Static task
static1
Behavioral task
behavioral1
Sample
05690dba76bc0acb9915b622d4a98dd0_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
05690dba76bc0acb9915b622d4a98dd0_NEIKI.exe
Resource
win10v2004-20240508-en
General
-
Target
05690dba76bc0acb9915b622d4a98dd0_NEIKI
-
Size
82KB
-
MD5
05690dba76bc0acb9915b622d4a98dd0
-
SHA1
84f8d2c0643bfe2fac460628b72ee112b619eac4
-
SHA256
b25ce1c10001d1e72120fdfeb105434cc58103778ceadbfdf9b3547cd950ce62
-
SHA512
a0bc68d9ddc27f4af526e238e0731fa5ca454a9c910312ec024c7ac2a51272794f7144115b8b37092d6dce6e44685cd7b3a5771f190394dc29884e5e51cc3a91
-
SSDEEP
1536:Wg3ueGmOWSB4kgrQwkd+qk+EJtCekL5t7CZi6a65Y1+no5x:Wg3ueGm9PkgrQ1+qD15t+IVA2+o5x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05690dba76bc0acb9915b622d4a98dd0_NEIKI
Files
-
05690dba76bc0acb9915b622d4a98dd0_NEIKI.exe windows:6 windows x86 arch:x86
e808b76ebe479af9408db3d46773ac2e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
wsprintfW
advapi32
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
dxgi
CreateDXGIFactory
qt5core
??0QJsonValue@@QAE@H@Z
??0QJsonValue@@QAE@_J@Z
??0QJsonValue@@QAE@ABVQString@@@Z
??0QJsonValue@@QAE@PBD@Z
??1QJsonValue@@QAE@XZ
??0QJsonObject@@QAE@XZ
??1QJsonObject@@QAE@XZ
??0QJsonObject@@QAE@ABV0@@Z
?insert@QJsonObject@@QAE?AViterator@1@ABVQString@@ABVQJsonValue@@@Z
?timeout@QTimer@@QAEXUQPrivateSignal@1@@Z
??0QJsonDocument@@QAE@ABVQJsonObject@@@Z
??1QJsonDocument@@QAE@XZ
?toJson@QJsonDocument@@QBE?AVQByteArray@@W4JsonFormat@1@@Z
?staticMetaObject@QTimer@@2UQMetaObject@@B
?staticMetaObject@QObject@@2UQMetaObject@@B
?dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ
?qt_metacast@QObject@@UAEPAXPBD@Z
?qt_metacall@QObject@@UAEHW4Call@QMetaObject@@HPAPAX@Z
??4QJsonObject@@QAEAAV0@ABV0@@Z
??0QJsonValue@@QAE@N@Z
??0QString@@QAE@XZ
??1QString@@QAE@XZ
??4QString@@QAEAAV0@ABV0@@Z
??0QString@@QAE@$$QAV0@@Z
??4QString@@QAEAAV0@PBD@Z
?exec@QEventLoop@@QAEHV?$QFlags@W4ProcessEventsFlag@QEventLoop@@@@@Z
?toStdString@QString@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0QObject@@QAE@PAV0@@Z
??1QObject@@UAE@XZ
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
??0QString@@QAE@ABV0@@Z
?detach@QListData@@QAEPAUData@1@H@Z
?detach_grow@QListData@@QAEPAUData@1@PAHH@Z
?disconnect@QObject@@SA_NPBV1@PBD01@Z
?connectImpl@QObject@@CA?AVConnection@QMetaObject@@PBV1@PAPAX01PAVQSlotObjectBase@QtPrivate@@W4ConnectionType@Qt@@PBHPBU3@@Z
?QStringList_join@QtPrivate@@YA?AVQString@@PBVQStringList@@PBVQChar@@H@Z
?constData@QString@@QBEPBVQChar@@XZ
?toStdString@QByteArray@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?timerEvent@QTimer@@MAEXPAVQTimerEvent@@@Z
?qt_metacast@QTimer@@UAEPAXPBD@Z
?qt_metacast@QSettings@@UAEPAXPBD@Z
?qt_metacall@QTimer@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacall@QSettings@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?metaObject@QTimer@@UBEPBUQMetaObject@@XZ
?metaObject@QSettings@@UBEPBUQMetaObject@@XZ
?event@QSettings@@MAE_NPAVQEvent@@@Z
?start@QTimer@@QAEXH@Z
??1QTimer@@UAE@XZ
??0QTimer@@QAE@PAVQObject@@@Z
??1QEventLoop@@UAE@XZ
??0QEventLoop@@QAE@PAVQObject@@@Z
?drives@QDir@@SA?AV?$QList@VQFileInfo@@@@XZ
?absolutePath@QFileInfo@@QBE?AVQString@@XZ
??1QFileInfo@@QAE@XZ
??0QFileInfo@@QAE@ABV0@@Z
?dispose@QListData@@SAXPAUData@1@@Z
??1QUrl@@QAE@XZ
??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z
?readAll@QIODevice@@QAE?AVQByteArray@@XZ
?value@QSettings@@QBE?AVQVariant@@ABVQString@@ABV2@@Z
?childKeys@QSettings@@QBE?AVQStringList@@XZ
??1QSettings@@UAE@XZ
??0QSettings@@QAE@ABVQString@@W4Format@0@PAVQObject@@@Z
?toString@QVariant@@QBE?AVQString@@XZ
??1QVariant@@QAE@XZ
??0QVariant@@QAE@XZ
?deleteLater@QObject@@QAEXXZ
?connect@QObject@@SA?AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z
?QStringList_contains@QtPrivate@@YA_NPBVQStringList@@ABVQString@@W4CaseSensitivity@Qt@@@Z
?cap@QRegExp@@QAE?AVQString@@H@Z
?indexIn@QRegExp@@QBEHABVQString@@HW4CaretMode@1@@Z
??1QRegExp@@QAE@XZ
??0QRegExp@@QAE@ABVQString@@W4CaseSensitivity@Qt@@W4PatternSyntax@0@@Z
?at@QListData@@QBEPAPAXH@Z
?size@QListData@@QBEHXZ
??1Connection@QMetaObject@@QAE@XZ
??YQString@@QAEAAV0@PBD@Z
??0QString@@QAE@ABVQByteArray@@@Z
?number@QString@@SA?AV1@NDH@Z
?utf16@QString@@QBEPBGXZ
?split@QString@@QBE?AVQStringList@@ABV1@W4SplitBehavior@1@W4CaseSensitivity@Qt@@@Z
?replace@QString@@QAEAAV1@ABV1@0W4CaseSensitivity@Qt@@@Z
?remove@QString@@QAEAAV1@ABV1@W4CaseSensitivity@Qt@@@Z
?append@QString@@QAEAAV1@ABV1@@Z
?startsWith@QString@@QBE_NABV1@W4CaseSensitivity@Qt@@@Z
?arg@QString@@QBE?AV1@ABV1@00@Z
??4QString@@QAEAAV0@$$QAV0@@Z
??6QDebug@@QAEAAV0@PBD@Z
??6QDebug@@QAEAAV0@H@Z
??1QDebug@@QAE@XZ
?fromAscii_helper@QString@@CAPAU?$QTypedArrayData@G@@PBDH@Z
?arg@QString@@QBE?AV1@ABV1@HVQChar@@@Z
?arg@QString@@QBE?AV1@IHHVQChar@@@Z
?arg@QString@@QBE?AV1@KHHVQChar@@@Z
??0QChar@@QAE@UQLatin1Char@@@Z
?debug@QMessageLogger@@QBE?AVQDebug@@XZ
??0QMessageLogger@@QAE@PBDH0@Z
??1QByteArray@@QAE@XZ
?shared_null@QListData@@2UData@1@B
?end@QListData@@QBEPAPAXXZ
?begin@QListData@@QBEPAPAXXZ
?append@QListData@@QAEPAPAXXZ
qt5multimedia
??1QAudioDeviceInfo@@QAE@XZ
?deviceName@QAudioDeviceInfo@@QBE?AVQString@@XZ
?availableDevices@QAudioDeviceInfo@@SA?AV?$QList@VQAudioDeviceInfo@@@@W4Mode@QAudio@@@Z
?availableCameras@QCameraInfo@@SA?AV?$QList@VQCameraInfo@@@@W4Position@QCamera@@@Z
?description@QCameraInfo@@QBE?AVQString@@XZ
??1QCameraInfo@@QAE@XZ
??0QCameraInfo@@QAE@ABV0@@Z
??0QAudioDeviceInfo@@QAE@ABV0@@Z
qt5widgets
??1QApplication@@UAE@XZ
?exec@QApplication@@SAHXZ
??0QApplication@@QAE@AAHPAPADH@Z
qt5network
??1QNetworkRequest@@QAE@XZ
??0QNetworkRequest@@QAE@ABVQUrl@@@Z
?allInterfaces@QNetworkInterface@@SA?AV?$QList@VQNetworkInterface@@@@XZ
?addressEntries@QNetworkInterface@@QBE?AV?$QList@VQNetworkAddressEntry@@@@XZ
?hardwareAddress@QNetworkInterface@@QBE?AVQString@@XZ
?flags@QNetworkInterface@@QBE?AV?$QFlags@W4InterfaceFlag@QNetworkInterface@@@@XZ
??1QNetworkInterface@@QAE@XZ
??0QNetworkAccessManager@@QAE@PAVQObject@@@Z
?ip@QNetworkAddressEntry@@QBE?AVQHostAddress@@XZ
??1QNetworkAddressEntry@@QAE@XZ
??0QNetworkAddressEntry@@QAE@ABV0@@Z
??8QHostAddress@@QBE_NW4SpecialAddress@0@@Z
?toString@QHostAddress@@QBE?AVQString@@XZ
?protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ
??1QHostAddress@@QAE@XZ
??1QNetworkAccessManager@@UAE@XZ
?get@QNetworkAccessManager@@QAEPAVQNetworkReply@@ABVQNetworkRequest@@@Z
?createRequest@QNetworkAccessManager@@MAEPAVQNetworkReply@@W4Operation@1@ABVQNetworkRequest@@PAVQIODevice@@@Z
?metaObject@QNetworkAccessManager@@UBEPBUQMetaObject@@XZ
?qt_metacall@QNetworkAccessManager@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QNetworkAccessManager@@UAEPAXPBD@Z
??0QNetworkInterface@@QAE@ABV0@@Z
kernel32
ResetEvent
WaitForSingleObjectEx
GetCommandLineW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
WideCharToMultiByte
SetEvent
CreateEventW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
VerifyVersionInfoW
lstrcmpW
LocalAlloc
LoadLibraryExW
GetModuleHandleA
GetModuleFileNameW
GetSystemDirectoryW
GetVersion
SetLastError
GetFullPathNameW
GetFileAttributesW
ExpandEnvironmentStringsW
VerSetConditionMask
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Process32NextW
Process32FirstW
FormatMessageA
LocalFree
OpenProcess
GetCurrentProcess
Sleep
GetSystemInfo
GetDiskFreeSpaceExW
K32GetProcessMemoryInfo
GlobalMemoryStatusEx
CreateToolhelp32Snapshot
GetProcAddress
GetModuleHandleW
GetLastError
CloseHandle
GetSystemTimes
GetProcessTimes
DeleteCriticalSection
msvcp140
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Xlength_error@std@@YAXPBD@Z
powrprof
CallNtPowerInformation
ws2_32
gethostbyname
WSAStartup
inet_addr
iphlpapi
IcmpSendEcho
IcmpCreateFile
IcmpCloseHandle
vcruntime140
__CxxFrameHandler3
memcpy
__std_terminate
_CxxThrowException
wcsstr
memmove
memset
wcsrchr
__vcrt_InitializeCriticalSectionEx
__std_exception_copy
__std_exception_destroy
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
exit
_exit
_crt_atexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
_register_onexit_function
_initterm_e
_controlfp_s
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_initialize_onexit_table
_initialize_narrow_environment
_cexit
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
terminate
api-ms-win-crt-math-l1-1-0
round
_except1
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__stdio_common_vfprintf
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
_wcsicmp
isdigit
isalpha
_wcsupr
_wcsnicmp
api-ms-win-crt-heap-l1-1-0
free
_callnewh
_set_new_mode
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
shell32
CommandLineToArgvW
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 736B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ