J��A��(QV x9��*Ŵ�#k��1����Y�4������k��L]}\��T����a��� �l���z���ӝ=��S".��%�]w$��rd���9 g'��T �2F�l^�{�ܩ�Y+��fs�Wf!�O]���9���^�0Ig��.|�.l���6�;�F���J�|"8�0�8��fD#��dB`)�w��i�oT~� ��Y�R,�,q�F��:lt~��м=^�Tw�|��v�8��ʗ�7�Q�E�u�8�D0��]�n��h�1�0���6���lT`�6o?�r���Ϯ�ˬs1���!��M��jAV�c5ns�N�"�;��R�М��7��y<������Wx(]��L�W� ��@�F�_��������G�0��!���s�8"x&/TM^�?��ߔ������h��4 �t���*V�M��9é��y���"��8P�L�>h�,�E��"�#yfW��r$�1�F�\�i�����>]���%����pС���VP��QVYSr+�weH<Z�He��Sj�.��a�>��~F���ǁ����MSBH�܇T�rˢn%qGk3O��ԯmIE�epQI���,K�h��z�I������������ ��.5C�"*�'��\ET˧?؆y���z<�0�{��̏v>4�+k�I��e�^B�e�ꑘ��[Y"E�0]��y���n}��|�����b �=�!l�-�G����kWQ�bm�E�;�Qg��{�7+G7��Slb�6�k{&o��r��PȄ����kdX��<몂$v�9E9����Q#z?-$ �v%����A���/rd��[��s�bi�7�#�����NJ��^p���!��� �܃��W�C�����A�|*�j~��N��"C��{�SD��Cf���0�l� fQ�����v�}��CJ���uH��i|IƸ����6�.�L�0�;k��$����I��a;�O�x����i3W4Ļ䱌�*�ǝ0�X� ��p�W��þY+���/]o��VI�m��}Ϯ��\ꨂ���¿0�&$�X�_� u��mk���\�p7\���NP�h[RǪ�2��-�y�aR>Q��[1���3uI����w\�5�q:&�#B�C S��N��E�C��Y�M�)]�8�,:9�4�7�1��Uc1O�nԓ��7)f�u0Cgڪ�h6I�M��n*mz�>�fj�<67:��Ǭ�`.�����U��K�N�~�M���O��/�*�F�Q�ϓVd�.9k����DG�����A� f_��)'�t���15=���OVc�:����&�>��wߩ�lK��&�컸��\��Oՠ�����9��f�PX��[�t5Cm�ϯ&��/��˄��%7�ɱ����aYn�d焾�d2�Q����$2YF *��](E��ɴ;6 ;ᦰG��1ʆLS�������̙W�����Ti�� ���X$�AR��T� P��k>��d?��|rY��$j�%�K5��l�-P��i4��5���x�E�%��:G��-��eNS%$g+O^rֈ���H�Ҝ�)�⺾x/������aa��S��.�P�s������&��镮>E!�)�A�v������*QhC����JT�ѽK�q�g��5��p���,��9� MM��P,� ��c���4��tbE֍�� ��8䪗}�gb�`Q��vvƚN�����Qwwu�ޖK_c��?��ަT�|/���`�$���s�t�TW�=y1����<�b��b��&5�H�FD��Ȭ�{�N�?>T}.Q�hp�Ϫ�r� �;^�OiU�I~��U[n"E��J�z�b~�ń�I��W�8g�H�`H��V���@a^�]U7��" >�֣���@3� �[a0r�LU��;p:g@]�m~�_><j��\�IHUi�g�i�|��2A���8�oMqփ��J��3�K���m,�3�ԥ�ck��)�q}��̂n~]��/gM��=�8�e�����9�+�&-���9d%�;�QH��'���XL|/�Q|M�W��H5�)�V�."^�f�QP�"�h�94e�؛=�:���FD0t�jĄҿDn��!P�q���vo�5a�Ա�X�KC�d�$��!���,��W����,Ik{�>�VN��s*�������ً�N�Rg&��2Mݛ�û��4�9[�z��J|�; ���ܕ1�`�8|ϕ����M��mL�_��yZq����C�i�����s�A�DN�<˓̟d�0�=\��C��<���s 7��/+|ٗ�欗"횹�,�5�b��Ǥ�' ?A_9�m���Gx[t�,9�8��n����<rMI��2AY=y�y�/�6?E���>��@���2+P?�����D�d.i$v� ކ3k�\�4�+c�Bv��苔<�l��u�e^�Ð�-�������?�%"� Dj��8 N q����M3�i����S[K�C}�^TV����V��c�fC�1��s�ڤ�Πc9� �2��k��SAZ�L��3��F���eG���O}/��r�!�V&�5PF^p����E��!�n�!�� ;�Rۻ:,,�nz\�h��{>`��c�gkc����N�|��3i�(�5��Sr�p#��K#B���9Y������Q�c�3e3�)Oי�v4���n3�э����ڣ<]�h� ������b\u���]>Ӈ����h��#6����K�;�, h��0�T���%�(n�be,�l�j6�`��$B�YH������}�ﰏ��M��C�$�nɿ���p��2����.����6!ܾ�� ��1����k�\�.��(�pxE�-S +.�>l�"�Z �7M ${�>�>���l��,p��Jҗ�AV�G$���� j�8�۾qr�]����R��}T�z��W5�����ryɒ&��Sc�����@�������d�91�j8��n�iu������N�m��Աq'�+ ����Y�ކ��\x�px��Z.6���gA�����qV�B����N��y���P���ʡ����C�ݻ������v�� Ec�Mǧu�݁���4�7��ȹ\p3����c�O'G�����Y �:J:o�!��ӵ}����8��Q��1�j���sm�6Ŵ*R�K:��^pϬv�kT11��⠭8ֳ_\��|���5�t�����q��fM'����Lԕ�`(PE�5Q˺�"��s��]�m��|'�5���Kk����8w1��E�����9QA����_�k׆���`�J��c}�3��%�E��*�ֽV#�s���B�n���T�� 3"%b��p�ǷF�(��#��1ۘ����?�%_��M0�)��t���w��anF9��&'c�w�?��}�L�h�Ƀ.cG�:L:�,VkЂx�f��3J3G��BH'@S�����%ӟ"s��aD�=8��)��E�Iۙ�|W�GA��$+"a!� ��( u���\���Qr/2uȭ@"lVȤFm�O]7�i\l����� Ŀ����!��$�5?�j��X��I"N��@���� �6~-��;���+;�#����.���u���ۓ婱��ϭ¡D�YĆv����� 8���&��c��L:U[_rj<�e��)���Y���Y����'*;;������("���Z�r0�̃�l�f8
Static task
static1
Behavioral task
behavioral1
Sample
c4abe7b17a2786ebfa136766fbd71eb0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c4abe7b17a2786ebfa136766fbd71eb0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
c4abe7b17a2786ebfa136766fbd71eb0_NeikiAnalytics
-
Size
6.0MB
-
MD5
c4abe7b17a2786ebfa136766fbd71eb0
-
SHA1
3aaf94aae8fbe7814b23fdb395ee9927f093d7ee
-
SHA256
7e2e85facd23815e7c2b3d6dde3d4d11e8e02dee910c46ea5c415f78facdb005
-
SHA512
83992305dc1b12d6b85b219d48be8d1d9e5603b2b4dc822acf499aff7211db527fbd30826f2eab64481257a9d97ee0f70ddf9053d7901eba8b1605fa9a4996bf
-
SSDEEP
98304:WalWRgcAJQeeyi018vYTgYdUAFpsD9mLV2JBOMeYzuSybaFaog:RRZJQGiSt1UAFPhwBrPyXog
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c4abe7b17a2786ebfa136766fbd71eb0_NeikiAnalytics
Files
-
c4abe7b17a2786ebfa136766fbd71eb0_NeikiAnalytics.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 84KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 21.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE