E:\TeamCity\BuildAgents\Agent_3\work\Fix-It.15.6.32.12\FileIO\FIOClient\Win32\Release\MXIOClnt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
73f1d0b0395bdfd4b2575f78cb351df0_NEIKI.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
73f1d0b0395bdfd4b2575f78cb351df0_NEIKI.dll
Resource
win10v2004-20240419-en
General
-
Target
73f1d0b0395bdfd4b2575f78cb351df0_NEIKI
-
Size
41KB
-
MD5
73f1d0b0395bdfd4b2575f78cb351df0
-
SHA1
7f712565b602e66793678e438749cfbc0a56d30d
-
SHA256
d5f426ab734ceacf34a29b6cbcf2505f6df2077cffc2ce4de1b9cd62610ecd12
-
SHA512
e0a73137a5a570c97e1384036830c5ca5e50bad4b586d63d0c4668cb8d4e24ec712ae7d7b613bb0839380fae7f00aa942a049a61770151df9aa0a514176edb89
-
SSDEEP
768:az2zT4AdzXSs7/HACGrNYDRJ5tU5xieOBBrdD2PYtzX4Sdwc:WaT4Ees7/HA/NYDVtU5xieOBWPKX4Sd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 73f1d0b0395bdfd4b2575f78cb351df0_NEIKI
Files
-
73f1d0b0395bdfd4b2575f78cb351df0_NEIKI.dll regsvr32 windows:5 windows x86 arch:x86
7c55e9426284829e42f74cf650fce053
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
kernel32
GetProcAddress
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
lstrlenA
MultiByteToWideChar
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetUserDefaultLangID
LeaveCriticalSection
EnterCriticalSection
GetTickCount
GetCurrentThreadId
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
WaitForSingleObject
lstrcpyA
lstrcatA
LoadLibraryA
VirtualQuery
GetModuleFileNameA
FreeLibrary
GetVersion
WideCharToMultiByte
GetACP
SetFileAttributesA
GetLogicalDriveStringsA
GetLogicalDrives
GetDriveTypeA
FindClose
FindNextFileA
GetLastError
GetSystemTimeAsFileTime
GetCurrentProcessId
FindFirstFileA
user32
CharNextA
IsCharAlphaNumericA
wsprintfA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
ole32
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysReAllocStringLen
atl100
ord32
ord15
ord61
ord23
ord64
aqcommon
?LoadStringA@AQ@@YAHPAUHINSTANCE__@@IPADH@Z
?FormatDateTimeA@AQ@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@ABU_FILETIME@@_N@Z
mxlinkdb
?Release@CMXUDatabase@@QAEKXZ
?AddRef@CMXUDatabase@@QAEKXZ
msvcr100
_malloc_crt
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
??3@YAXPAX@Z
_CxxThrowException
_purecall
malloc
free
_resetstkoflw
??2@YAPAXI@Z
__CxxFrameHandler3
_mbctolower
_mbctoupper
??_V@YAXPAX@Z
_itow_s
memcpy
_splitpath_s
strcpy_s
strcat_s
memset
_strdup
_mbsrchr
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
__clean_type_info_names_internal
Exports
Exports
??0CMxFileIOClient@@QAE@PAVCMXUDatabase@@@Z
??0CMxFileIOClient@@QAE@XZ
??1CMxFileIOClient@@QAE@XZ
??4CMxFileIOClient@@QAEAAV0@ABV0@@Z
?ApplyLog@CMxFileIOClient@@QAEKK_N@Z
?ApplyLog@CMxFileIOClient@@QAEK_N@Z
?CloseHandle@CMxFileIOClient@@QAEHPAX@Z
?CloseLog@CMxFileIOClient@@QAEKXZ
?CopyFileA@CMxFileIOClient@@QAEHPBD0H@Z
?CopyFolderOrFile@CMxFileIOClient@@QAEHPBD0H@Z
?CreateBackupLog@CMxFileIOClient@@QAEKPBD00@Z
?CreateDirectoryA@CMxFileIOClient@@QAEHPBD@Z
?CreateFileA@CMxFileIOClient@@QAEPAXPBDKKPAU_SECURITY_ATTRIBUTES@@KKPAX@Z
?CreateLogAction@CMxFileIOClient@@QAEKPBD0KPAK@Z
?CreateRecorderLog@CMxFileIOClient@@QAEKPBD00@Z
?CreateUndoLog@CMxFileIOClient@@QAEKPBD00@Z
?DeleteFileA@CMxFileIOClient@@QAEHPBD@Z
?DeleteUndoLog@CMxFileIOClient@@QAEKXZ
?EnumLog@CMxFileIOClient@@QAEKHPAD00PAK1111@Z
?EnumLog@CMxFileIOClient@@QAEKKHPAD00PAK1111@Z
?FindClose@CMxFileIOClient@@QAEHPAX@Z
?FindFirstFileA@CMxFileIOClient@@QAEPAXPBDPAU_WIN32_FIND_DATAA@@@Z
?FindNextFileA@CMxFileIOClient@@QAEHPAXPAU_WIN32_FIND_DATAA@@@Z
?GetCaseIndependentRE@CMxFileIOClient@@QAEHPBDPAD@Z
?GetDriveTypeA@CMxFileIOClient@@QAEIPBD@Z
?GetFileAttributesA@CMxFileIOClient@@QAEKPBD@Z
?GetFileDetails@CMxFileIOClient@@QAEHPAGPAPAG@Z
?GetFileVersionInfoA@CMxFileIOClient@@QAEHPADKKPAX@Z
?GetFileVersionInfoSizeA@CMxFileIOClient@@QAEKPADPAK@Z
?GetHandleInfo@CMxFileIOClient@@QAEKKPAD00PAK@Z
?GetHandleInfo@CMxFileIOClient@@QAEKKPAD0PAK@Z
?GetLastError@CMxFileIOClient@@QAEKXZ
?GetLogicalDriveStringsA@CMxFileIOClient@@QAEKKPAD@Z
?GetLogicalDrives@CMxFileIOClient@@QAEKXZ
?Init@CMxFileIOClient@@QAEKPAVCMXUDatabase@@@Z
?InitializeCallback@CMxFileIOClient@@QAEHP6GKPAU_tagClientNotify@@K@ZK@Z
?IsValid@CMxFileIOClient@@QAE_NXZ
?MoveFileA@CMxFileIOClient@@QAEHPBD0@Z
?OpenUndoLog@CMxFileIOClient@@QAEKPBD0@Z
?ReadFile@CMxFileIOClient@@QAEHPAX0KPAKPAU_OVERLAPPED@@@Z
?RemoveDirectoryA@CMxFileIOClient@@QAEHPBD@Z
?RemoveDirectoryEx@CMxFileIOClient@@QAEHPBD@Z
?ReplaceTag@CMxFileIOClient@@QAEKPAD0@Z
?SetFileAttributesA@CMxFileIOClient@@QAEHPBDK@Z
?SetFilePointer@CMxFileIOClient@@QAEKPAXJPAJK@Z
?SetLastError@CMxFileIOClient@@QAEXK@Z
?SetTag@CMxFileIOClient@@QAEKPAD0@Z
?UninitializeCallback@CMxFileIOClient@@QAEHXZ
?VerQueryValueA@CMxFileIOClient@@QAEHQAXPADPAPAXPAI@Z
?WriteFile@CMxFileIOClient@@QAEHPAXPBXKPAKPAU_OVERLAPPED@@@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ