThreadContext
GetFileType
InterlockedDecrement
CreateJobObjectW
CreateNamedPipeW
ProcessIdToSessionId
SearchPathW
DebugBreak
ReadProcessMemory
SuspendThread
GetComputerNameExW
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
EncodePointer
DecodePointer
UnhandledExceptionFilter
HeapFree
ExitProcess
GetStartupInfoW
GetConsoleCP
GetConsoleMode
GetFullPathNameW
HeapAlloc
GetProcessHeap
HeapReAlloc
SetStdHandle
RtlUnwind
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapSize
GetTimeZoneInformation
WriteConsoleW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetDriveTypeW
CompareStringW
GetModuleHandleW
CloseHandle
LoadLibraryA
ReleaseSemaphore
RtlCaptureContext
CreateSemaphoreW
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
SetCurrentDirectoryW
LoadLibraryExW
GetModuleFileNameW
GetEnvironmentVariableA
GetCommandLineW
SetEnvironmentVariableA
LoadLibraryW
GetProcAddress
GetTickCount
GetCurrentProcessId
InterlockedExchangeAdd
RaiseException
CreateIoCompletionPort
advapi32
CreateRestrictedToken
SetThreadToken
RegDisablePredefinedCache
OpenProcessToken
GetTokenInformation
CreateProcessAsUserW
RegSetValueExA
ConvertSidToStringSidW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
GetUserNameW
SetEntriesInAclW
GetSecurityInfo
CreateWellKnownSid
CopySid
LookupPrivilegeValueW
EqualSid
DuplicateToken
DuplicateTokenEx
ConvertStringSidToSidW
GetLengthSid
RegQueryValueExW
RegSetValueExW
SetTokenInformation
RevertToSelf
user32
GetAsyncKeyState
GetUserObjectInformationW
GetThreadDesktop
IsWindow
SendMessageTimeoutW
AllowSetForegroundWindow
GetWindowThreadProcessId
CharUpperW
MessageBoxW
FindWindowExW
wsprintfW
CloseWindowStation
CloseDesktop
CreateWindowStationW
GetProcessWindowStation
CreateDesktopW
SetProcessWindowStation
chrome_elf
InitChromeElf
userenv
GetProfileType
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
Exports
Exports
ClearCrashKeyValueImpl
CrashForException
DumpProcess
DumpProcessWithoutCrash
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
SetCrashKeyValueImpl
Sections
.text Size: 446KB - Virtual size: 446KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ