t:\ace\x86\ship\0\aceexch.pdb
Static task
static1
Behavioral task
behavioral1
Sample
25d992ea9c661b08b542680034ab2990_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
25d992ea9c661b08b542680034ab2990_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
25d992ea9c661b08b542680034ab2990_NeikiAnalytics
-
Size
560KB
-
MD5
25d992ea9c661b08b542680034ab2990
-
SHA1
71ffb2974ede806dfbcd057ace66ed3ce917cb32
-
SHA256
f0304823997647ede3c6a854766755adf4f22bf34e35c65decf3d61066758690
-
SHA512
7048a418e749798638bbec054b1a3d83597e30d6bb51afd8ed1fa8505277431cf376b238307260b2a46e11ca2c7e075d08733496436191236a591c16e474ba2d
-
SSDEEP
12288:CTbprcX03EdTeWV0TIbI6WwMH6uIJdJz3BraCDKCQc8TA4hN:kprcIE9VV28vWJHYxraCEc83
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 25d992ea9c661b08b542680034ab2990_NeikiAnalytics
Files
-
25d992ea9c661b08b542680034ab2990_NeikiAnalytics.dll windows:4 windows x86 arch:x86
d696afa7b73fccd251575ac063457f93
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ole32
StgCreateDocfile
StringFromGUID2
acecore
ord167
ord126
ord146
ord107
ord158
ord108
ord170
ord155
ord173
ord179
ord172
ord159
ord133
ord101
ord114
ord118
ord156
ord140
ord908
ord157
msvcr80
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
?terminate@@YAXXZ
_wassert
_stricmp
towlower
abs
wcsstr
iswctype
fabs
floor
_mbsicmp
_wsplitpath_s
wcschr
wcstok_s
_vsnwprintf
_wtoi
strlen
_CxxThrowException
_wcsdup
memset
memcpy
__CxxFrameHandler3
wcslen
_wfullpath
malloc
free
advapi32
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
RegCloseKey
kernel32
VirtualProtect
LoadLibraryA
GetSystemDirectoryW
LoadLibraryW
RaiseException
GetPrivateProfileStringW
GetModuleHandleW
ExpandEnvironmentStringsW
LoadLibraryExW
QueryPerformanceCounter
GetCurrentProcessId
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
GetUserDefaultLCID
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
WritePrivateProfileStringW
GetLastError
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetTickCount
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DisableThreadLibraryCalls
GetCurrentThreadId
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFileAttributesW
LocalAlloc
GetProcAddress
oleaut32
VarI2FromStr
SysAllocStringLen
VarBstrFromR8
VarDecFromR8
VarR8FromStr
VarR8FromDec
SysFreeString
user32
PostThreadMessageW
GetActiveWindow
Sections
.text Size: 172KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CURSORS Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
BASE Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 248KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ