Static task
static1
Behavioral task
behavioral1
Sample
052e972cc814888f6ecaf51693b7aca0_NEIKI.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
052e972cc814888f6ecaf51693b7aca0_NEIKI.dll
Resource
win10v2004-20240419-en
General
-
Target
052e972cc814888f6ecaf51693b7aca0_NEIKI
-
Size
8.4MB
-
MD5
052e972cc814888f6ecaf51693b7aca0
-
SHA1
7be05009509ee1723fdef6ddb21bb3cbcc0d5fb1
-
SHA256
f70033a237d270cde7338a6055314d30c2d723a2b7625bbb69fb23f26154fa29
-
SHA512
020ebb50e88cdea797b39d68f0801397ac333f2ef4650bf728e6e17a98970589141f946f7bcdf2d2b29ff35e87b272b6d82f954bc2a9fbc1628c6cab4d0d7ef5
-
SSDEEP
49152:ez8yiOdu+rUc2wn6Bk0PizcYyp8FvDQrVg6mpKrsq9BWQzT/gUKHz9QJ848+VFPz:e5iOdu+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 052e972cc814888f6ecaf51693b7aca0_NEIKI
Files
-
052e972cc814888f6ecaf51693b7aca0_NEIKI.dll windows:6 windows x86 arch:x86
33634ee3f9620b9c2588eba159f04381
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
MultiByteToWideChar
Sleep
GetTempPathA
GetLastError
DeleteFileA
Process32Next
CloseHandle
GetProcAddress
VerSetConditionMask
GetCurrentProcessId
lstrcmpiA
CreateToolhelp32Snapshot
AcquireSRWLockExclusive
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
GetModuleHandleA
TerminateProcess
GetCurrentProcess
VirtualProtect
VerifyVersionInfoW
Process32First
WakeAllConditionVariable
ReleaseSRWLockExclusive
user32
SystemParametersInfoA
GetWindowThreadProcessId
EnumWindows
SetForegroundWindow
UnloadKeyboardLayout
GetParent
advapi32
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCloseKey
shell32
SHGetSpecialFolderPathA
shlwapi
PathFileExistsA
msvcp140
??Bid@locale@std@@QAEIXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
vcruntime140
memcpy
__std_type_info_destroy_list
memset
_CxxThrowException
__current_exception_context
__current_exception
_except_handler4_common
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
__std_terminate
memmove
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
fwrite
_fseeki64
__stdio_common_vsscanf
fread
fgetc
fsetpos
ungetc
fclose
fflush
setvbuf
fputc
fgetpos
api-ms-win-crt-convert-l1-1-0
strtol
strtoul
api-ms-win-crt-runtime-l1-1-0
_beginthread
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate
_errno
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_unlock_file
_lock_file
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
Sections
.text Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ