nekopara_after[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
nekopara_after.exe
Size 4.2MB
Sample261017-aaak2syv4p
SHA256 b414f4e818b5a5a00516bd9c2e7183d425391e52ebde8edd5ba6b8e46c17aebc
MD5 8c24371f0009b41efc6ca0bfea2ab74a
SHA1 7bed206fac681a21447fb21b9c7e74ebdacd62cf
SHA512 0c7d141bc9800bb68ed9f7e9bda75f41ee9a3aaa0e8095d8b23e4531012c4bc014d393fccd211055e2aa98f7ded5ece35156d8975d731117e27a724924736232
SSDEEP 49152:8tnKg7x+RgOIfBHqGsXQQvHN7kX0wjwS65TE/t5FtuwKQL0dNBExglLztmyTV7S5:8RgRgOydqjAuAkp5T0tmEClLztm8z
TLSH
T12926BF11BB91C636E9E212B16ABDAF5F202CAE14176440DB73E80C5E6DB07D32736B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nekopara_after.exe

File Explorer

nekopara_after.exe

.exe 4.2MB

nekopara_after.exe

IMPHASH 9567e2dba4e003d705d55f3641eaa38e
SHA256 b414f4e818b5a5a00516bd9c2e7183d425391e52ebde8edd5ba6b8e46c17aebc
MD5 8c24371f0009b41efc6ca0bfea2ab74a
SHA1 7bed206fac681a21447fb21b9c7e74ebdacd62cf
SHA512 0c7d141bc9800bb68ed9f7e9bda75f41ee9a3aaa0e8095d8b23e4531012c4bc014d393fccd211055e2aa98f7ded5ece35156d8975d731117e27a724924736232
SSDEEP 49152:8tnKg7x+RgOIfBHqGsXQQvHN7kX0wjwS65TE/t5FtuwKQL0dNBExglLztmyTV7S5:8RgRgOydqjAuAkp5T0tmEClLztm8z
TLSH
T12926BF11BB91C636E9E212B16ABDAF5F202CAE14176440DB73E80C5E6DB07D32736B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2338899

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

tvpwin32.pdb

kernel32

FindResourceW LoadResource IsBadReadPtr GlobalAlloc Sleep SizeofResource GetVersionExW GlobalFree LockResource GlobalMemoryStatusEx SetCurrentDirectoryW HeapSetInformation GetCurrentThreadId GetSystemTime CreateMutexW HeapQueryInformation GetProcessHeaps HeapWalk GetNativeSystemInfo HeapAlloc HeapFree VirtualFree SetLastError VirtualAlloc LoadLibraryA VirtualProtect GetConsoleMode FreeConsole WriteConsoleW GetLocalTime SetConsoleTitleW OpenProcess GetProcessAffinityMask SetThreadAffinityMask GlobalMemoryStatus TerminateProcess GetCurrentThread SetThreadPriority GlobalDeleteAtom GlobalAddAtomW MulDiv OutputDebugStringW FormatMessageW LoadLibraryExW SearchPathW GetSystemDirectoryW GetWindowsDirectoryW WideCharToMultiByte IsDBCSLeadByte MultiByteToWideChar GlobalLock GlobalUnlock InterlockedIncrement InterlockedDecrement WaitForSingleObject InterlockedCompareExchange SetEvent ExitThread CreateEventW SetThreadIdealProcessor VirtualQuery GetThreadPriority SuspendThread ResumeThread CreateThread HeapDestroy HeapCreate LocalSize GetTempFileNameW SetEnvironmentVariableW SetEnvironmentVariableA GetExitCodeProcess GetCurrentDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetModuleFileNameA ReadConsoleW SetFilePointerEx GetConsoleCP GetTimeZoneInformation GetFileType GetFileAttributesExW GetOEMCP GetACP IsValidCodePage HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount GetCPInfo RaiseException RtlUnwind GetCommandLineA GetSystemTimeAsFileTime AreFileApisANSI GetModuleHandleExW HeapReAlloc IsProcessorFeaturePresent IsDebuggerPresent DecodePointer EncodePointer GetStringTypeW ExitProcess DeleteFileA GetFullPathNameW LocalFree LocalLock LocalUnlock GetVolumeInformationW GetCurrentProcessId DeleteFileW RemoveDirectoryW GetTempPathW GetFileAttributesW CreateFileW GetTickCount CreateDirectoryW SetEndOfFile GetDriveTypeW SetFilePointer GetFileSize CloseHandle DuplicateHandle CreatePipe SetStdHandle GetStdHandle FlushFileBuffers GetModuleFileNameW ReadFile WriteFile GetCurrentProcess CreateProcessW FindNextFileW FindClose GetProcAddress LoadLibraryW FreeLibrary FindFirstFileW GetLastError GetModuleHandleW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetProcessHeap GetSystemInfo HeapCompact

user32

GetClipboardData OpenClipboard SetClipboardData LoadStringW ClientToScreen SetWindowRgn SetCapture GetFocus EnumDisplaySettingsExW SetFocus GetForegroundWindow GetKeyboardLayout SetCursorPos MonitorFromWindow DestroyCaret IsClipboardFormatAvailable SetCaretPos GetPriorityClipboardFormat CloseClipboard KillTimer SetTimer ReleaseDC GetDC ChangeDisplaySettingsW GetSysColor MessageBoxW PostQuitMessage SetWindowPos GetParent GetWindowRect DefWindowProcW CreateWindowExW SetWindowLongW GetWindowLongW RegisterClassExW GetClassInfoExW PostMessageW DestroyWindow GetWindowThreadProcessId SystemParametersInfoW EnumDisplaySettingsW LoadCursorFromFileW CreateCaret GetMonitorInfoW EndPaint GetWindowTextLengthW GetSystemMenu ScreenToClient SetActiveWindow GetMessageExtraInfo GetKeyState TrackMouseEvent IsWindowEnabled SendMessageW GetCursorPos BeginPaint SetPropW GetCapture GetMenu LoadIconW SetRect InvalidateRect GetWindowTextW GetMenuItemCount AdjustWindowRectEx ReleaseCapture IsWindowVisible UpdateWindow SetWindowTextW SetCursor LoadCursorW WindowFromPoint GetCursor DialogBoxParamW GetDlgItem EndDialog SetDlgItemTextW EnableWindow TranslateAcceleratorW DestroyAcceleratorTable IsIconic CreateAcceleratorTableW WaitMessage TranslateMessage LoadAcceleratorsW PeekMessageW ShowWindow DispatchMessageW GetAsyncKeyState GetSystemMetrics EnumWindows GetClientRect

gdi32

SelectObject CreateFontIndirectW GetTextMetricsW GetStockObject EnumFontFamiliesExW GetObjectW CreateCompatibleDC GetFontData DeleteDC EnumFontsW CreateDIBitmap GetPixel CreateCompatibleBitmap SetPixel DeleteObject CombineRgn CreateRectRgn ExtCreateRegion GetTextExtentPoint32W GetOutlineTextMetricsW CreateDIBSection GetDeviceCaps GetGlyphOutlineW

comdlg32

GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHGetPathFromIDListW DragQueryFileW DragFinish SHBrowseForFolderW DragAcceptFiles ShellExecuteW SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoCreateGuid CoTaskMemAlloc StringFromGUID2

winmm

timeEndPeriod timeGetTime timeGetDevCaps timeBeginPeriod

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

mpr

WNetGetUniversalNameW

shlwapi

PathIsDirectoryW PathFileExistsW

imm32

ImmGetContext ImmGetOpenStatus ImmIsIME ImmSetCompositionFontW ImmSetConversionStatus ImmSetOpenStatus ImmAssociateContext ImmGetConversionStatus ImmSetCompositionWindow ImmReleaseContext

dbghelp

MiniDumpWriteDump

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.adata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

946KB

Virtual Size

945KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

680KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

300KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

nekopara_after.exe

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

winmm

version

mpr

shlwapi

imm32

dbghelp

generic