t:\ace\x86\ship\0\acees.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dc8ee6f774748f32bc36bb7984cf27f0_NeikiAnalytics.dll
Resource
win7-20240508-en
General
-
Target
dc8ee6f774748f32bc36bb7984cf27f0_NeikiAnalytics
-
Size
436KB
-
MD5
dc8ee6f774748f32bc36bb7984cf27f0
-
SHA1
2c05be0390d2bf5d467f988db1d5fdc0cf6c7ba9
-
SHA256
f904e0545a853a84fde14e740ad754466f1e946694ecf32005ffc77e53cec308
-
SHA512
a989dd5577355c5b7051c71a99a4ca2a75876cc96565cf86de79e858484c1fbc0f41843975f13a8d3c32d7edb85d5712b608d2bc6a5dfa442de781f2835a96ad
-
SSDEEP
12288:OzSePdXLt73lhR7XvZ2NsazGacwE2W8lBtAxoF/NYa/:O+udPQNsazGacB2V7tAqF1Ya/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc8ee6f774748f32bc36bb7984cf27f0_NeikiAnalytics
Files
-
dc8ee6f774748f32bc36bb7984cf27f0_NeikiAnalytics.dll windows:4 windows x86 arch:x86
dd4fe326f4a61301b42f731a70a6effe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ole32
CoCreateGuid
CoGetMalloc
StringFromGUID2
IIDFromString
msvcr80
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
_stricmp
_wassert
strlen
_vsnprintf
wcsncmp
wcscmp
memmove
_memicmp
_wcsicmp
towupper
malloc
free
towlower
_wcsnicmp
iswalnum
iswcntrl
iswdigit
iswpunct
iswspace
memset
memcpy
wcslen
advapi32
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey
kernel32
InterlockedExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
RaiseException
Sleep
GetModuleHandleW
LocalAlloc
LoadLibraryExW
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryW
GetSystemDirectoryW
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
CompareStringA
CompareStringW
lstrcmpiA
GetLocaleInfoA
MultiByteToWideChar
GetLastError
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetUserDefaultLCID
GetVersionExA
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
oleaut32
SafeArrayCreate
SafeArrayPutElement
SysStringLen
LoadRegTypeLi
CreateStdDispatch
SysAllocString
VariantClear
VariantInit
SysStringByteLen
SysReAllocStringLen
SysFreeString
VariantCopy
VariantChangeType
SysAllocStringLen
SysAllocStringByteLen
VarBstrFromCy
VarBstrFromR8
VarBstrFromR4
VarBstrFromI4
VarBstrFromI2
VarBstrFromDec
VarDateFromStr
VarCyFromStr
VarR8FromStr
VarR4FromStr
VarI4FromStr
VarI2FromStr
VarDecFromStr
VarBstrFromDate
LHashValOfNameSys
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayDestroy
user32
IsCharAlphaW
IsCharAlphaA
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
DllMain
Sections
.text Size: 152KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ