��n몶�k���7{���,�:��O=t��U��Nu2h�<Ψ�p�{��=���\?��զ�RL֘ٲ1U-���OX�0 0�6��{`t�(Ҝ�j'A,ƌ8$��ƥYX��}y*v�+��R�a�g7l,y�1��$義 x����f���ߖ������ތ@#�w)��H�т�s�$c1����Ԅ��m).g��Ǯ��a�<���+��������\�M�����W�l������_�s֘�.�ӥ��@C=Zp��t��i�I�j���}���=�:Y�Uȅ%���>|)��(Ѯ�����1o���"���z�Xe�%Ʉ#���yE-���������;^�J��â���|����,E�@Q�N|��a��K��NL��sN2jT�fb���m-YϘ�'u ��]*��/b��L�f�Q�t�^���ݪ�p��\^�BL[�w"���r���V7��x�nc�gZ��=���n�����]A�>ɯ�;�g�O�X����Ml���7��$+���3yM)���u�\� X/_<S���"�9��G�d�d���B&'��.K]��8�*����[���j��y��cW�H���'1I���q����n���`����?��G��CL2;���@��]��x���w�(�Vj�zG��+��f����d%���!r�Y"����hъ| ��"��`����;z|@A�ה���CV3����M*c�;�ǰc� e+�s� ��>�}�2��'|�H�6B6j���O3��&$����L�]�T��.�;М�l��0�o��l�S)+>�JQ��E0dzY�>��My�_R@�@����1ψ�A:���Km���i�4��2$��>�}�3��Zb�t��v>��V�������=���1��L�%�̛�2~�wP�g4$�,S�U�o\�����R�'���k\��y�q#{�<�7��-+y�~�w�l���'Z݀t�����c-7{�}H{��,�Jm1�y�� �/È-? ��6�w�F�T�jnޙ��'ô8�c;�5y���~��oF5mEQqA0�#8��i2�k�~\���� �����IO��c~D���x����̏���ԑȓ�{��$�"�l?�0nZ��q��]f�j]B�=x��GަA��ăh2G�L�������Y���qMB���������� ��5x-���~�)�O�f;1TW�ޏ&So�xP�?_�^�9�x�.�k=��������]�`u���������i�:����H ��e0����o�Js@]Y�Z-9~XUo��,�ɀ/˵�Дe �ivy�f���I���X��1oc5�/rg���e� �4r�iw�hT;<wv����m%#����s���&�K��r���?��.��%�כ1>���9�mx2d]���E�<�S'82:0�κ��E�;��Ww�\X]����^MEmɥw�=�5^d���� BJƸA;�����]Ⱦ}Y��Y9��?��D�{�O���Z�sBȿ��<��i�x��/M�["ĎL�( ���t��z��3.* ��B�t����)���R��3ΰ����D:�Q�Չ��u�x�0/�^6���N1�ujI�]0J�Zj�o�zY�2'e��3G�v��w�`�?�ᅆ���Y��y������ 5/�}�n�;�L��Y����Jqؑ�k�ʐ�`��m��VPG�y��r��I pUHZ �L�~=������K1��c�y����T��f�;f�����ɳ���3�+�Uv�,ڵ��@���9��ȍB�-K���8������R'A��f�r����e_q�8�E�K�Rwũ������Uo(��|m4t_ʢ3Ҡ�p�a��;4�����dyD��o>Ƙ/�j�G�:\�a���X�.�ʒl]�Ix��x� hZ�qp�$�dU���T�>���5i�`�i����=nSF�vpR��Hy�y�M;c������7�%�� u�����v��_���>�R�z���_ڨ�I�|���|�lP�Ѷ��b����~D�Ζ�U����<�����T$cu�����c*:�JZ�0MDr���M�["W����ý2ΆuV�$���eP�~�Ҿ;�@C"cShND�+ ������/�MM�����sr�qk��U��];��[�ju{�4�����Б\Z+`{���[+���߫�!lLOr M"����K��A�ρ�t�NaIϩ |�ٶ� a��ɂ���x�>Eӫ���U����ˈC\�I��H}Y�քu�"�$h�l��?�\�Q��� [��◼�.�YMą Mi�Y�3�т�Z<�z�J�x��_ܢ�0�ܯ�t���@jh�����7��Ű�A���֎a�t70�U��g�r�;�(��<�(���(����a#H�ud�= �PL�W-��砃i���١0��j\d]^D���V�V)�/�Di��E�5M��"��V�k�w�a�����3��Ӄ�m�X��W(�Z�J�9�㻴&'٨iw��G:¶,_0P6w���M�;)�L*m2�fSQ:��S\������/iƊ��f�e֚��~ 4�^q�z��)��dZ���7�J\Ox�;���.��I�v��$*8�a��h5��y���l�]�iP$�r���-w��U�+��6ԃ�P��#�Z���Ҷ��@�n<ᚡ_���^�=�t��MlU1��wKN�:�3�"_H.9��<댓�tI�%�e����A>8�>���z�����8�_p��eR����&�`�h z�qXgiE>�e�p��Е��5NU�̻��7��_e�|69��p�"�Mb���x�W�?�υ'�W5Ԝ "Pa���:4���D�屟�C^�wc�NX�D�ܭM������}ֆ�������M$*�1CK*��kɈ ��k0j���7�t�Q5��n��U;9����������,��p� JD��]|���n�?���3�YAu��E��>��� ��6߉�&Hg��I���X��z&�IM��$����yD}1��3j�[��^�Zxw�F����R���O�`��[����l�? �2�`=߮��eT���X|G�, v��$�&�s�2�9[�s����6�G�иCSfôp�O�?F�P��S2��/�pWeNՖ���������{uA��������I��Q����ֆ�&����iAm�:���>�� .��s��2 ������`$�9 �z�&�N�C�(D�������U���O�-77A�@F���.�D�p�6#�D�̢ �AV���ʻnq�#�gD��=����r\���-�>��Mz.]�ȁ�B~�};NXA���Ҷ�3&{;�/�T�{p�o.��|��%�em����AC�����L�:�}1x�$�|� ��ET��ٿ �BӞ9�?�5�̙-����D>e�~���}V�b�p���h4����Tl'FM�=�Ne0�Byn,�^+�Z����>&oاe]}�#�٧��I^����%tT&8HSX���� X|��T7p�� Ff��|_w�����>���_�@��6�n�f��R�xZs�0yr��z�H$���p�K���o� l . �1#����D��%g�S�D֍��2��w&;{0�nL��:��!�Ҧj��3(��(Z���+UYAV��U �C��x?��~��!c�S�k,,,��A���~��V}��]�����/���#�� [����ӡo�,�h�Nb��$��؎���4J��B���A$����bc-�65��d�&����P�#��v��
Static task
static1
Behavioral task
behavioral1
Sample
848ae4158b1f4526da6d0d88e85838c0_NEIKI.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
848ae4158b1f4526da6d0d88e85838c0_NEIKI.exe
Resource
win10v2004-20240419-en
General
-
Target
848ae4158b1f4526da6d0d88e85838c0_NEIKI
-
Size
2.5MB
-
MD5
848ae4158b1f4526da6d0d88e85838c0
-
SHA1
ce26c9138c391782750cebe5709ea71c7558bc71
-
SHA256
df41d8d5580544eeff53d260837d65c9435ce670758dad8d509cbe2547c1f7bf
-
SHA512
09090f7ac53897d8f46afde3c16011ad64ef7a470cba7fc1085b4a10974818f68637dce74c0c633b07375a359ee91b901e86e2543adc4ee89ce98657f784f138
-
SSDEEP
49152:drsuSrYvE3Wv+8dx0hm3lyn+HZKymBtnwdPdyvuaxNGp7a6:drDJrkZnMm/w7oTNGp7R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 848ae4158b1f4526da6d0d88e85838c0_NEIKI
Files
-
848ae4158b1f4526da6d0d88e85838c0_NEIKI.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 71KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE