E:\TemporaryBuilds\azure_inpixio_build2_de_build03\2\s\msi\_bin\x64\Release\custom-action.pdb
Static task
static1
Behavioral task
behavioral1
Sample
adfcfcca923a175efd892bf2ee74f1a0_NEIKI.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
adfcfcca923a175efd892bf2ee74f1a0_NEIKI.dll
Resource
win10v2004-20240419-en
General
-
Target
adfcfcca923a175efd892bf2ee74f1a0_NEIKI
-
Size
986KB
-
MD5
adfcfcca923a175efd892bf2ee74f1a0
-
SHA1
f0b6b554f6eefa2fefe5e05df99f5918731525fa
-
SHA256
5063d55bc89ad0e7299b60a4225f3c072a3ae326bcdfee37f56193d92ad4fa10
-
SHA512
4101543582565d907a43c1ab51cefca037f2e04fbdc18778c6f821a7e7c727585abd950658178a80498000ebcf997ee87187146781077ded1cad908dfad98da8
-
SSDEEP
12288:dJfr8SmOJetwLy3nT8JhCOzX+plQCVuLYGJNV5uOqTDe4OlJSxioSb76:/wSmObLiuuplQSGJNVkvDe4OlJSxi7y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource adfcfcca923a175efd892bf2ee74f1a0_NEIKI
Files
-
adfcfcca923a175efd892bf2ee74f1a0_NEIKI.dll windows:6 windows x64 arch:x64
3e21f14ea4982491bdcec0ee6809dae9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GetTickCount
GlobalFree
GlobalAlloc
GlobalFindAtomW
GlobalAddAtomW
lstrlenW
GlobalDeleteAtom
SetLastError
GetModuleFileNameW
SetEvent
Sleep
CreateEventA
WideCharToMultiByte
GetLastError
LocalFree
FormatMessageA
CloseHandle
LeaveCriticalSection
EnterCriticalSection
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
QueryPerformanceCounter
HeapAlloc
HeapFree
GetProcessHeap
ResetEvent
WaitForSingleObjectEx
OpenEventA
SetWaitableTimer
GetCurrentProcessId
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
CreateFileW
ReadFile
WriteFile
RaiseException
ConnectNamedPipe
PeekNamedPipe
CreateNamedPipeW
WaitNamedPipeW
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetOverlappedResult
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
SleepEx
CreateEventW
WaitForMultipleObjects
CreateWaitableTimerW
QueueUserAPC
GetCurrentProcess
GetCurrentThread
TerminateThread
GetSystemTime
GetSystemTimeAsFileTime
GetVersionExW
FreeLibrary
LoadLibraryW
MultiByteToWideChar
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileType
ExitProcess
GetStdHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
advapi32
OpenThreadToken
OpenProcessToken
GetTokenInformation
RevertToSelf
LookupAccountSidW
GetUserNameW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
ImpersonateNamedPipeClient
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
ControlService
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
SetThreadToken
ws2_32
WSAGetLastError
WSACleanup
WSAStartup
crypt32
CertFreeCertificateContext
msi
ord124
ord73
ord74
ord103
ord8
ord17
ord49
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
bcrypt
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom
Exports
Exports
StopInpixioService
Sections
.text Size: 709KB - Virtual size: 709KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 213KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ