{�k���v%���Z�9I�umV�*��:=�9߾x�=������(���K�� ��1 ��+c���IJz��m���k�Z/:0�6�)�=�Δ�ӹC�����o���/���f�!�!�b�֊���I�xi�!e�IJ~˯A;������MYsV[�2 ̓W $���fǰ�t�u�Q��CA���^\Ѓ�\��i'�#�D���8��c1՝@���L�]t��Fk�Ӕ�}��s��a��jA�l��i|U�C�낚W ��6n)@�Y�fW�����:�ș���J�e�(�1c��d{�����'��v��>c(F��xYzȟ�=���̊㚂h����J��2z.43�]����������`�bN}6/8�+t���梮h�j+�6<~�9���c���m�� !����q�(�d���*]�d�Ï%�3�.��*�P�t1�h�2�~����|7{ut0�����m�� �1DRL�lZU��+@�"6����l[���}�ϝ�#H��ު���g`�ȗ�_���hI��4�!�21U�]��!����6� �`1��֠D{E��)5`�N����&�� ?��ؓ�o����H�ˊ��zP�^>�2�ڙ_aω��������2S`l`����=Z(\��e�-��j>�@ d���O�����P��� ���a*��yl����;�K�k��c�?�S Iʎ+�T�d��6쟸��pŏ�K[8 �ݦ���/��3��Y�Ҧ)=):��*�ν�;��}�b#�J�S��|X+F������K}%$!�_ p�Q ���/�bV�P�y� ʓz�[i�Ri�� fB�k�����t@ H�������M�EX�* �N�3C���[�"��Ƅ��������X��^UF�tQx���w��S�v�8������rjc=f���O%<�ľޛw5 `Y����u.y�����iªT.d���.K�<�첚�n���r��m�{�a�[�I9����&�3m����9�����J̫�!��^�v��5��J���jY#�P�`>�'3a@�'0��Pl��<m[��C�;S�_\ ��%�f/K� �J]���Mb�re�ޘ����W��h# N������8�����rP���5�C�}W����ĕ���3��u�_�� ��@�����S6�u0(� �2��������':D�`��d�'�J�Eeo�y����u�m���Ԍt�$"��ԯ�'����ղ�Jua���Eg�]�Q�D2�}4n6����譿[ =!��/�%���2�%<�'�a����@z\(��|m�;};�\�5�jU� H�Q��G���S��#�-���^��-ͿC�tЧ��ɃpєD���XX7�V:�$�BQمʞ��������|��ߚ���� ���oGcxE _´L�� ̘X0. aY�?�N�;�����!���*�O/��T�ʼ�1Jɺ�o� �&��K�].1��r�<ꡧ��ms�o��)CG�C8�H�z-�,�YL> ڕEm,���vu"�x�>~��f��u��Dֿk�ɶ$b���E��~j)��P�\���z���ƪrC�3jie��6e���t�ڋ�^���1C"� \�J,��Z���0H~˚;��KJ�>�~��7OM 7u��=�d]B��!ü.��\d����4S��O��~;���S�V�mX�� ����ЦX� `ŋ�%1�27.Pa[��k� ����萺V��u����'�߇��[l��t��13���������F�%~в�Y�|��@q��͂#���<&�l=��Ѵ!�G,�ǵ��|8��S�_;hљ0}��kK�v�ys���Kz�����^��0 zC�����ʸ�oW&q�$���!���[�![+��`S��Qõ�̄��>Xo:!�tl����xy��3x��3̮`PD�-�~� �C���@[����������|��H�X����t�o,V��&��G[̪���fԻ��.V�j�K���0�F W��-��LJ�2�UduSX0hlj`�9T,�N��q�b�Md �o�Lw���E�|��bT�U:���D����Y��~q���vX�r��b�2ӅbtSd�oL&���~M�1S����L]R<�̣͋ܘ�I�� `!�"O��oi�"|�_���)<g<�҆�UxзH\��h��`t�q$~U$�J�h �j4�Ǿ�j�)kMh`���/ޒK�j�qֲ��gB1yk�d��o�š�ZG��9<��jE�]#��c�ف�$H���~eؠQ����!B/�|'�?����^��& ����:wLZ���=�YV0�n4�u�=�a��d� ڸ��$T�Ʃ��� |�.q�뽘݁�`vn*�JAf/d�sKm Q�]�F�ĥ ~��a�@`����Nwp���}�Ȏ�\�j9�H�8%9_&B ޝ.UPX&�`�]{s��=�U;��w;C�i�������l�u�����W�Ad56���r*FLw�S�O���@��TqQ�Ui��YA>Z�ț?-��Qk�-��<�t:�Θ�a�|j�f)u x�O���t�_�<�Z~Ƭ�k���`p�_HNW�`���_�YR������H?�j'���$�l�c�Q;�xS����%��|��#������Ɍ�*wᒺ�� ��X�l�\�dB^pd�7�Ŝ:�{�7(!Q�;S�J��W��,?�D�I�&D� �߽f��//л!��Sv腀S*(|ďŗd�)f5�:Q)eQ�gJ��w��^�6�n!V��zy��ɰ^@g0f�������6������躎zd�;�\�䚌��J��\ܕ�J1/<���`�ڎ���� ��l�L_\`�<z�ICWZ@h~���9��\�+�M�#��]r�WB��n�H0�ǺptQ�@����A�>B���i�E�g�m�KTC��b9�fTtt��?�TQ�r��y��e�~��s���m���s(%�D(�!D��mC����o3�� Ԉs�b΄O^ V��g�$�B���b�xjO�!P?j���N����Yk��-oA3
Static task
static1
Behavioral task
behavioral1
Sample
0777f968a92c785f71992faddce99f60_NEIKI.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0777f968a92c785f71992faddce99f60_NEIKI.dll
Resource
win10v2004-20240426-en
General
-
Target
0777f968a92c785f71992faddce99f60_NEIKI
-
Size
7.0MB
-
MD5
0777f968a92c785f71992faddce99f60
-
SHA1
c8c6f8ad7e5f09cf765315ea1e7bef5fe770cf98
-
SHA256
3696c3308cc042247d51215ad372d0fa52dc666fc37d073656e5594a94eab839
-
SHA512
08a564a1d3c23c9dd87e453277523ddbb84cec1a25240d971e59f786026103d7281a251021268a8ba57b281ddb96a51b10256203cf71a5ccfd9b3dc7d87e2faa
-
SSDEEP
196608:4v3zkXLXlZ3lEad7yqMYVUunFokuyYAIjHJ:4voXRZm87yqMYBRSAI9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0777f968a92c785f71992faddce99f60_NEIKI
Files
-
0777f968a92c785f71992faddce99f60_NEIKI.dll windows:6 windows x64 arch:x64
04129bcd1ef59221ac04f6deaed1221d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
VirtualProtect
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowLongPtrW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
d3d11
D3D11CreateDeviceAndSwapChain
vcruntime140
__C_specific_handler
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_initterm
api-ms-win-crt-heap-l1-1-0
_callnewh
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 149KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourc Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.detourd Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.1230 Size: - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.1231 Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ