r��%���z���H �s++��`�PƋ���x7"��G���v�H��� Ha\���s�aVj��c��68��k�_pV�%�����G��p(�����_����1z����*o��S�\��$�}�$���\���}-���8Y �Nk?o$��׃L�ϱ����#�Qc�nZ&�E#Հ�!�؛��rcY:�V�,��wQ�V��d��*|5���j:�E��ZbAF�6�K/�����%���iF3d�n�(�y��S=#`�>!�AP5XWv��,��`>Co�@��*�М�XG����j�2���� E����ڣA�o�DJœ[ۺ}_��}����b��i��s�s]�A��Zt�v�U2m/����W7|�旯7��:^H������?K���H;�#|.�t�tE��t~��z �o�]+�R���(�ڔtExA~���A�<�R(��e�F�}�D@0�;CKu�� h<��9�����t��]T�����$OVQn|�C,O>Ѝ�ߧ�Z�N�O��As��=���PM�a� V^e@�=Wv8; �7@vT���SG[J��/���P �g����:_XJ)�,E�p7t@���Qqq?Zy���b��?���f���dG:�x:���A=�*�`��m)�_%��6;Ԭ�<\ ��BB-H�*+���a�}E�2�ߟ'�]*pG�`���+��B�G�,zY�.���*�l"~�B/�<����:D9�J9��&)�<��F ���.0�N2�22r�����ټ�yvoV�*��t}r��;�$�;[N���P3a�H���L�&��}�Y%��a��e���C��Eґ+�+27��Jl�V����p��b�y�k=��0��Jq�o/���)�/?���ǝ|���/,�����qgC�KCl)�Rc���L� fC�.�_�ѡղ��$M=����w|��l�l]�4��������ا�gb�S�v(��eU����r3�Ws�����HP/Sk�d���7����S(�h�[�;�~��4J�[�ح;�r� �8z��2P�E�p��gk�T���"Y7�%��n?5�)t��mc��\M�Ƙ,�/>!5�?B�§�^�j;��u�X��xe�N�t��{^�������@7W��S� �w^H=U4�(TD�v�3�T���.��dƙݜ%�Q�<˺ ����L)�G[7u��E�L͐P�s!����\g�m��U�����P��|ڨ�]��B�y���)2 ��B�H�+ؒ� j�z }�����S��>�?O�IY��h�U\T���Lt���Ҳ�����5d�1��ӗax|���c���F�R�YFK��~+T��8��XzJg� L�ml;�6�9Y)籸A���^D���!@ ����ם��i��N�a�h��uX�a��9X���B��z�������Ûq{�����{f��)��5�T^���6�bS1>,<���@��5 �xg��̖�L��7B���G�zZbP~�c�ZODi���n�]�^"ۨ�%�'�$�����ǡ~��c@�cQ��T��LΉ���1Z���{�Qv��|b�;�-�����m��6��ȕNC`I��>^�0nM?��q����f��G�9�0�ԠO ���"��z���Ztܸl!��T�tŴ��߂$�A�T�����ވ��!���Ew$�_��'����<C�t:���b��Q�:o�_�s�W��u��/�D���v��I�Yj�� JWM���[v��P�ɹ[�(��7t�Ɖw%�Cg��?�)����kvR��W���dJN �X6zU����z&�bw��5*�^�m��@�5T�6��~�R������|�a<7hNH�p�)5 �y�hǩE�7���#������T|�ʛQNo2�S���Ġ����}�59�ͭ�g�>3Y�l������0����G���3��>���~X�J?�!n-�S0���a?{t�����<�δf�sJ%�@E�<dž��� %��3��5(�����c��d@ �����������c�`��"%_3��:����7w�<���;��-������N�p�H<.��$�n1M�|�o�ҖwyIZjڜ�<�6`�����Z(1s���>K�ζA�5HZ2p��j4TJ7���DY�q;�������/k�T��a9�))!���������R��k�;נT����2\�����(W�����vfҔP��DI�6��{�*J(V(��K��Ph� �I��x�]�O��PM���F���?Pq�i�)��M��˂�������O��S?O�-�!���{sʧ� ~���/������paH��w_x��E���!�̴���8�n�h@���nݡ9ќ}�q^��� FVc����ұ���@�Z.�3(62�ZJ\��tﻡ;�)�2dy�`S%�����7�.��!�|+���A��?�7�fB�A�̓����JZ���i�1(�"�@�)<�}^����7[�����"wu{�2�P�f.�X�mv'e��kC�ޝ�*$����������Zևi^0����b{4CZ�����g�(�\fˉk�9duh`G���{fhs`4����������x��;�\��1��a�K�N�����ҡrWШ gy�v��%�*Oyo�^_��`#rmk^LSq�ee��)(1���q�.tɹ�����.o$���paW��1���4 �a� � >��1狩Ӻ�#��{��������̫���u�*���NR,���@�����v`b��N���W^�� :g�Da���gQN����E��D�� �,�AT,\��T�z>��xQ ��r� 3D������FHzX�2���=�M��|B�����"�9J�x'� ��$�*��-�jvK�8����o��?��|G����ҩJ ����+q=�/�h���o�����E�TIc��.؞��{�W�8���H�c`i.�F�(���!FRY+I�e�c��t��q��������$p-�N3��ءɯtW��q�l��͉�B�W�Mbq�p,B<$gy��7E;U+�S�>����N�8��2pK7z��%K��"����z���
Static task
static1
Behavioral task
behavioral1
Sample
8bc2d6f3e8ff875cea1431af24b297e0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
8bc2d6f3e8ff875cea1431af24b297e0_NeikiAnalytics
-
Size
9.2MB
-
MD5
8bc2d6f3e8ff875cea1431af24b297e0
-
SHA1
c2b8ab98ffaa5fad929d65e2aa637be7af0cdc66
-
SHA256
6ac00add568b498a4d418f28275e165334fbe2625b0da9f612ff48f05dde6980
-
SHA512
14f7ee976cab4061c3404dafba6c3e864e679bf940401d76d1562f18f2221e050aa98d8d755d52f5c2d0d3696e1c972abf5cec74f3f6435c476f45df42ae51d2
-
SSDEEP
196608:jD6FHh0ZJweP8mxNvoDEH/ZMPXubWZvjdiOauNIeSiCvh/9:jDSmke0mjhSX1xTQeu9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8bc2d6f3e8ff875cea1431af24b297e0_NeikiAnalytics
Files
-
8bc2d6f3e8ff875cea1431af24b297e0_NeikiAnalytics.exe windows:6 windows x64 arch:x64
9f5f89652637994fae631352e89fa271
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleWindow
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertFreeCertificateChain
ws2_32
getpeername
shlwapi
PathFileExistsA
psapi
GetModuleInformation
userenv
UnloadUserProfile
ntdll
RtlVirtualUnwind
urlmon
URLDownloadToFileA
vcruntime140
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
__p___argv
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-stdio-l1-1-0
feof
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
Exports
Exports
Sections
.text Size: - Virtual size: 431KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.c.R Size: - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.x(X Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.WFt Size: 9.2MB - Virtual size: 9.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ