C:\.image_jenkins\workspace\CC-Windows-Release@2\WorkSpace\bin\JYPacket\2.9.1.990\CapCut.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2aa9a8d27d345a68adadb60dc384dad0_NEIKI.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2aa9a8d27d345a68adadb60dc384dad0_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
2aa9a8d27d345a68adadb60dc384dad0_NEIKI
-
Size
779KB
-
MD5
2aa9a8d27d345a68adadb60dc384dad0
-
SHA1
ba1648f503707bda65a1a557bf1af65b0212997a
-
SHA256
08a29690cf391064244d4983c315632191d53eed41553a3d505f5c754e14e525
-
SHA512
6f8c5647b780d9529c107c86987701f2134429a516eba74b6d288571231a7d5e1a03eef63aaf6517fdea5690d4765b748e61026c75c516d17c45d8e3386f04f7
-
SSDEEP
24576:gP3YwJfLwHzCwMsqjnhMgeiCl7G0nehbGZpbD:ZgfLwTCHDmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2aa9a8d27d345a68adadb60dc384dad0_NEIKI
Files
-
2aa9a8d27d345a68adadb60dc384dad0_NEIKI.exe windows:6 windows x64 arch:x64
991d92251a6bdbd7af9b37eacdc920d5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
vesafeguard
safe_guard_first_load
vecrashmonitor
?init@VECrashUpload@@SAXPEBD0_K00000000000@Z
veconfig
?getCrashPath@path@VEConfig@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getVEHelperPath@path@VEConfig@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getVECrashHandlerPath@path@VEConfig@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?ENV_CFG@pluginUpdate@VEConfig@@3QEBDEB
?VERSION@product@VEConfig@@3QEBDEB
?GRAYVER@product@VEConfig@@3QEBDEB
?BUILDNUMBER@product@VEConfig@@3_KB
?getDownloaderPath@path@VEConfig@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getConfigPath@path@VEConfig@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
qt6core
?qt_metacall@QSettings@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?qt_metacast@QSettings@@UEAAPEAXPEBD@Z
?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z
?qBadAlloc@@YAXXZ
?allocate@QArrayData@@SAPEAXPEAPEAU1@_J11W4AllocationOption@1@@Z
?reallocateUnaligned@QArrayData@@SA?AU?$pair@PEAUQArrayData@@PEAX@std@@PEAU1@PEAX_J2W4AllocationOption@1@@Z
?deallocate@QArrayData@@SAXPEAU1@_J1@Z
?compareStrings@QtPrivate@@YAHVQStringView@@0W4CaseSensitivity@Qt@@@Z
?data@QString@@QEBAPEBVQChar@@XZ
??0QString@@QEAA@AEBVQByteArray@@@Z
?isNull@QString@@QEBA_NXZ
??0QObject@@QEAA@PEAV0@@Z
??1QObject@@UEAA@XZ
??0QVariant@@QEAA@AEBV0@@Z
??0QVariant@@QEAA@H@Z
??0QVariant@@QEAA@I@Z
??0QVariant@@QEAA@_K@Z
??0QVariant@@QEAA@_N@Z
??0QVariant@@QEAA@PEBD@Z
??0QVariant@@QEAA@AEBVQByteArray@@@Z
??0QVariant@@QEAA@AEBVQString@@@Z
??0QVariant@@QEAA@AEBV?$QList@VQVariant@@@@@Z
??0QVariant@@QEAA@AEBV?$QMap@VQString@@VQVariant@@@@@Z
??0QVariant@@QEAA@$$QEAV0@@Z
??4QVariant@@QEAAAEAV0@$$QEAV0@@Z
??0QJsonDocument@@QEAA@AEBVQJsonObject@@@Z
??1QJsonDocument@@QEAA@XZ
?toJson@QJsonDocument@@QEBA?AVQByteArray@@W4JsonFormat@1@@Z
??1QJsonObject@@QEAA@XZ
?fromVariantMap@QJsonObject@@SA?AV1@AEBV?$QMap@VQString@@VQVariant@@@@@Z
?event@QObject@@UEAA_NPEAVQEvent@@@Z
??0QMessageLogger@@QEAA@PEBDH0@Z
?info@QMessageLogger@@QEBA?AVQDebug@@XZ
??0QChar@@QEAA@D@Z
??0QString@@QEAA@$$QEAV0@@Z
?arg@QString@@QEBA?AV1@HHHVQChar@@@Z
?QStringList_join@QtPrivate@@YA?AVQString@@PEBV?$QList@VQString@@@@PEBVQChar@@_J@Z
??1QDebug@@QEAA@XZ
??6QDebug@@QEAAAEAV0@H@Z
??6QDebug@@QEAAAEAV0@PEBD@Z
??6QDebug@@QEAAAEAV0@AEBVQString@@@Z
?exists@QFileInfo@@SA_NAEBVQString@@@Z
?execute@QProcess@@SAHAEBVQString@@AEBV?$QList@VQString@@@@@Z
??6QDebug@@QEAAAEAV0@_N@Z
?exists@QFile@@SA_NAEBVQString@@@Z
?remove@QFile@@SA_NAEBVQString@@@Z
??AQByteArray@@QEAAAEAD_J@Z
?toHex@QByteArray@@QEBA?AV1@D@Z
?size@QByteArray@@QEBA_JXZ
?right@QString@@QEBA?AV1@_J@Z
?startsWith@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@@Z
?startsWith@QString@@QEBA_NVQChar@@W4CaseSensitivity@Qt@@@Z
?endsWith@QString@@QEBA_NVQChar@@W4CaseSensitivity@Qt@@@Z
?append@QString@@QEAAAEAV1@VQChar@@@Z
??0QTextStream@@QEAA@PEAVQIODevice@@@Z
??1QTextStream@@UEAA@XZ
?setEncoding@QTextStream@@QEAAXW4Encoding@QStringConverter@@@Z
?readAll@QTextStream@@QEAA?AVQString@@XZ
??6QTextStream@@QEAAAEAV0@AEBVQString@@@Z
?toMap@QVariant@@QEBA?AV?$QMap@VQString@@VQVariant@@@@XZ
??0QJsonParseError@@QEAA@XZ
?metaObject@QSettings@@UEBAPEBUQMetaObject@@XZ
?toVariant@QJsonDocument@@QEBA?AVQVariant@@XZ
?fromJson@QJsonDocument@@SA?AV1@AEBVQByteArray@@PEAUQJsonParseError@@@Z
?object@QJsonDocument@@QEBA?AVQJsonObject@@XZ
?read@QIODevice@@QEAA_JPEAD_J@Z
?close@QFileDevice@@UEAAXXZ
??0QFile@@QEAA@AEBVQString@@@Z
??1QFile@@UEAA@XZ
?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODeviceBase@@@@@Z
?size@QFile@@UEBA_JXZ
?mkpath@QDir@@QEBA_NAEBVQString@@@Z
?removeRecursively@QDir@@QEAA_NXZ
??0QCryptographicHash@@QEAA@W4Algorithm@0@@Z
??1QCryptographicHash@@QEAA@XZ
?addData@QCryptographicHash@@QEAAXPEBD_J@Z
?result@QCryptographicHash@@QEBA?AVQByteArray@@XZ
?dynamicMetaObject@QObjectData@@QEBAPEAUQMetaObject@@XZ
?qt_metacast@QObject@@UEAAPEAXPEBD@Z
?qt_metacall@QObject@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?staticMetaObject@QObject@@2UQMetaObject@@B
?toUtf8@QString@@QEHAA?AVQByteArray@@XZ
??1QJsonValue@@QEAA@XZ
?type@QJsonValue@@QEBA?AW4Type@1@XZ
?toBool@QJsonValue@@QEBA_N_N@Z
?toInt@QJsonValue@@QEBAHH@Z
?toString@QJsonValue@@QEBA?AVQString@@XZ
?toArray@QJsonValue@@QEBA?AVQJsonArray@@XZ
?toObject@QJsonValue@@QEBA?AVQJsonObject@@XZ
?isString@QJsonValueRef@@QEBA_NXZ
?toString@QJsonValueRef@@QEBA?AVQString@@AEBV2@@Z
?value@QJsonObject@@QEBA?AVQJsonValue@@AEBVQString@@@Z
?constBegin@QJsonObject@@QEBA?AVconst_iterator@1@XZ
?constEnd@QJsonObject@@QEBA?AVconst_iterator@1@XZ
?keyAt@QJsonObject@@AEBA?AVQString@@_J@Z
??1QJsonArray@@QEAA@XZ
?size@QJsonArray@@QEBA_JXZ
?at@QJsonArray@@QEBA?AVQJsonValue@@_J@Z
??6@YAAEAVQDataStream@@AEAV0@AEBVQString@@@Z
??5@YAAEAVQDataStream@@AEAV0@AEAVQString@@@Z
?globalSeed@QHashSeed@@SA?AU1@XZ
?qHash@@YA_KVQStringView@@_K@Z
?status@QDataStream@@QEBA?AW4Status@1@XZ
?setStatus@QDataStream@@QEAAXW4Status@1@@Z
?resetStatus@QDataStream@@QEAAXXZ
??5QDataStream@@QEAAAEAV0@AEAH@Z
??6QDataStream@@QEAAAEAV0@H@Z
?isDeviceTransactionStarted@QDataStream@@QEBA_NXZ
??0QDebug@@QEAA@$$QEAV0@@Z
??6QDebug@@QEAAAEAV0@D@Z
??0QDebugStateSaver@@QEAA@AEAVQDebug@@@Z
??1QDebugStateSaver@@QEAA@XZ
??0QVariant@@QEAA@_J@Z
??4QVariant@@QEAAAEAV0@AEBV0@@Z
?canConvert@QVariant@@QEBA_NVQMetaType@@@Z
?toInt@QVariant@@QEBAHPEA_N@Z
?toLongLong@QVariant@@QEBA_JPEA_N@Z
?toList@QVariant@@QEBA?AV?$QList@VQVariant@@@@XZ
?qdebugHelper@QVariant@@AEBA?AVQDebug@@V2@@Z
?equals@QVariant@@IEBA_NAEBV1@@Z
??5@YAAEAVQDataStream@@AEAV0@AEAVQVariant@@@Z
??6@YAAEAVQDataStream@@AEAV0@AEBVQVariant@@@Z
??1QDateTime@@QEAA@XZ
?toSecsSinceEpoch@QDateTime@@QEBA_JXZ
??0QFileInfo@@QEAA@AEBV0@@Z
?absoluteFilePath@QFileInfo@@QEBA?AVQString@@XZ
?isFile@QFileInfo@@QEBA_NXZ
?isDir@QFileInfo@@QEBA_NXZ
?size@QFileInfo@@QEBA_JXZ
?fileTime@QFileInfo@@QEBA?AVQDateTime@@W4FileTime@QFileDevice@@@Z
?entryInfoList@QDir@@QEBA?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z
?arg@QString@@QEBA?AV1@_JHHVQChar@@@Z
?rename@QFile@@SA_NAEBVQString@@0@Z
?copy@QFile@@SA_NAEBVQString@@0@Z
?toMSecsSinceEpoch@QDateTime@@QEBA_JXZ
?currentDateTime@QDateTime@@SA?AV1@XZ
?absolutePath@QFileInfo@@QEBA?AVQString@@XZ
?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z
?event@QSettings@@MEAA_NPEAVQEvent@@@Z
?disconnectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?customEvent@QObject@@MEAAXPEAVQEvent@@@Z
?connectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z
?value@QSettings@@QEBA?AVQVariant@@AEBVQString@@AEBV2@@Z
??1QSettings@@UEAA@XZ
??0QSettings@@QEAA@AEBVQString@@W4Format@0@PEAVQObject@@@Z
?toString@QVariant@@QEBA?AVQString@@XZ
?toBool@QVariant@@QEBA_NXZ
?toULongLong@QVariant@@QEBA_KPEA_N@Z
?toUInt@QVariant@@QEBAIPEA_N@Z
??1QVariant@@QEAA@XZ
??0QVariant@@QEAA@XZ
?canonicalPath@QFileInfo@@QEBA?AVQString@@XZ
??1QFileInfo@@QEAA@XZ
??0QFileInfo@@QEAA@AEBVQString@@@Z
??4QString@@QEAAAEAV0@PEBD@Z
?toStdWString@QString@@QEBA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?compare@QString@@QEBAHAEBV1@W4CaseSensitivity@Qt@@@Z
?fromWCharArray@QString@@SA?AV1@PEB_W_J@Z
??4QString@@QEAAAEAV0@$$QEAV0@@Z
??0QString@@QEAA@XZ
?exists@QDir@@QEBA_NXZ
?mkdir@QDir@@QEBA_NAEBVQString@@@Z
??1QDir@@QEAA@XZ
??0QDir@@QEAA@AEBVQString@@@Z
?toStdString@QString@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?fromStdString@QString@@SA?AV1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0QString@@QEAA@PEBD@Z
?fromUtf8@QString@@SA?AV1@VQByteArrayView@@@Z
?toUtf8@QString@@QEGBA?AVQByteArray@@XZ
?append@QString@@QEAAAEAV1@AEBV1@@Z
?arg@QString@@QEBA?AV1@AEBV1@HVQChar@@@Z
?arg@QString@@QEBA?AV1@_KHHVQChar@@@Z
??4QString@@QEAAAEAV0@AEBV0@@Z
??1QString@@QEAA@XZ
??0QString@@QEAA@AEBV0@@Z
?data@QByteArray@@QEAAPEADXZ
??1QByteArray@@QEAA@XZ
?castHelper@QByteArrayView@@CAPEBDPEBD@Z
??0QChar@@QEAA@UQLatin1Char@@@Z
?fromVariant@QJsonDocument@@SA?AV1@AEBVQVariant@@@Z
libcurl
curl_easy_setopt
curl_slist_free_all
curl_easy_perform
curl_easy_cleanup
curl_global_init
curl_slist_append
curl_easy_init
kernel32
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetFileAttributesW
OutputDebugStringW
GetLastError
FreeLibrary
GetModuleFileNameW
GetProcAddress
CreateEventW
LoadLibraryW
SetEnvironmentVariableW
GetCurrentProcess
TerminateProcess
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_join
_Thrd_id
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_signal
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Thrd_sleep
_Mtx_init_in_situ
vcruntime140
__std_exception_destroy
_CxxThrowException
__std_exception_copy
memcpy
memmove
wcsrchr
memset
_purecall
__std_terminate
memcmp
__C_specific_handler
__current_exception
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
__p___wargv
_get_initial_wide_environment
__p___argc
_initialize_wide_environment
_initterm
_initterm_e
_exit
_invalid_parameter_noinfo_noreturn
exit
terminate
_beginthreadex
_seh_filter_exe
_set_app_type
_configure_wide_argv
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
wcscat_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Exports
Exports
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE