��-��ڡ�D=���� �ϛ)�p [U|H��$L�.��`�J-:��@�A���%_T\Փ����{��1�V��S%�4#j[n�njk�z%�@�R�ȹ�̧��S�Ny�8l��ܠ�v�>���;'*hC�'Hě3��v WM�.��n �ą����Y��<�.����yK��?2�ݷ3�`���`���]6��wn�Nc?���[�>T��;8^�̱� G�N.V��X������+:�魁1ͤʒN���*{�2n��i&�/[��=�|q�W)�]�H����B͗B��^O�l��o/���ua�:n�D�O�0����)w-�E�N��:�|O4y�X� �|Tp4����81!{���V��)N�VCZ�^."�&�-������f����J~�gq�7���#�#'ΐQ�:{��Ч��>I�P�"�����G|��`��]*�C�����/�[�@a�C����ė%�:rz�>OJm���������l�$�?jL7͜�A�v�o0��XX���@���0�3 +'���H�It?�㇠H��8����y���e�L�Be�-Tjw�ln�e�[b� �O��B�6��J8 p���CW�W�*ɼ�d�u7͊[o�Y�pY����W�{�P������:/a�T�̰B�);�b�8�? ��D��|"�8>d�OJ���A(�j��4��;aV����יи$JTkZ'����j����5�b��%e�bH@Ó�⸄U8×4���iJ7�s�ހ��B�#�8�Wr�s�0�bu0�]vm�ꊅK�b�@�!�R���7g.��6rW����P$���w�|�S1`僶^7Hc��^>V���ΰ�������c��>8���(��x2�X_Ͼ^�o�&^wy����9���R�j��u~�C ����_�<���p��{��&�:�Z�j�D�/-5����;;D�mkM�� ���v��4q��=�s��1K59d,�D��<T�B���{�B����=���7��U�9��7�E[Z����������lPE-�j�0o��<x�L���k5���R�x��I��lW��Yq5�"��+�~�����r��WJׁ��C����%0�;r�\=:?|b�6��_�� H=���,N�-���J�1�^�"�~���!V9+��9����-������Q�"|R��B�F�����]n9� ?���/�h�s�V"��y�뀍L�$KpR�U\�z��g@�#�y��@Z��a��E��ތ�N�?����Qf����/� �iƙ�$Kz��s��l�[d��IOz'�F;*(v��(X���yI��S�4#����+9r�kQ��~#��l�97gs�Y�v%�B�0�SI>S�6P��5�3���jQ����?�g3����nQtQ�rZeЪGE�{ ���<���t���P'�]���`�-�=d<�[���cE�e��z����2t&��³��Q&��ll2� �Fja>����M��Jڙ�9��+/(O�c�_y�K�o��U���i5���>O<�wT��RL����0�P��>�rUe��Gp�=\^�VU���_�%օ��ɳ�>~��S����5O^���S�*��N����xcX@=ď���Q��&�����_a젠.u�(!�K�.�4J��ww�� Q���0a&ZQ5=��^��c�i�jCg�g ������� ��/+�m`��&q���G���xI�lOaS�s[��da��5��@H��s��� W�D�q1�,�h��_�-�籛H����t��U�t[ij�5���ā�XՄr:�__*�@2���8nGt�6Ru�e��ut��MP ��<]�$WE�OZh���h�1������A��'ձM�/ﷻ�3���^�9�����F��"�`)Ϳ{0������,�`��k��s�~+4[8<�w]Y�X=��N�O�vpːf�sG=G�p����0����������ќw|�QP��#�Rm(*�/��Pi��N� $����@����CC�i�����JN����K�N4�&{ ��T��MZkɈ�Z"4�4!~QGN8��V�� ��z���5RR����;�pZ*��u �ǘx�_��m&}����: _/ 0z�ܹ������р\jA��d�\��Oц�#90��ob2�F��z"�Q�&���&�?����@�o�"�)VN��P/��n#�/�����{��l��Q�bɡ�Kro��A̟�'�����P2�+�Ni�7iQ~cX�5Q�!��2}�(ڹ'3&W���1�|[�v�e��-����veQ�Ђ���H$�_n����P���i���� IV��`$��g�(��[�ܘ�|� /b'���"4�W�Vպ�}[Z�u�8Ӆ��W�b ��+M8�}9�MH��v�#�?3u�%��آ�h���8�!m�fYQ�{)ڿ�@UD�J���7�+�ch �T�m����E��Vm�U�(��Xb�+�����G���R���d�<�8-D���P���p�4�����}v�M�BJr�)�*��ߌ�.��6�ŕԥ�Lم> ���Tp6���*��@��ZE㴑�n��,�� 7+#u�M}ק��5?-䖛��#�6ݾ7�SInՖD-G��f�d0f��W'�E������Y�S�W� ���E������<�T̾� �=յ�����(9���M�Ui#(�v�7g�)�3�0jB��v��J�ϥN�f]o������Z�U�L�Z��f#���������!�E�p�e�A��ͼ���ʵ�����M�����}��M�/��(ڠm�k������5Et��.Y��#ec���2�|��RK�^�yMEP8x�8�\r���+@��Fa�)m���0S����3�E���./Д����5�1��U|ٲ��p�5ʑtx����b�Qڐ��x��U����r���6"mF��xa�U�J���g��^ɛ�ViVMY.�M��4��%3��M,��A.KPI4q�*����������5��D��:`�Qt��9(i�y�ȭ�o��w{?�>$l�%f�U9o~�T�����bPlnBS%.;ܔsqX���^�F��O����" ��$
Static task
static1
Behavioral task
behavioral1
Sample
41df90d37ef537811882af38128e4180_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
41df90d37ef537811882af38128e4180_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
41df90d37ef537811882af38128e4180_NeikiAnalytics
-
Size
6.4MB
-
MD5
41df90d37ef537811882af38128e4180
-
SHA1
774a5f75ac83800d4a20192c02711be093767dd3
-
SHA256
80ec8b0e5e55e9fc1a0406f354a9576f597c9a6886e890db56cadf82868c340c
-
SHA512
faf6b7604de0760a9f905aa55657811dcf3a717d44c1ea4ab3fef2180d252f4ba25ad6a77cfc9fc5272f2f09fb4313c6175051f7fced6773c5c2f686a889a4e9
-
SSDEEP
196608:pzjnkSVARVXfqHXrO1acbVco5SxrNWmSJkVZa:pzrkSVARVPq3rgxBMrNFZTa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41df90d37ef537811882af38128e4180_NeikiAnalytics
Files
-
41df90d37ef537811882af38128e4180_NeikiAnalytics.exe windows:6 windows x64 arch:x64
e2f96df1175ccefc575f9724291cff80
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
_LDATA Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 576KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 537KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
H8!UFULy Size: - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
H8!UFULy Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ