1fc0e8c83957f9a2295e507b9db71d60_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target

1fc0e8c83957f9a2295e507b9db71d60_NeikiAnalytics
Size

992KB
MD5

1fc0e8c83957f9a2295e507b9db71d60
SHA1

8d7bcc9bae31e563b59b95bb59098532f4c94c40
SHA256

cc0126406eb0a73837dee33bd5ec72c41990b3053ace3293d03afec0c00ecbf5
SHA512

0a5af5eb2cb5194ec57cb7f0279db0b10d46f7080e340ec5d09d54bfc864cfb77433e16e182e210c63ebdf67c012c8e66aa2cf2e5c39ba7132bf1c7747f9a014
SSDEEP

24576:2ZrJ6/QzI4xKI1vsQTUxgUJ79W0rr2JFReKyM4Ar:ArJ6/Qc4x+6s70eRur

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fc0e8c83957f9a2295e507b9db71d60_NeikiAnalytics

Files

1fc0e8c83957f9a2295e507b9db71d60_NeikiAnalytics
.dll windows:4 windows x86 arch:x86

b973a57a519d862a1a795d990e7be3fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

t:\ace\x86\ship\0\aceexcl.pdb

Imports

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
StringFromGUID2
CoCreateInstance
CoInitialize
StgCreateDocfile
StgOpenStorage
OleInitialize
OleUninitialize

msvcr80

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
fopen_s
fwprintf_s
fclose
vsprintf_s
wcscpy_s
vswprintf_s
_wassert
_stricmp
_wfullpath
__RTDynamicCast
_recalloc
wcsncpy_s
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
memcpy_s
towlower
wcsstr
iswctype
memcmp
wcsrchr
toupper
_wcslwr_s
fabs
floor
_ecvt_s
atoi
_wsplitpath_s
_CxxThrowException
__CxxFrameHandler3
strlen
memmove
wcstoul
tolower
malloc
free
memset
memcpy
wcstok_s
labs
_wtoi
wcspbrk
wcscmp
_wcsnicmp
wcschr
abs
_vsnwprintf
wcslen

msvcp80

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

advapi32

RegQueryValueExA
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyExA

kernel32

HeapFree
GetTempPathA
GetTempFileNameA
CreateProcessA
GetProcessHeap
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
LoadLibraryA
GetSystemDirectoryW
LoadLibraryW
SetCurrentDirectoryW
RemoveDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
ExpandEnvironmentStringsW
FindNextFileW
FindFirstFileW
GetFileAttributesW
GetFullPathNameW
GetTempPathW
DeleteFileW
CreateFileW
HeapAlloc
RaiseException
lstrcmpiW
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetModuleFileNameW
DeleteCriticalSection
GetModuleHandleW
FindResourceW
SizeofResource
LoadResource
LockResource
GlobalSize
GetSystemTimeAsFileTime
lstrlenW
lstrlenA
GetProcAddress
FreeLibrary
GetCurrentProcessId
SetFilePointer
WriteFile
CloseHandle
GetLastError
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
GlobalFree
GlobalUnlock
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
GetThreadLocale
LocalAlloc
ReadFile
DisableThreadLibraryCalls
GetACP
IsValidCodePage
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
GetTimeFormatA
GetDateFormatA
GlobalLock
GlobalAlloc

oleaut32

VarBstrCmp
VarI2FromStr
SysFreeString
SafeArrayDestroy
VarR8FromCy
SafeArrayGetElement
VariantInit
VariantClear
SafeArrayPutElement
SafeArrayCreate
SysAllocString
VarCyFromR8
VarUdateFromDate
VarR8FromDec
VarR8FromStr
VarDecFromR8
VarBstrFromR8
SysStringLen
VariantChangeType
GetActiveObject
SysAllocStringLen

user32

CharUpperW
CharNextW
OpenClipboard
UnregisterClassA
SendMessageW
GetClassNameW
EnumWindows
CloseClipboard
GetClipboardData
RegisterClipboardFormatW

Exports

Exports

DllGetClassObject

Sections

.text
Size: 540KB - Virtual size: 538KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 412KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b973a57a519d862a1a795d990e7be3fd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

msvcr80

msvcp80

advapi32

kernel32

oleaut32

user32

Exports

Exports

Sections

.text Size: 540KB - Virtual size: 538KB

.data Size: 16KB - Virtual size: 32KB

.rsrc Size: 20KB - Virtual size: 16KB

.reloc Size: 412KB - Virtual size: 412KB

.text
Size: 540KB - Virtual size: 538KB

.data
Size: 16KB - Virtual size: 32KB

.rsrc
Size: 20KB - Virtual size: 16KB

.reloc
Size: 412KB - Virtual size: 412KB