Ա��0��Yb6~u$�<K�IY\sa?���A,����ύh���)����L��>q�������6īQu��.9U�3���>�Σ��GL���V-@��LuHdٌ�����u9g�C�SR��00�ꇵT��^���A��j�7Fo"����3�O1#%fl���>].�1�ƥ�6��0렅�y��^�F�!�_L�o�auD9=V d��@x�\�,Q��%����f���!���DF����q�8��'���gsOM�Th��3xu�m����L#�f�"l��,����ԫ�u�]�"g��jK��N�)~@���J�'��adV���"<��T]Ka��y��-��N\�B�&�;�R}�PY=�7= H- k{tJ������i.<��I��㋴n������ΒCt��y:����*U�>j�s�)���s�����K�Jw�%��Ѥ@2|�T�5r�ҢF֙u�s^B���2�\�ŝ3�����rI��:����{����8���eP�T����Ր`|ݦ,6P�D }����������+�%/�b0"H�&s�U��q�C� ��q�˕t#�O5�a�zjfX�F��]�6YJ�쨦���'�K�~����dG��G.��usI6��gn1r�ˮ�w�rÖ"/�k�v�!������FF]��X�wZHgax�F�Ks���a�C��b��]���������d��}����g���o�%>�J��pSF;~g�r�<z� � �<�5�����8��͛�k��'|����}Ƀ��-��0��?���!4��;Ќ�Z�����k>�AO��솪|���lM9�qQS|b��*\��ސR�u��x�oI���G���oc:E~�8V��r�fG{9ڟ�\�wE�:[����������µ�����DP�m,f���Yl���4���w\�) 86ouL�m���9:L����CP���>���,�����5 �?̝V1�)e�pOW�[䞐 �K�v�I>�dЛ$X�k�$;��8����ZS�Y@�V�yvd�Y�UJ�`lx��p��m�N���?���Ѓ�C���Nc`�R�D"��¤� AD&'�cE$W �7zGu8���#�ފ_D��������(T�/��R R鴓B���y��=���Ymi�������f�X�N����R����Aʬ�=EV�q�~̨����X�c��_���:t�����c�FFn�a���y=�� �p6Ԥ���K$#h��u�7�L���v��&��X|��W�]Ȋ��5��Ak��|���頸cĀn#�k~E���cw4��}9�}綼�Fʙ������U`��O��q|"�['V��\��l�����Hƽ[Kq�����>xYJ;�c����O Tb}"ض�WA<J@�'�R8RA�M\� P���U�N ��s�#̶�? �G�ݤ-��a6A�=}qY�$�Ȕ��nu�q�U��aS\�;#�]�^5&��|Ɂ���Q1���~�B�A]ǃ�m�=�/��v�U�*9��vD�6�ڟ3��ɓ>�����_pnS�i���~Ru�v#٧��v��(�%n������}���0���]kG�����X������TJ�a�Ҳ;�]���w9:��Cw���>�m}Qu.�7(\ ��E|�ɕG&2-k� ��=��r\2��T����m�ݪ2��]/ʩ^1ၨp�ݔS��˙�m՟͂�V�1����/�둔���if�g�v)����Dա%�hYRD7`�,�����dN�h�'-n1��؋̱ ���e��������݉"x��2�L�a �����>O�3�8�1� �H0���qV��"Y`R�gt#D�}gg15���m�;($]��:�uA:��Rq��[+�����]o��9�� ��O������@��*�;��S '��L���ʱ�]��2I�-IF@E�-2~�et��j��H�����.؆�v�����h���NK:&9&�Ma�Ww���٥���cz�Є�5Ӷ�Y��YM��0��yu���³�a�0e�ή�^v�$e��rK��^�V��ąFʇ������;u���$��)����+��Gt:�}�Z��-��/�8o�R�\�(�;g�Lj /Y����a�]�� m��'td'�| �YmI�w��uYpA��e�-w��A�����3{av9�m�v��\�%w��Nj���N��kN\�x��$��J,Eow��� ˎ }�_kʉUDqh�ME;���uM�(5���&8i��������e|E�j���,�{G`\��> QN>�G�-Ab}�X����w�.7�����g �S�� �J���͔�a&����YA�J^� ���o� ���ͪ[k��\���]�F�/���U%&R��"&�`78 jy��xlm! �)����P�2����Q�����`�<d[�k���p�霃�� �ɭ6��ɝd1(� ����(�� ���6�ȵ�8��9G����XI�G�ʻuн��A���^���|o��)�W��q��Oƴ��n@ˑ���[��L����Pd����h e��$8;%��mՈh >EK� ;h���7U�۬K�� �"�8b�|$ ������9P��A�oqIC5ɵvU}��e�#�hCH@S�� ������I��m�4���m�7'���w��(�,_���-�V��$�RR��Pu#��yPc}h��1\O-�Q}T���3�|&2ͯ����m��L������W�t����~���ET��p�p���� >!��p��Qo���,���R�' �?��Oo�_o�Ly�}p;�� �?w:��M��TΒ�+[P�i��c�>�S�l�]����2� ���x�o�Z�D�&�͔(wf�f�ƙ���4g��k��]Zt���@o��K~�V��I�v�ea��0����{�.���a��t5o����ϴ���S�6"n#oJs�N��1�G͒*�0� *�E�{��������C�����K�ڱ� 5�������6�����PW�-��ǜ;)�2�y|��`��>�A-s�I���[�i�yϘ�*��gVxn�j�̧vS��-p}]l;��hN>sP��-(:֔ 0�#7�-}Lm���+>��_�,�;`���" 2�ag�.;���f�8|���,�7��D�� ��s�� 8=噺I1s�e�s�#��'س�@�����*�<�5��4�����-�_U#��,Mu�׀iih���]��y�숏#"Ԓ��b��X峇'���T� d+��Y��ik���璣9Ґ���� @��L���k�CG%� ��Z��mU�1��E��)��TClΌK����\�>Bţz'!����{��g .p�!*،a��t��I��P��+�d-�Z�6[������đpB���l��܁�$PE:�0gd[��7S���s$E����tn��5�&B�Z�|N"t �[m��&:|��:���E��:q��������W5�{���m%���h �X���D䊝�'+�;�=������\��c��D����~�#xG�s�]F_����*)�b��<������ \ms��.�{������;{��'�@�9�v�G��&�&Pr}�n&���D1�֘�(�\�'�Aq\>M���
Static task
static1
Behavioral task
behavioral1
Sample
ebe69ba3a6232712cf26fcb5532db670_NEIKI.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ebe69ba3a6232712cf26fcb5532db670_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
ebe69ba3a6232712cf26fcb5532db670_NEIKI
-
Size
5.6MB
-
MD5
ebe69ba3a6232712cf26fcb5532db670
-
SHA1
23a910e8280eec8a40fe881085dd6137ed99c056
-
SHA256
f485783cc6071f92bf08ab09ccd21ec8b2746f5be3c490b8aefcd684bba45fba
-
SHA512
62068d4b3ab9c1bcd40a12064b7edd4325287b26deff9f8b27b221fccd1856a2acd7e7fa0818a6befdc50bb1a90263185b4ce273527df6f8bf1c2978ff9a20f1
-
SSDEEP
98304:i1dVRumY1w7Zuij3jnUZV3OdyzfW5QF3yRMyGlneM227ugCa/4QSvjKp7npa:i1dbumY1w7sPZV+CfW5QuGeM2rZI4z74
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ebe69ba3a6232712cf26fcb5532db670_NEIKI
Files
-
ebe69ba3a6232712cf26fcb5532db670_NEIKI.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 22.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE