��(� me��^� L�;4�.��n��3�Q,m2����1���w� y�5Yǻ�4�^�S��ָ!����< ��;ʘۋ���d����1��?�^bB���5�|�0��;Է����0@�T;���T��ݺH����>z�+s뇲3"�;a\6Q�-���%(�h_tW��Q�Fj�m�^='�s�����,&eH��A$+Ouy���k͍���ċogu��E����}*��8�R���t��s��KVI��jǷ�hb���&��K8�b\�o�i)��?x1��K�7±H����vt:hr���c�L�� 3���?���\���n4�f���9��VR�f�Zh: x��YK��ȊA�Yn��[��Ns$7�'׆8Ӳ^�&ARI�<���c�/�+�_7�Ï6rr�?�I���ɅC_��I���;`z��]��5_�m����3μi�?4�_����i�x�1��Vd�a�5����u��'xVX�{E��g\|]\����F���5Y���)�a��>[�p��2)# �@x�����������(1�I)�;<g�<b����Ɩ����k�0J�����x6����l5�8��L�OB<k:��ETu찅wúKڥ4麫9�������@�Wgb0�^��e�g�ݕ���a���&$����s��4 9a�&E�1�ޘ��P?��>���J(�P@��?O�d�?��6(�ˉ�٭v��Ƃ_����pQ�*�������LO��t�[��7�Et������e�?��R�5m���Dྐ;��u�� .G�R����}G�w�2�/� a9� �W�z|"��F#"r��.�d{��ijJ��Z�i��n��[U����\��� �������r�MxƋ����5O���O����j�:-���v�K3�JsvEE���A~E4M2J����2�]8Q#��gH���r����e�ɋ�?l�ã;�����_����}GD���,=4����26��q}l�jF��I$�Nܥ�te0�o�VόsGr� nX]��7\R`��c� ���)Y����M�<��$�8걻��E���Y�0`��ɼ?ڐ�7�_�^�����i�x�l�e�mE�Ղ��h��3����g�Cu��G?� @���z�c����'�H)�b�ݍ�i�����=_�y�})P�@���+�H�"��JޗE��M�G�$)�Vz��c�Y�Ms�ߚ�����zB�t֓����A�۠o�V'��l��K>I��Dr��>�@j��J�k�<���,O�"�䰃�S�}�2(6���~�d�3y&�����]��e��!��#$?�L1����V��z��?���{�u��U���6=|g�L$Ȭ"q!�.*uw��O9��r�8a�MX�]jN�-{�$W�����y����N^�e��x�\��aM禆��/��#���'w������@�jȨʇF���/�?Đ�A�V��??H�����Hs���"������g<��e$�����¾/�TF��l���@�x䰞��|&M�`V�J�����N0 st����Tr9�%�T���`�1LK�ñ[�a)^�s��p=�o��zh�ˁ�..52IG��mj�M]2:a"��!�[pYϻ�,4J��+��u�����eRrZ)Akm��[!�e!���H��P��[����'�g�{�N5�/��h��+�&���Lh��V��O.�� ���F��o��T�ʯwC�p�%���K�`%�'H��D4�E�c����Elc5��������8���I��w/��1����u&~9oH'�(R)�)�EQl�h�� �/��vb�� G_���Ò&��Цܲ >��/|� L7ԋ��ָ�Z����-ۑ�*����8�����/mB �1"a� (ʒ`i+���7C�5���a�����gώ'�+��>I���rK���݀�� ��z�����8Ox2"�Zg�`���P)�s�E\v|����l�a�V(��WPT����!;�9=\YY���p�J��G�'���b{�D�P�h2�D-��/��z�{�C��!cv��' ����+h���M��t��7'�7?��BTHǐc� NM~�{�*�"���SF_"�����*�o&Ɛ�X <�� Ԋ����X-z�R�����T^{�BwDFv�#$�t<DAI���7��zX�!�N��Sn)��h@5�2�S���s�|UB,��v�� �c�;H�7��yz�xo�.����Qf�3xo٢36ԛ�������*�6\�N�Rݱ��Ԟ7pV����矖�`�i��HT@ d LW~}P���E�9t u��@t���ա��:�����ˊ��4�ּf���cY��i��6�+J���M��ʁՑ�V��ޞk`W�Q)�1�K|�Z)5���b�T;|�ӛ<t<��$[�Q��ؘ�������=�u��n�CSI��%lc�8ɶb%}V�:�H��˸^�U�L������ߊԢa��I�i�v��� � �=)��2Z+�'w��� r�ؽ|�QR�s��;��@f��/�_���?F[�g�)�4}�(bO�/��/Dž�6v��A�q�щ"����0b���� ٲ;H�Jh{9֠���s����<V��8�ͅ����N��Fs� �s8��,���ߔ�ݜ����8�z�^�{�����B<&G����m�(X4�D�^C�����a��;����aQ��ڇm��{��Fimm��9��q쳆� � m���;�<�+1)��hD���b� O��k�F�>3@BVpm��a��[Hr����<Ւ�((��������K_��w��xJ��^M/���< ��?��`P2���&fH���&"�@@��z�G��P)��eH3��6�� E�B�MPմA��Y���i8���tT��,d����,]���o��Cp���@�����vN�;u<�k��'r�Wa�=����=M�Z��0�e��#q��Ї�b�+�Z'�avu�ֽ��|�|\��,/��.=�vZ��nV\�CQ�ҁ��U� �&��w���Qt�[�~2&^e�zz[�L�ݸ۶*�m�X�\�?8P��\��@��5TW�\�Jb�7����!������U��}�K�� f�{��:vg��ڧz:�9]9�͎�ޖ����O�q��A����éWv����I2��q������O���Pqk:�p���"f��0�����m##El�S�i��;�y�w�����V5dy���^%�Q�qZ�[q��s�i,Q���)��,�G�La�s���bh�_`�֍Sf�i�� wHr�Ӷ�|�i�O,��iy��~|���ʗ�Fb�:Y"'����&١&�k��+2^ Qu�U ��j��Q���E�l��)�4^�����O�d�d����߷��R�����54Xq$�z�L�3�W*6 '*s���#6!���=��V��?҇V�I��!;�~����G��{*9|Y&�q(H#velt�̮���ᔦv��|Bf�`U*.��Z~3<��0�0�0��!�X��V�U(�@�f~��T��TD�`���Ui��t���`�_����E'���}p9�D���n�U,��J(�\���u+��㖔��䢭ߣ袕����R�r��{�y�PN���q�� mq�B������d�-��隶.�g���n�9�;'x ���_W�~�Z��.-X���6SU2��
Static task
static1
Behavioral task
behavioral1
Sample
a841eacfb42a0a7f81eb072de0e60600_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a841eacfb42a0a7f81eb072de0e60600_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
a841eacfb42a0a7f81eb072de0e60600_NeikiAnalytics
-
Size
5.6MB
-
MD5
a841eacfb42a0a7f81eb072de0e60600
-
SHA1
9bd18c8994b2026f4d2c8853ef946551da5a0fe7
-
SHA256
6c141d291acb3f9b96c4c17bf816de11e81ac1c837a8211592b2263766b71ad8
-
SHA512
5fd280a1cd86cd8b6afcc8f4a640ab672cd50dc25d29f3d7162f02c915f4edf91cc5b51c06081b83b764ff3458dd1f20d13f45620984a31e6cede8fddb6a83cb
-
SSDEEP
98304:/tl6RwI7OYu3d/RXVu3o6umEofNiohuvuYAtmuBvy5PaoNDgx/hLsq8x5ej5b9X4:fhV3d/RXVu3o6Yowo8uHAuBSHitV0ORa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a841eacfb42a0a7f81eb072de0e60600_NeikiAnalytics
Files
-
a841eacfb42a0a7f81eb072de0e60600_NeikiAnalytics.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 417KB - Virtual size: 848KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 84KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.3MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 505KB - Virtual size: 508KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 299KB - Virtual size: 12.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE