d:\Avikon\Clean\atape\utils\RailGapProcessor\Release\RailGapProcessor.pdb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e77eadb56317f263b299c88dffe80970_NEIKI.exe
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
e77eadb56317f263b299c88dffe80970_NEIKI.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
e77eadb56317f263b299c88dffe80970_NEIKI
-
Size
782KB
-
MD5
e77eadb56317f263b299c88dffe80970
-
SHA1
e7cadae064b72cb167a41253ce43fad988e6d067
-
SHA256
03dfa6ba829ff36f907f5b8a3de1a0e1b10be60b6dded5ee449ea145287e279d
-
SHA512
07a5f003090e1da4e793afe5d56f6a23ed874d5e01e3117ee54e077d05d4ef15c587ed442639c2e1caeeada4a7803bd81a3f00a7a22ad04385b59ff2fad92115
-
SSDEEP
24576:Z1uCE4m3FJaguCl174yiANnGAKmjWI4rY:4ag/oATX
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e77eadb56317f263b299c88dffe80970_NEIKI
Files
-
e77eadb56317f263b299c88dffe80970_NEIKI.exe windows:5 windows x86 arch:x86
b465b4a3726817713140fe88a070737f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mfc90u
ord2592
ord6577
ord6311
ord2597
ord4131
ord2593
ord1678
ord5851
ord2702
ord6218
ord1420
ord481
ord2084
ord1088
ord321
ord813
ord6687
ord5632
ord590
ord1810
ord1809
ord3353
ord6408
ord1492
ord5653
ord4682
ord4631
ord6579
ord2904
ord6830
ord6831
ord1599
ord280
ord5182
ord6760
ord6187
ord1675
ord3422
ord3423
ord811
ord1937
ord1938
ord795
ord333
ord3488
ord3794
ord639
ord374
ord4000
ord4527
ord2971
ord3741
ord5008
ord4774
ord6822
ord5778
ord1248
ord265
ord6811
ord1243
ord5767
ord3589
ord5167
ord1714
ord3642
ord767
ord6805
ord3637
ord2143
ord6065
ord3686
ord3687
ord3220
ord293
ord4127
ord398
ord662
ord2758
ord6372
ord6574
ord2470
ord1779
ord1708
ord3627
ord750
ord3537
ord6096
ord5324
ord1333
ord2057
ord1108
ord615
ord3496
ord4654
ord1667
ord2277
ord4510
ord1601
ord2103
ord12404
ord13194
ord9972
ord10457
ord10304
ord13136
ord12165
ord12617
ord6174
ord9965
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1048
ord5548
ord6088
ord6547
ord6604
ord3513
ord6741
ord5830
ord1272
ord6418
ord5850
ord5863
ord266
ord654
ord3842
ord802
ord322
ord6040
ord5974
ord6101
ord6183
ord6569
ord4579
ord6566
ord6060
ord6572
ord6063
ord4213
ord2087
ord3217
ord5674
ord5676
ord8452
ord4347
ord4996
ord5680
ord5663
ord6018
ord3115
ord4905
ord9272
ord2208
ord6482
ord4211
ord7332
ord7138
ord4043
ord4967
ord286
ord3399
ord2209
ord664
ord405
ord6666
ord1357
ord2130
ord3577
ord2282
ord4512
ord6091
ord1353
ord636
ord367
ord744
ord524
ord4044
ord778
ord3654
ord3286
ord4660
ord1719
ord2283
ord1354
ord3543
ord2106
ord2537
ord3486
ord582
ord784
ord3500
ord1250
ord4664
ord3528
ord3165
ord3742
ord1183
ord6355
ord4266
ord296
ord600
ord4442
ord1137
ord2360
ord4262
ord3061
ord4010
ord2069
ord799
ord693
ord595
ord3563
ord4681
ord4910
ord4348
ord2891
ord4071
ord4081
ord4080
ord2764
ord2893
ord2774
ord3140
ord2966
ord4728
ord3112
ord2983
ord2771
ord5650
ord1727
ord1791
ord1792
ord2139
ord5625
ord1442
ord3226
ord6376
ord5404
ord3682
ord6804
ord4174
ord6802
ord1641
ord2368
ord2375
ord2630
ord2612
ord2610
ord2628
ord2640
ord2617
ord2633
ord2638
ord2621
ord2623
ord2625
ord2619
ord2635
ord2615
ord971
ord967
ord969
ord965
ord960
ord5683
ord5685
ord6466
ord1728
ord4702
ord5154
ord3743
ord5664
ord4603
ord6800
ord5512
ord2074
ord5602
ord4658
ord1493
ord4345
ord1751
ord1754
ord6411
ord3355
ord2280
ord7766
ord605
ord1274
ord1233
ord1145
ord801
msvcr90
memset
abort
_controlfp_s
_CxxThrowException
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
memcpy
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
??0exception@std@@QAE@ABV01@@Z
memcpy_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
_waccess
??0exception@std@@QAE@XZ
memmove_s
_itow
_swprintf
wcsncpy
_vsnwprintf_s
_wtoi
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
swprintf_s
_localtime64_s
swscanf
malloc
free
_wsetlocale
__wargv
__argc
_purecall
_wtof
wcsrchr
_wcsicmp
_wtol
wcschr
_wcsnicmp
isxdigit
isdigit
__iob_func
_wsplitpath
_wmakepath
_wfopen
_beginthreadex
fclose
fputws
fflush
memmove
strncmp
realloc
??8type_info@@QBE_NABV0@@Z
__CxxFrameHandler3
_amsg_exit
__wgetmainargs
kernel32
CreateFileA
GetFileSize
CreateMutexW
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
HeapAlloc
SystemTimeToFileTime
SetFilePointerEx
QueryPerformanceCounter
HeapFree
InterlockedCompareExchange
UnlockFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
HeapReAlloc
CreateFileW
FlushFileBuffers
GetTempPathW
HeapSize
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
InterlockedExchange
GetStartupInfoW
SetUnhandledExceptionFilter
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetFullPathNameA
WaitForMultipleObjects
InterlockedExchangeAdd
GetLocalTime
CloseHandle
WaitForSingleObject
SetEvent
SetThreadPriority
GetCurrentThread
GetThreadPriority
CreateDirectoryW
GetFileAttributesW
FreeLibrary
LoadLibraryW
GlobalAlloc
GetModuleFileNameW
LocalFree
Sleep
MultiByteToWideChar
FormatMessageW
lstrlenA
LocalAlloc
GetFullPathNameW
lstrlenW
WideCharToMultiByte
GetLastError
GetProcAddress
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
InterlockedIncrement
ReadFile
InterlockedDecrement
EnterCriticalSection
user32
DrawTextExW
DrawTextW
TabbedTextOutW
RedrawWindow
KillTimer
SetTimer
DrawEdge
IsWindowVisible
GetWindowRgn
DeferWindowPos
EqualRect
EndDeferWindowPos
BeginDeferWindowPos
GetClassNameW
CallWindowProcW
RemovePropW
GetPropW
SetWindowLongW
SetPropW
SetWindowRgn
IsZoomed
GetWindowLongW
GetWindowRect
IsMenu
AdjustWindowRectEx
FillRect
GetSysColor
OffsetRect
CopyRect
ReleaseDC
GetDC
SetRectEmpty
IsCharAlphaNumericW
GetParent
DrawIcon
GetSystemMetrics
IsIconic
LoadIconW
GetDlgItem
MessageBoxW
AppendMenuW
CreatePopupMenu
GetCursorPos
PostMessageW
InvalidateRect
GetClientRect
SendMessageW
EnableWindow
GrayStringW
gdi32
TextOutW
RectVisible
PtVisible
CreateFontIndirectW
GetObjectW
ExtTextOutW
GetTextExtentPoint32W
BitBlt
GetMapMode
CreateCompatibleBitmap
LPtoDP
OffsetRgn
DPtoLP
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateRectRgn
Rectangle
GetStockObject
StretchBlt
CreateCompatibleDC
CreateDIBSection
Escape
advapi32
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegFlushKey
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
comctl32
InitCommonControlsEx
ole32
StringFromGUID2
OleInitialize
CLSIDFromString
OleRun
CoCreateInstance
oleaut32
VariantClear
SysStringLen
VariantChangeType
VariantInit
VariantCopy
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
GetErrorInfo
msvcp90
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??1locale@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??0locale@std@@QAE@XZ
?_Incref@facet@locale@std@@QAEXXZ
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?id@?$codecvt@_WDH@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?classic@locale@std@@SAABV12@XZ
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?toupper@?$ctype@_W@std@@QBE_W_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?destroy@?$allocator@_W@std@@QAEXPA_W@Z
?construct@?$allocator@_W@std@@QAEXPA_WAB_W@Z
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W0@Z
??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
Sections
.text Size: 565KB - Virtual size: 565KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ