�x$"�����sN:�D�������ܮ_Y�^M�}~�3��L�ܬ�]ի��� �q20әoY~>�S�]��o���-%F<e}f$+���/��g���:�F@�⺏��-NUB�#��04o*�KEK{"�j��3hX�-)�Z@~��i;-gTՈ��_�<������j 7�s��|�Y��#ņr�&�A��������M!Y(恷.�h�Cn]$Z�������ԡ�}0}a��s�c1�������SRbA7(�N�c�@&���$B�Ձ�0آ��]�!��R�4e��>� A�`�y�Ε���[q��40�+��,���~<Ք(1ڽ��>�ٕik���=�~�o�� ?k� �h�����<ap4��#�Y��:+��G~Ķgב]!����J~J9Z!�b����o �_����'㋙�a;���?9��D�ڰ7����Տ����',#�"��7����>�ų���V�ɡ�����_�zh��h>�ҧןGLL�����n���1��"���w���Ņ�8�ۢ���*�Z��rR8����_ ��P�d��&;�mǤ$4���eЙ��Rb?�>i^c�ޑ�[����^����÷aS�_z��M�[����Q���P�ޕ���9wj����<�ǁD�������TDž���^��V��_�V���ԅ��'�ZKh�k�4��Ƨ�Ò����Ws#Z�Ef���I�����n>x:sW+��l4�[Y���%Z�&�7�N�}-�z(*���I����Q�a��~�q� �Uy�s� ľ輾����aa8{X�rw�/�_��>�4&7�/l�C��3\&��ϻg8���*���#�3��*�Qh�o>�����\a!I�b�Z#.|y���0k�=V\��D�l�cc�"���a}����0糒�rBQ�uAcܩ�L&BX�'XNJ��s�Iq���9m��6����'�@�"��#$$�R[�_v���35A.��g*0�4�E��%N�|W���FoE/{)�{���D>C�3I��hEx� -�1z�aʰ;� ���B*�0I�<�c�v���$�E�>��D��$�_�� bݲ0^�f��l� ��W�'�ʁ�9X�������dlͺ�c����c{S�?Գp����r�Ac���1��%K<��n��������k�'5��-҄$����_�Q9t�QM �>���ln_�xeY����9P̰�z���"�kJ��"��������L&�@'&L�Gi:�}�ү�PU �����z�QR�$������B��C��x��O�璺�&zv`�˸�d��ų���fl�1|�LY��&Ќ�V{ʢ`��/�Vm�D��h�`� �Aakk�t��"� <�e�S'��mk^�EV:���H;o�[�W�=B�|�hΛ��_ׇY+�in�>�H.���W����]�o ��I��.M���)?a����KH�F,C���>މ��,��6�S�F�HU(6��v�g�8�89�<1��)��;YώQ���l|�E�Zcf:3�F����uf���!�j��$C���6�_ ���A�p^h�L<�~2+�8;ox�+GL��[�d�!��}-?-ƻ�="�A3�2a�^L���+L`�}��ULk�q�T�����~m��4v���L��]��R6��ߓK�.�,���c�m��R���|�����m� �5z������C,8qh-d��"N��T ��%_f<|0{�VP�x���*�/��,y��P� ިC�j����6��.�f)���᷊�m�l�;��-�'G���:"��S��Z�P�q�w\w\R�JM|�0��eG�T��D�$&0�r���p���;�EI����y� 5�e#/h±H�2��~ ǵ�{/�>�:� �WI�il~�~����n,��b%��K@h9�!su��J�*So��tx��&�?����֡�`ZCE1T��?I��q�;&���ڦ���1h c�'݃I����3���"&��1mSl^�GK��w{�^��?�O��(�y���%r����T�� �r�&LO)���k�0g�����P ��J�J�Ý��G� \:b/�=�^��(����N.@A31"0�"5���0o(K���C92������/�?���b��[p��4fXd��Η���$���_3y�e��qde�s��0v�X�/�d��\!�� g�]��V� �����W ���і�.t�{z��FM �w3���9"�rе���|"��Eg��i/g�]������UJ$�A�V�d�c�gl8q�����3d���Q��,���e�����B��y�#�杽���zc�g��.>�D�dB�k����6#�z�f���!CO$lP炿ـ���Nwu��!r�̝�/�fY1�bv��K�)<tZ/��=]�/s�Cp���X����t���� M�{�ޜ��OLV��O��F�E<|��V �>��H_!{���5oN��3E�NI�h�� �w�CWd�h,��y��i�����GM=�,�U�/x��� %%�L����!�瀫�Kt�s]��^����D���~<��!D .:Q��U��&���1t��*�A�PYS���t<@R�+ܺ�Nֿ�{�UQM�VڪS?�6��:������/�]��a��Щ��az��g����<��|�r��� �y\{"��Z��-��]�K#�(����i�G?�(�`�ֵ|�dQ�Ack�..��t�G���{*��82Њt�"���;-b�0��K�v)e �BX�C2Q�mMm1AJ�9"̨F�!F��G���ټB���,��s�����o���=��~o������$�9#�3Pס��'y#�>�iAQ��LC�� �Q��� �L��j�=1��� <f����l�FۂH/�wڈ�P��F�d���se��N5V��ۇ&� 0�����9������2��`��H�4��5�9%#��O����k9T�R�L�����bR����KZ@F�5Fp1�I�����f�A�B]�g�f��θm�&�����m/�B6� �S������;X��}i���[�/�`�m�� �l7���)�^�(z�e<��&����h���� �{�%�6aS441wo��$ѱ�<�9�̍�u@��M iG��7�˿ d�+XȞG�I��j�p�6����z1��&)�ɺ������d��u�IITRQ�tҕ#6�>��_dՏ����p���P=��/�l�iKPz�r�<f���x��H�l���њ˟���+�(�dk�G���1TLZT�{+���`�؎����`�����.I�L�f��!N��>� ����h��y!��ң�9:��@�(��8��vf���!��&*E�Tz��3�H< 1ȽQ\���߮�����%�ƨG��?� ����hK�u��@cW�Gz]�JC=h3=��TZ���X@�f��n%Aa� E��3~%���"����n��,����F���r ��usϦ�h�&o���[����>[ �� R�o(�U����&�����bG��`夘������NB�!lo�8m$?��m��s�~�~��k����Z��&{D_��IG `A�rEA�|���Hh�?s���7s(� �^q�җ�rwī"{,$RZŶ)P tc�n7M��+V,��%�{�VM�o��8�2�ե�4� KvSq�w��l��[ ����!��y*L�/�m�/2}g����KPƂ$0$.i$�7?(l����4$ծ5�r��)S~?� ���O7��|baJ�j��:N0�w����z��g�����
Static task
static1
Behavioral task
behavioral1
Sample
fbd483babed86674aa5a4c7231e21030_NEIKI.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fbd483babed86674aa5a4c7231e21030_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
fbd483babed86674aa5a4c7231e21030_NEIKI
-
Size
2.4MB
-
MD5
fbd483babed86674aa5a4c7231e21030
-
SHA1
8cdacb547e4aec46bfcde9fb11d6554c57c411e6
-
SHA256
fb8cceed45f76295863e42d6e8929ce25a85bd821b10c78b367a047a48589b75
-
SHA512
568b95a4fcc6cf7b47961ff56497f2c884b4d42209f50d4cd36a0a32c4469d2f27f9177a4e60707f7c46751fba2ed4c0a9160eb89febbafeb5d4ae8eccf5d0ac
-
SSDEEP
49152:h/qaYn5Tca9+6vNVAufqmOnBwklxyYMTBI5nnhTb8oVY/SS8:h/qptca9+6HAuymQBwklxy9eRhTb1VYg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fbd483babed86674aa5a4c7231e21030_NEIKI
Files
-
fbd483babed86674aa5a4c7231e21030_NEIKI.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 32KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE