neko_ui[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
neko_ui.exe
Size 51.7MB
Sample260714-xepxvsbv2m
SHA256 afa06948927be8fb8589ee872b631707cc39e49cdeb97050244b42fe188ca909
MD5 1d12fb26de6f8a78e686ec409d52251d
SHA1 84581e517f16d4d80538728dfdab6ecd526486e3
SHA512 1814387efeac4f565ec7e2bc463bdce971fb5f2bc870795d09da6c80738dcde335f6d116ac949f8ab6a8c5bb18ebc0a84196275e8c39b42a0f2fc6ce051f8548
SSDEEP 1572864:9HKQWUY2wIr0SLurBn8GaB8ONeoQEYNawLR:9qQ30SLuNncB3NQEYNXL
TLSH
T106C7AE1D6BB241FDD0E0843D61607D32FCEDA7E54E53F1E23672E9884BA7182D9A9348
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
neko_ui.exe

File Explorer

neko_ui.exe

.exe 51.7MB

neko_ui.exe

IMPHASH 4786962c6f6715c2a86d33c3f600c9ce
SHA256 afa06948927be8fb8589ee872b631707cc39e49cdeb97050244b42fe188ca909
MD5 1d12fb26de6f8a78e686ec409d52251d
SHA1 84581e517f16d4d80538728dfdab6ecd526486e3
SHA512 1814387efeac4f565ec7e2bc463bdce971fb5f2bc870795d09da6c80738dcde335f6d116ac949f8ab6a8c5bb18ebc0a84196275e8c39b42a0f2fc6ce051f8548
SSDEEP 1572864:9HKQWUY2wIr0SLurBn8GaB8ONeoQEYNawLR:9qQ30SLuNncB3NQEYNXL
TLSH
T106C7AE1D6BB241FDD0E0843D61607D32FCEDA7E54E53F1E23672E9884BA7182D9A9348
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33150779

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nggsd\Downloads\neko\build\neko_ui.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea DwmEnableBlurBehindWindow

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

winhttp

WinHttpConnect WinHttpSetOption WinHttpCrackUrl WinHttpCloseHandle WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpSendRequest

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW LoadLibraryExW GetProcAddress FreeLibrary GetModuleHandleA GetModuleFileNameW FreeLibraryAndExitThread

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetLocalTime GetSystemInfo GetTickCount64

api-ms-win-core-memory-l1-1-0

WriteProcessMemory VirtualQueryEx VirtualFree ReadProcessMemory

api-ms-win-core-processthreads-l1-1-0

GetExitCodeThread ExitProcess ExitThread TerminateProcess CreateThread GetCurrentProcessId GetCurrentProcess GetCurrentThread GetStartupInfoW GetProcessId CreateProcessW

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Process32NextW

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW Sleep WakeConditionVariable InitOnceBeginInitialize InitOnceComplete

api-ms-win-core-heap-l2-1-0

LocalFree GlobalAlloc GlobalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle SearchPathW GetCurrentDirectoryW GetCommandLineW SetStdHandle GetCommandLineA GetEnvironmentVariableW SetEnvironmentVariableW

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler

api-ms-win-core-console-l1-1-0

GetConsoleMode SetConsoleMode GetConsoleOutputCP ReadConsoleW WriteConsoleW ReadConsoleInputW SetConsoleCtrlHandler AllocConsole

d3dcompiler_47

D3DCompile

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo VerSetConditionMask GetSystemTimePreciseAsFileTime

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA LoadLibraryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte GetStringTypeW CompareStringW CompareStringEx

api-ms-win-core-localization-l1-2-0

GetLocaleInfoW GetLocaleInfoA GetLocaleInfoEx EnumSystemLocalesW LCMapStringW IsValidCodePage GetOEMCP GetCPInfo IsValidLocale LCMapStringEx GetUserDefaultLCID

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-mm-time-l1-1-0

timeEndPeriod timeBeginPeriod

api-ms-win-core-errorhandling-l1-1-0

GetLastError UnhandledExceptionFilter RaiseException SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

CreateEventW ResetEvent InitializeCriticalSectionEx SetEvent AcquireSRWLockShared AcquireSRWLockExclusive WaitForSingleObjectEx WaitForSingleObject ReleaseSRWLockExclusive ReleaseSRWLockShared

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation FileTimeToSystemTime

api-ms-win-core-console-l1-2-0

FreeConsole

api-ms-win-core-console-l2-1-0

SetConsoleOutputCP SetConsoleCP

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-core-file-l1-1-0

GetFileAttributesExW GetFileAttributesW GetFullPathNameW FindFirstFileExW SetEndOfFile CreateFileW GetDriveTypeW SetFileInformationByHandle DeleteFileW SetFilePointerEx FlushFileBuffers GetFileInformationByHandle CreateDirectoryW

api-ms-win-core-file-l1-2-0

GetTempPathW CreateFile2

api-ms-win-core-file-l2-1-0

MoveFileExW GetFileInformationByHandleEx

api-ms-win-core-com-l1-1-0

CoCreateInstance CoInitializeEx CoUninitialize CoCreateFreeThreadedMarshaler

crypt32

CertOpenSystemStoreW CertGetCertificateContextProperty CertOpenStore CertDuplicateCertificateContext CertFindCertificateInStore CertFreeCertificateContext CertCloseStore CertEnumCertificatesInStore

ws2_32

send WSAGetLastError ioctlsocket recv getsockopt ntohs select gethostbyname WSASetLastError WSACleanup htonl htons inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname closesocket connect setsockopt socket shutdown getpeername recvfrom sendto getsockname WSAStartup

advapi32

CryptDestroyKey CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGetProvParam CryptSetHashParam CryptExportKey CryptGetUserKey

kernel32

TlsSetValue TlsGetValue TlsAlloc InitializeSRWLock SetLastError VirtualProtect WriteFile CreateSemaphoreA GetFileType RtlVirtualUnwind CreateFileMappingA UnmapViewOfFile MapViewOfFile GetProcessHeap LeaveCriticalSection GetModuleHandleExW ReadFile GetFileSizeEx CreateFileA Module32NextW Module32FirstW GetSystemDirectoryA FormatMessageA GetSystemTimeAsFileTime GetSystemTime ReadConsoleA FindClose FindFirstFileW FindNextFileW DeleteCriticalSection TlsFree GetACP InitializeCriticalSection HeapAlloc EnterCriticalSection HeapReAlloc ReleaseSemaphore HeapFree GetCurrentThreadId

user32

GetForegroundWindow GetWindowTextA GetCursorPos ScreenToClient FindWindowA IsWindow GetClientRect OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindowThreadProcessId GetKeyboardLayout GetAsyncKeyState GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode SetCursorPos SetCursor ClientToScreen LoadCursorW TrackMouseEvent SetProcessDPIAware MessageBoxA GetClipboardData TranslateMessage DispatchMessageW MessageBoxW GetUserObjectInformationW GetProcessWindowStation MapVirtualKeyA GetKeyNameTextA SetWindowLongPtrW GetWindowLongPtrW SendInput PeekMessageW DefWindowProcW PostQuitMessage SetWindowLongW UnregisterClassW RegisterClassExW CreateWindowExW UpdateWindow DestroyWindow SetWindowPos ShowWindow MoveWindow

gdi32

DeleteObject CreateRectRgn

shell32

ShellExecuteW

wininet

InternetOpenA InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile InternetCloseHandle

winmm

PlaySoundA

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlUnwind RtlPcToFileHeader RtlCaptureContext RtlUnwindEx

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork FreeLibraryWhenCallbackReturns CreateThreadpoolWork CloseThreadpoolWork

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsSetValue FlsFree FlsGetValue

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-datetime-l1-1-0

GetDateFormatW GetTimeFormatW

api-ms-win-core-heap-l1-1-0

HeapSize

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

Name

.text

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12.9MB

Virtual Size

12.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8.6MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

nigger0

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

nigger1

Size

353KB

Virtual Size

353KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

nigger2

Size

20.5MB

Virtual Size

20.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

neko_ui.exe

d3d11

dwmapi

imm32

winhttp

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-console-l1-1-0

d3dcompiler_47

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-file-l1-2-2

api-ms-win-core-debug-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-mm-time-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-console-l1-2-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-console-l3-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-com-l1-1-0

crypt32

ws2_32

advapi32

kernel32

user32

gdi32

shell32

wininet

winmm

api-ms-win-security-systemfunctions-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

generic