C:\php-sdk\php56\vc11\x86\obj\Release\php.pdb
Static task
static1
Behavioral task
behavioral1
Sample
51711070ae36a30bb59be16afcf82f90_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
51711070ae36a30bb59be16afcf82f90_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
51711070ae36a30bb59be16afcf82f90_NEIKI
-
Size
139KB
-
MD5
51711070ae36a30bb59be16afcf82f90
-
SHA1
d14d886b068f3d20feedaa532318afae2b0ce2f8
-
SHA256
bd7f45e4d5226953233e80b145b8b6cd17cb796baaaa4bccf330431351cc8754
-
SHA512
2ec7a345254a39abdcf650db9c72ed0fbd05dd763cfa3633d88667afd8b875c1cfe059d0f9d8e584e03f83b87f89b9ef76405f5fe063d21fc4c4f5aeac9b7e25
-
SSDEEP
3072:mR4rSeG1rqyIS35VTIK2lQBV+UdE+rECWp7hKmjEJ:KutS3PBV+UdvrEFp7hKFJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 51711070ae36a30bb59be16afcf82f90_NEIKI
Files
-
51711070ae36a30bb59be16afcf82f90_NEIKI.exe windows:6 windows x86 arch:x86
f2da57d75b3525a1ed548ca9a65d273c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
php5
vspprintf
zend_execute_scripts
_zend_hash_index_update_or_next_insert
zend_hash_del_key_or_index
php_set_sock_blocking
spprintf
zend_llist_apply_with_argument
OnUpdateBool
php_network_getaddresses
php_handle_auth_data
zend_llist_get_next_ex
zend_hash_get_current_key_ex
zend_ini_boolean_displayer_cb
php_select
_array_init
zend_hash_num_elements
zend_register_ini_entries
php_network_freeaddresses
php_register_variable_safe
php_url_decode
_estrdup
add_assoc_stringl_ex
add_assoc_string_ex
zend_hash_index_find
zend_hash_move_forward_ex
zend_llist_get_first_ex
zend_hash_internal_pointer_reset_ex
php_socket_strerror
php_escape_html_entities_ex
_erealloc
zend_hash_get_current_data_ex
php_network_populate_name_from_sockaddr
php_poll2
sapi_send_headers
ap_php_snprintf
zend_unregister_ini_entries
_safe_malloc
php_error_docref0
zend_parse_parameters
php_ini_scanned_files
zend_read_property
zend_printf
reflection_extension_ptr
zend_eval_string_ex
gc_remove_zval_from_buffer
zend_strndup
php_module_shutdown_wrapper
zend_register_constant
php_getopt
zend_ini_deactivate
_php_stream_free
sapi_shutdown
get_zend_version
php_output_write
php_module_shutdown
zend_is_auto_global
_zend_hash_add_or_update
zend_hash_copy
php_execute_script
_zval_ptr_dtor
php_handle_aborted_connection
_efree
zend_strip
display_ini_entries
php_get_highlight_struct
sapi_globals
php_ini_scanned_path
reflection_ptr
reflection_zend_extension_ptr
_emalloc
sapi_module
executor_globals
zend_hash_destroy
php_output_end_all
reflection_method_ptr
zend_exception_get_default
zend_llist_copy
zend_load_extension
compiler_globals
zend_hash_apply
php_register_variable
php_ini_opened_path
php_lint_script
reflection_function_ptr
module_registry
zend_call_method
zend_str_tolower_dup
php_printf
zend_error
tsrm_realpath
php_module_startup
_php_stream_open_wrapper_ex
zif_dl
core_globals
php_print_info
php_request_startup
zend_extensions
_zend_hash_init
php_import_environment_variables
sapi_startup
zend_highlight
zend_hash_find
php_info_print_module
_php_stream_get_line
_object_init_ex
open_file_for_scanning
zend_qsort
zend_hash_sort
_estrndup
zend_llist_destroy
php_request_shutdown
reflection_class_ptr
sapi_deactivate
zend_llist_sort
zend_hash_apply_with_arguments
zend_llist_apply
ws2_32
htons
ntohs
getsockname
setsockopt
recv
bind
socket
closesocket
send
listen
accept
WSAGetLastError
msvcr110
_stricmp
_setmode
_read
_close
_open
_setjmp3
memset
_strdup
_except_handler4_common
_controlfp_s
_invoke_watson
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__crtSetUnhandledExceptionFilter
?terminate@@YAXXZ
_commode
__initenv
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
sprintf
_getcwd
_stat32
_ctime32_s
toupper
bsearch
_chdir
strncpy
strtol
_ftime32
signal
strerror
strncmp
exit
fclose
getenv
fseek
realloc
ftell
strrchr
fwrite
_fmode
_fileno
fprintf
fopen
printf
isalnum
fgetc
_errno
fflush
strchr
__iob_func
strstr
rewind
malloc
free
memmove
memcpy
kernel32
GetSystemTimeAsFileTime
SetConsoleTitleA
GetLastError
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
QueryPerformanceCounter
GetCurrentProcessId
DecodePointer
GetConsoleTitleA
GetCurrentThreadId
Exports
Exports
php_cli_get_shell_callbacks
sapi_cli_single_write
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ