��Qdx�@{��������-Q�r��b������N']ծkn�����$-�`�|�1��"ZW];郁�PC,�K )I�?_����P�$�&2�5=�\�l��)=a�B���*����m�NL�čr3�Oͳ)�O��h�a�����y��:3bSj�'�խxj��%�:3D���������Ik/�yR��_]���g����f}~F:����f�T�.`�f�� Us`�T����t��G�x~HU�4�8/�@�=n���`�tEY��y���ٝWJ�l�DuA�<��I�j0|����� �ŝ�i4�-�����W,���P�ڄ+���|����3��A���� x�������kr7�9� �`~ʎ����R�O�d~��Rǀ}���c(��B�#|�Y#.R ����^X�#�R�ö��}�;P 'Î�U4�2(v�f<�����q��9K<z^� ��s^�|W���\(����cS�-`] �f���f��}5���x���+oi���Hw$�x�(Q���<Jڐ4I�^u����%�[B�Ssi��x�XHe�!캸b*)��$��_͖��ϖ�VR��9�����ɨ/�@K�r������*ew%��0CeF�a*o�/�ri٣j��a�D/�������M������ׂk���Z�lz�'�c6�%:���: 1i�U����Ժ�f�9��w�rQD�ڮ�A {.�!<\��(Zt���S^������k��ι�P�4d.�dr�(�v�Ԧ����ޮ�(��JQx��RRa0�7��ɓ��[1����-��^����Y��=���Q j��FY��;�.���8���رut��=��tt���h(*�Eü�Ŵ%O�5�9:�j��� 2� ��h�b5:t]PR�����p3��d7�T$�Xn_�Zʨ���yQ��Mf�N��<�K�gkp���)xv�w��U��� V��SS��k=� �~S$m� ���FE���s�[P;��;B��\����}���\=q� �Y���K9�1b��B��Mq���8������� Olqy�n�����~vLv��=w(p��Ws�\�,ﰎV�-~Lr��������TP�6��|�r���2�'`6�6J��:������"���8�WU�M2S�����Jf���� k��Dw:���-��ee��� $�,@m�f��,N\2O�=��b�}�2����7�p�<ȒX �~w��^8�;TQ:��4�����s!�Ѩ1ڟ���m2�֩ �b�Da8PMߵTA�,U�n̞*g���ѭ&�WO#{���D�]W�Q�$P9:?1?��i��^���!_���σ\E�U�����y(@Ea{���F����Sfx%���C�0'�P���Z�E(�X�������p�*�]�!��ݫ� Izۮ�*��-[�^<���:��$�F&��;g��T"�kO- ���Q���E�-ȇ���J�(j�r�{L�f�;.��&D&<\G���)�hU��h���D$��$�D`��L~��&<�]f�7n���#����D���iM�b$n@@E��_���� ��ʠI(����Ռ��KÐ��B���2Rآ;%I�J�\\6��fm�O�, p��OZL� \a�h�����d9ͤ�Ԏ��Ehi�m�Ģg���7(_�tJY�.�g�A�g9�����G��`��6��;_NA��D`z����O�q��y��OcN���0G�4E�Zb'��9E��3>`f:Ʉ�A�<�|E���-�E�H�A9F a��"f=$����r��,�& �a��9˺r���pzP�_��"М*,3 �5��Bv덶�F�_W����^!�u�&xU �����I�2[%����D��L�t��"�pȧ�ݴ����3E��d�?eB��L��Al���0Β(œ7_<:�F�V MH?J�it���f6��=ö���%{����=�����xf���H����:R�*��-����Q��K�q�:�j�0�������s��R����HnI����U�����1��gLV��J��jv��sӠ�y��=6!�������^&|���u/o�^_0.wg�y��,pR�t�{-kzk��#l�ۿH�ˏc�2n�$����Xx3)$h^\�}��2��i���㮕S1@�$����͒ސ�9ȼv�oM��I�b6���/��#ҁ;|}��nj���N ��:���JpH�Ӗ�+���<��hQY���(��AF��n}����w6�@��k��63�Q�(���SƗZB��0}r@�d3���T��oJ��wF�'p�ڸ�u�3�p���C��GvP���=u��['(S{Y|w(��=��AS#LଫC[a�A�QS<s�<ks!`�L�S7�*8��Z8y���!�]�g��v�����d$2�cZ����ljH�W��2��=�3oL����N��&�iP����u8G�-꿹�Hr(�aSI����h��I��:1�WS�Xp��p��������Q̂p���`i��z9��eP>�@�;%�B��:�:b@��kð�$���3��ec|v�Òא�����o��_�x�0Sx�ObC�����M��o!ݿ��`��y�b%���0�?�Q���Çj����Л0i�;5w1��-t��[ݖ�`�����,ɻ�5��z2T�7T�����7ڲ3~�uj �8�U1/=r�w�Z��M�1�i#��u�4<�=i���(��X&KT�a��/�f_�f �d������LC��/Ի1�,�f��f��}��v;^D��=����A*���(p�t�]A�X3��N�J;�A%G��Q�'L*M�����!H�3�oE�f������l�� sL��06��F�.��HYp ����4��ɿ��_�}�j���e�j���g�+�n|k}�:T����Yw�9��ڝ]�ʥ+�y/����v�YP��(#'�U��w�i[�Q�� ������#4��`�0�..)���X�I9�����9�v`��Ky��PF0+�l {���S�1.��aO���˲!��h�&��VD�����a��������a�O��ʡ ��0�s:�J%��¯�`
Static task
static1
Behavioral task
behavioral1
Sample
33ac7bcafa12d91733ffe8174dbbf1a0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
33ac7bcafa12d91733ffe8174dbbf1a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
33ac7bcafa12d91733ffe8174dbbf1a0_NeikiAnalytics
-
Size
6.8MB
-
MD5
33ac7bcafa12d91733ffe8174dbbf1a0
-
SHA1
951f7c1a8d8b18d1bed8af8ae340b762e6b5eac7
-
SHA256
01591ec1fef2fd93a7eb295dfad928a69cd35a78c3624c2c5f8120b108179944
-
SHA512
13e9053779c3a921b61eee2082ccae2c328432ddd207a6e80d3260db47ef6c342d5b69a68f4aa27f6b9338fcf90f5418f52f11255821d8ae93a3fa833fed6456
-
SSDEEP
196608:rJgGTVzy2+TJD9uz8jRE+96CjvLjDfw+nrV:r5TFy2+TJD9LjRQQvLj8uV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 33ac7bcafa12d91733ffe8174dbbf1a0_NeikiAnalytics
Files
-
33ac7bcafa12d91733ffe8174dbbf1a0_NeikiAnalytics.exe windows:6 windows x64 arch:x64
e2f96df1175ccefc575f9724291cff80
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
_LDATA Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: - Virtual size: 563KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 522KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
hXM/J<'q Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
hXM/J<'q Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ