d:\Projects\WinRAR\rar\build\sfxcon32\Release\sfxcon.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a8bec1e7c564da0486c89c06b4ea65d0_NEIKI.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a8bec1e7c564da0486c89c06b4ea65d0_NEIKI.exe
Resource
win10v2004-20240426-en
General
-
Target
a8bec1e7c564da0486c89c06b4ea65d0_NEIKI
-
Size
194KB
-
MD5
a8bec1e7c564da0486c89c06b4ea65d0
-
SHA1
b35cdad0ea840b2c966f92a30b2f69c43e211281
-
SHA256
e7b962757bf7a39228c4b9ca40d1c8f8de751a9ad062cb229c1d22bf3fdb472f
-
SHA512
0b0959dba66391628690763b232be3b7977cd5bf4e39ff9fbacfe21a39e4b9564a81ac3355912bccb7ff84a36b207db0cfccb2c0ad8ed57605f5173f75438ef9
-
SSDEEP
3072:kB55gAmUjTGueNu1hAYAO4sBIHxss2AVpygPcQOq/bzp+WTWv+3CKq:kIyCNu4YmGEJPcQHvVTWv+3a
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8bec1e7c564da0486c89c06b4ea65d0_NEIKI
Files
-
a8bec1e7c564da0486c89c06b4ea65d0_NEIKI.exe windows:5 windows x86 arch:x86
2547b8ec4890953dfa6be5708897bea3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetConsoleCtrlHandler
GetLastError
SetLastError
CloseHandle
GetCurrentProcess
CreateHardLinkW
DeleteFileW
RemoveDirectoryW
DeviceIoControl
CreateDirectoryW
CreateFileW
SetFileTime
MoveFileW
GetShortPathNameW
GetLongPathNameW
SetFilePointer
SetEndOfFile
ReadFile
FlushFileBuffers
GetDriveTypeW
GetFileAttributesW
SetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
GetVersionExW
GetCurrentDirectoryW
SetErrorMode
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
Sleep
GetModuleHandleW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateThread
WaitForSingleObject
GetProcessAffinityMask
CreateEventW
CreateSemaphoreW
ReleaseSemaphore
ResetEvent
SetEvent
SetThreadPriority
SystemTimeToFileTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
LocalFileTimeToFileTime
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
IsDBCSLeadByte
GetCPInfo
CreateFileA
WriteFile
WriteConsoleW
SetConsoleMode
ReadConsoleW
GetStdHandle
GetFileType
GetCurrentProcessId
GetConsoleMode
RtlUnwind
HeapFree
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
ExitProcess
RaiseException
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
VirtualAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStartupInfoA
SetStdHandle
GetConsoleCP
HeapSize
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
WriteConsoleA
GetConsoleOutputCP
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
user32
MessageBeep
OemToCharBuffA
CharToOemA
LoadStringW
advapi32
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
SetFileSecurityW
Sections
.text Size: 141KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ