muirct.pdb
Static task
static1
Behavioral task
behavioral1
Sample
f4c072f4965d6e3a085162494fd8b4d0_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
f4c072f4965d6e3a085162494fd8b4d0_NEIKI
-
Size
720KB
-
MD5
f4c072f4965d6e3a085162494fd8b4d0
-
SHA1
179c42f61cfa045d327458804b7e22ca290eaa82
-
SHA256
f53b44290d24549bad2e3b7f914c5b4188dbdab461b9acde9f166c86e203688d
-
SHA512
b51a3d148cfd6d4863daca7a1e70945a6b07cd34a63ae6513f543d2559f7a2eee82468ac8cef68fc6964529cb2400ba4b63cd6b30ce5dbe253a61e207564b5c7
-
SSDEEP
12288:Y7hU1vpoJr3F4SOpFjn04R4gq4HSUQH4WT65RShG605414IQanx8/6:MU1irV49pFT0SLTQYWkK2u4dax8C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f4c072f4965d6e3a085162494fd8b4d0_NEIKI
Files
-
f4c072f4965d6e3a085162494fd8b4d0_NEIKI.exe windows:10 windows x64 arch:x64
3064221fc9208288e0016821c0f93774
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
IsTextUnicode
kernel32
CreateDirectoryW
SizeofResource
LocalAlloc
GetFileAttributesW
SetFileAttributesW
GetLastError
LockResource
DeleteFileW
HeapSetInformation
LoadResource
LocalFree
FreeLibrary
CopyFileW
LoadLibraryExW
HeapCreate
HeapFree
HeapAlloc
HeapDestroy
GetProcessHeap
FormatMessageW
GetFullPathNameW
EnumResourceTypesW
WriteFile
EnumResourceNamesW
CreateFileW
GetVersionExW
UnmapViewOfFile
CloseHandle
EnumResourceLanguagesW
LoadLibraryW
FindResourceExW
UpdateResourceW
GetProcAddress
GetModuleHandleW
BeginUpdateResourceW
CreateFileMappingW
MapViewOfFile
ReadFile
GetFileSizeEx
MultiByteToWideChar
Sleep
VirtualProtect
GetTempFileNameW
_lread
MoveFileExW
GlobalLock
GlobalFree
_llseek
GetTempPathW
SetLastError
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GlobalUnlock
_lwrite
_lclose
msvcrt
_exit
_cexit
__setusermatherr
_initterm
_errno
_fmode
_commode
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
memcpy
memset
__wgetmainargs
memcmp
exit
_amsg_exit
_XcptFilter
_CxxThrowException
__set_app_type
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
__CxxFrameHandler
??1type_info@@UEAA@XZ
bsearch
wcsncpy
__iob_func
wcsncmp
towupper
_wcsnicmp
wcsstr
strncmp
strtoul
wcschr
toupper
towlower
_vsnwprintf
malloc
free
fwprintf
vfwprintf
wcsrchr
_purecall
wcstoul
_wcsicmp
__C_specific_handler
wcscmp
imagehlp
MapFileAndCheckSumW
bcrypt
BCryptHashData
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptDestroyHash
BCryptCreateHash
user32
CharLowerW
ntdll
RtlLookupFunctionEntry
RtlAllocateHeap
RtlFreeHeap
RtlCaptureContext
RtlVirtualUnwind
Sections
.text Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE