CertMgr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
496d9967969eae6edb3ec57d0dd90e30_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
496d9967969eae6edb3ec57d0dd90e30_NEIKI
-
Size
628KB
-
MD5
496d9967969eae6edb3ec57d0dd90e30
-
SHA1
207f818556d35b0bd08c151b4781bd1126fb9f14
-
SHA256
2df78e197842b90d4d55568d2cec1ab90590a79cca87047cc2fa48741f263cfa
-
SHA512
42911fda21dbb613b00688593faeeee50b500be260181aeef17e500817dedb3d94addebfa24e29c7d5bfd0f5b9c984ed1dde48e2ee762ef6bb88910cb8d65aa8
-
SSDEEP
12288:1SCAtSbwoqg0fitGbna8dQcLk/+cb1q86pJDlAF44bE2cSX:1SCAwbl0fitGbna8FLk2m1X2D4brr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 496d9967969eae6edb3ec57d0dd90e30_NEIKI
Files
-
496d9967969eae6edb3ec57d0dd90e30_NEIKI.exe windows:10 windows x86 arch:x86
0fc82c88fcc1cb6ab4e7ab78d4291cf0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
?terminate@@YAXXZ
_XcptFilter
_controlfp
_except_handler4_common
__wgetmainargs
wprintf
strtok
_vsnwprintf
realloc
printf
_wasctime
free
scanf
_wtol
towupper
memcpy
_amsg_exit
__set_app_type
_wcsicmp
vwprintf
malloc
__p__commode
memcmp
memset
user32
LoadStringW
LoadStringA
crypt32
CryptInstallOIDFunctionAddress
CertDuplicateCTLContext
CryptFreeOIDFunctionAddress
CertGetCertificateContextProperty
CertGetCRLContextProperty
CryptStringToBinaryW
CertGetCRLFromStore
CertAddEncodedCTLToStore
CertOpenStore
CertGetCTLContextProperty
CertFindCertificateInStore
CertSetCertificateContextProperty
CertEnumCTLsInStore
CertRDNValueToStrW
CryptEncodeObject
CryptMsgGetParam
CertCloseStore
CryptSIPLoad
CertDuplicateCertificateContext
CertEnumCertificateContextProperties
CertDeleteCRLFromStore
CertDeleteCertificateFromStore
CertDuplicateCRLContext
CryptHashPublicKeyInfo
CryptDecodeObject
CertFreeCTLContext
CertAddEncodedCertificateToStore
CertGetPublicKeyLength
CryptSIPRetrieveSubjectGuid
CryptMsgClose
CryptMsgUpdate
CryptGetOIDFunctionAddress
CryptInitOIDFunctionSet
CertRDNValueToStrA
CertFreeCRLContext
CertDeleteCTLFromStore
CertFreeCertificateContext
CryptStringToBinaryA
CryptFindOIDInfo
CertAddCRLContextToStore
CertAddCertificateContextToStore
CryptMsgGetAndVerifySigner
CryptMsgOpenToDecode
CertSaveStore
CertFindCTLInStore
CertEnumCertificatesInStore
CertAddEncodedCRLToStore
CertAddCTLContextToStore
cryptui
CryptUIDlgCertMgr
advapi32
CryptAcquireContextA
CryptReleaseContext
kernel32
GetFileSize
CreateFileMappingA
WriteFile
GetSystemTime
SystemTimeToFileTime
MultiByteToWideChar
CompareFileTime
WideCharToMultiByte
HeapSetInformation
CloseHandle
FileTimeToSystemTime
GetLastError
GetModuleHandleA
UnmapViewOfFile
SetLastError
TerminateProcess
MapViewOfFile
FileTimeToLocalFileTime
GetCurrentProcess
CreateFileW
UnhandledExceptionFilter
GetTickCount
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE