`��r-�=��qk�.�yW:���c%̳��Eu�QDN�k��E�+�����qT�1B �� ��w�ڙ���M�l�.��o����y ��:c � 87a���9G�6�Fc\��h�|�E��F��%0]r8l��tF�����Qjd��c��b"Mc�k�Ɉ�A].D���3���[4>��P�����>Eo{M�f���0,�mS1]��R"�4h������x�q��L �}�\%ONhc�;���ؘ�ݮ�wR6��t���U[@�H�����ʽ��?����lRfH1��mӯ"��D`v7쟔��6'C]ƛ�#G�^����Np��t(���(��v6���UZ��2�f53ړӟ��~}�Z*�N�N���;��~Eƍ��N� '��Rw���?���ϼ� �8I����د�� Hʸ�8i�[�19��7�K���d���)����x|G��I����*N3��T����¬p}.iw��{��UX{�@㯆�1 ����'(��I4�}���rN W�N��ô\ �g��������G ���?�J5�i���~��Tw���`��W0�4n8��ד�Ψ�y����Ϟ� #�w[����c�M1���(�q}7�"�Bdc�?37 ��8�:���2p�G5��Э7�Ok�R�'{N��gd-��}��iZC[F��{�k�Nz�RW��8���������8�Ҡ���&Z���wO)d�xu��܆�~d��� ��)yX���:���K+��U��B��dֱ�`֊��� o^�bc/F� V������`�F��^�D���ӕ-���pm�[l���U�G�2n�H8�En>���w�}l�����O4���·*����[g�&e�H���tܛF�;��}.�:� [�#��]nR���K�!��kl�{+&_�8 a�$KHeoyE@�c?^�'1��b6G&��N��J�|>e<��*�}u�o ~�&�"����s Ϋ���cOy&[3�c�+jc�_+2;&t5�bpw�@qҨ�`�&�����ɏE����x��/��`���ٟ��T1��%���l `���A�#Xg���)%r����7,����P}?�0+9�tTj���D�dBG2@2�1nҗK]JL�(�h�vc��P� �tH�iث\�8`���C�\uS�h��\���RO`�G�ؐ���[I����t�p� ��V�O��2��z-4%���R'N�r�0&�t������Ǣ~"ɣۇ_!�61nÝ+b��eq�\6x���g��� A���a��3��7���lCYܐ��q�-RA�� �3Xgٛr��|/�GOJ�}�I�A�����\����I:J�]E�I�w+ Q�D��[ s0���;�-����[�����ا��(q���P��vA.J��� �L���4����?��d��UP<&Dg�^�sS�lG1�OK�ESJ�N[AT�r�S�;F& ������BJtTt����_�i�g�،eQe%���q�1V� P��C�]�J��g~�����"'�9J�\x��y�":I=��[Kv�U%�Ur�|^4m?w�<C���'l@�η�U#u�p�&u�Z5�CN�mT(.�i#G#O1i[��~#�;RE���䕁���s��#W���=%����*y�5�:�� ���J�ҞP�oS��.�������P�� ��k#1FXD�J����Pgnĵ>@ �ty[�M]�IZ���%z 4��|jl\be�JibQ��+*r��5�,әe?X�ڔ���{��x��NF�[�%�E;l��!H�0cnl���X�\��o�������?��2�#�׀U E��/�WV��� �IL�W�o��)@ް�wt�O��%��Igc��@t9�����E�>=�)�[�!���@���0Ǽ&kU�����V}�*�S�� �Rp�ߑ�$�;rJӹ�0�\-m_��Y��$�f�@��:ch�%jZ��gwZb&����� �� wǒ�(����g�h��f>6��?��Q�t�2��%UNW`�Z^Ў�}������wvE�z��͏���9�鈏�2�ЮqW��˄����\��!깭�(-�|%�����Ѵ�3�m��QK����Y�u���4�����#��ݶ���N� �^;3�K�S�nJv�+k�oZ�-}#�LG�Z�R�#~�y���i�o�#ܛz����y��O���%̷ �����n\C�D�hr���=����F���~����!ބ��I"��=l �@���E}��Ch���e?8r`EL��L�?{vߗT��4�������TKn����|��� �o:��:��W�.>m�`�G��?g��� ڭQ}�u�WH�Q��% ��H{�]j�f!��S}^'�����eC����J<<j Ź����Qi�Tߎ{�5GL~�?�1��\�ҩ� �ml�|�#���|�G��E��l��c�:�B7��\��� ]�q�$��T��{zU�k5����?c�V������E/#�i��Bd�F51�)yǘM���@4����4��9 �=�L{�jWy��㈶b����<J��'at��8Ѿ���h&�.D�Ъ�J��{����+?�s����`���*PӸ Y������C�ˡv^����κ$B�������B�-�:$F�?\VV��}�|�G�8f;�uF�+A`s�ؒ�1��s�|_7�������a_W�`�h�E�.B,Mc1�s���e���0>���k����B<�*3ٿ�f�bl&C��w}�=��!��a�!�l���I��Р3H����K%ؐ��V�+ }�UQt^�B���g|/�z(������ͅz�z�8����!�XͨFk9I`���L~uz�>,o�l�,sz���#zl�W��L�c�X2��ȟ���9�B�~zV�ǥ>^� ϵĵ)ᎈSh+q�̖*��W�����)�u�5qo�<W��c_��z�2��Q&P*����<� st�'�2cw�Ƿ�n���;�p�����pg#yϭ��VNӜ��P�.���5VVTEPL.�b�.��b����e��^p|־��:�Z轑��U�S�م�Mk��8���7�TJN�"$c��=NG�%�o$8�@�
Static task
static1
Behavioral task
behavioral1
Sample
3e2c58c434206bf9cc3d9ef8d7dcab80_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3e2c58c434206bf9cc3d9ef8d7dcab80_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
3e2c58c434206bf9cc3d9ef8d7dcab80_NeikiAnalytics
-
Size
5.4MB
-
MD5
3e2c58c434206bf9cc3d9ef8d7dcab80
-
SHA1
2931f88e45e11493393c3e29ef787a0667ae72a6
-
SHA256
beaaf25f2241195f58c3c6f9dd8ed38102d92988bebcafa84ac358ed4d7cf253
-
SHA512
68a3d545fb649bc3061285fcd43f1a75b9eaf54bf67b0db526dba1f2e51f754847995fd58dc5cd0718aa2a3c5e3d7a2df74c0616d029124984320feb49fbc135
-
SSDEEP
98304:lgqHM2TXnHQm6xFa6IDLoyENdq4Dkpc9Ru5Af9fsZUU1KWgi29YtNf/t7Jsm:lgqs2j56xSLJE7Duc9AOfsoHYtBPsm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e2c58c434206bf9cc3d9ef8d7dcab80_NeikiAnalytics
Files
-
3e2c58c434206bf9cc3d9ef8d7dcab80_NeikiAnalytics.exe windows:6 windows x64 arch:x64
f6cdad788305f1bf18270dd076364721
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
IsBadReadPtr
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
BlockInput
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
QueryServiceStatusEx
winhttp
WinHttpReceiveResponse
ws2_32
getaddrinfo
crypt32
CertCloseStore
api-ms-win-core-localization-l1-2-0
IdnToAscii
wldap32
ord27
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
vcruntime140
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 482KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.neutron Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.neutron Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ