�ݣ?�� �ˮt���.�ӑ5>�I��v�.'w? .ޙ�@B^/h u`�[���y0*S3'.�!�}&�jH1`�k�5U]㕰"�댽��-m�L�\�6�0\���5�j�F�<NxyB)�2`OI�N�-$[m��l]y~���~[W�Wk`� =�V4��r�Pe�L����w�~}����s]��3���NVB��K�ziڟ����̒�D���sSR�&�C,��\;�k�3�� �IÁ v���FĔ������:+�f�?H~��W7-bP��%@����"���Nu���s���9�H��X��~��a���r�w) `��wKS�;OŲ*3RT�Q�w��mjPgD����Ö@��놡���H���C�SI� �M��G9�������x>��Ʈ��<H��~X���$a��\;V,��4W hת�Y~����Rd>X,ğ4hZ4G\���O���^��F ��������d�'����rH��5��?��?ʲ���d�s������̀=�3e,,�=wc��p�xJp�����2e�#�ډ,�C���N�EI��'Q�|1�"_F|���y�pYf��+�mLR��QI!D.�:g�ʶ'/wq���=M��y�=k �x���#�S�p�+� ���V�>aM /�s��FK��8�$lb>���,|}�b���CO���U�L!��AHS��+ ��)-(�5۵�?n7s琹�7��ש�s�&x���b0������-����șr���(+b#ȟ:�����I5,>g]�Z�j>�\Oes~��u`X������Mk� �T�E��a��^ �� $|V�>��מ�����o���?H*#�;!�hlI�6/���ӪR�0t�'%�8 ��<��B�6 �����/��85yAb�� $��& �HU�� q��I�M[9����B'5���*u5��*42�e���X�!��龗`�gܩ-��d�� T���}�߾%I�!�=-%��3\ֳC�J��=r,Z^Y�D=��g�O"���:W>.�l�븊���N�t��o��NJ����� �J*$��r�HO�oz��[W�8��=�`����=V���8|�N�R^�|:�~46�4��h�3��gkY��?�c1�Ǩ�x,)H��) ��i:��nժj��z� �Vl)�B����m�s@�ce*�SW���S�Ik����1�TUN�<��4�Y�� y��a���h�����D��}�g�7��v<�����Q�͙����oqT�3EA݄�z_3���+�H:����~FdB���Y�ż |2C���6=��`#��0�� � �ڭΓX�R3ն�����:#����X��o&�?#щ��j��X0}�W��)�}n��x�����{���Ƚ���g�7?��k`�癄����B]n���uaMʗa��O֎�Ւh"A��#tm~���v��3����|�fXA9��*9��=���LԀ?g䩉iX=*�������X�n��Q�C0:�7��61Fi ��o�[#�t06hl7��m�ۖu�r.&�Si��j<<7R�Bw@5^����wgW����d�.�p<!+jG��j8����0k\RĈ��x�mJ�{�: 1�3},傇��M�ڀ���l�;����4�F7$��0��� �u�"�,���\C����u��s_ ����H��Y�_ܓ��]���n7'��| ���X�~!t�0�g�a9����L2�g�W��,T9E9���|��Щš����� 3�ԩ��\�37�'R�w�h���a�?Ĺs�v�>b��[vw���F��6ΡU�Q_�w�1�;��VwJ��4��X�K���F�V.y2x�������L8�l}2"c�Ңk����M�0IZ����7�[��v�r����Rxg���{i�|3������r�!r��!e�x���o�P�&/v)��Z�[�V�z}c>YX{To�� �y��������I��gv,�ME�U���V� O_�Tn:~��)�<q� ~P��6��,���S���ʋT&dow%�cxdYX��n��:�R�y�����D�������,}����.S4���j�4�ק�SA���.�vHZ�wq�,�קa��c��#���R�Kzր�����q4�'���n[�k�ʟn���u���w��X�����o��O� �T�M�7<C��N7�;ٳK��:���1���7��*��a�ۍ����N�#XT�U����hWX�����@y���B����.ּ�9����|c��f-�2�#����� �Cꦾp�E5_�)Y�v�X��l,�C�ø{��o}fY��?����+p��nM�����C�Z��s$����v�����U�x\��2`p���'�t��#C�|��GסÊް`«i�f��Ѳa+Q~��D��DE�EXNK3G]@��A����f @�ک��h�&PB\��� �Zm��X�DF�.���V/���W/��~� ��U��/hL�T"~�1����K(� ����7�u�a ���H�s�ٮ��J��̩��o[�n/G�~�(���\�y�4 B�rK���Y)�fx����=o�'���������Y�2&G�`q���x���K�}�@a?�8�����i�Q���ϝ~�xy)�v��j��8d�De�d�z<.����5�V��Oh�*<\��"WT���C��� �S��ߔ-�� |����#�B��ۚ7l�rM�M_;p/~J��S~�\?,pG�/id�gN�mO����.8��Ӵ怔�Ԗ�;�їc�K3�[���>��?Ȩ�q^.��A�K�}_>�M$a���k�Q�!��o}��^�Mi��^��d⟍K�b���X�' 䈐N�:Eu� ���7b���El(ܿ�����,=/X�S5��0�����7S�/��x#M�́;8T�a/���@ ��pÒ�ԃy�����<� >����!��O1�m]��M����&候4�qN�D)��6��> *��ctYv.�[)ħaU�/�SHG�Q���s;�������M����p�]Ї����|��L��9��T�VA?��U�{ep.�߽��-<I$���}z���6��F2J�����D���|!��.�b�x?��X�{͍��*�`�x���SQ�)��2���R�7���G ���������^� ���%��;�n)Z_i��۶�0"D�����j�����Dp��0�Q{<<�v���KT�Ck�G�N�������B�"��R0�I��j=%Uy�����Dc�+Ԝr��daK�tdOB�cl�W� �� ̮I�p�<�E���>Q=�������7�����[�bL_
Static task
static1
Behavioral task
behavioral1
Sample
977b14133f2e843cb9bf96509a6e4b50_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
977b14133f2e843cb9bf96509a6e4b50_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
977b14133f2e843cb9bf96509a6e4b50_NeikiAnalytics.exe
-
Size
4.3MB
-
MD5
977b14133f2e843cb9bf96509a6e4b50
-
SHA1
650b980b674acd298eee2995db8b5a21fe86328e
-
SHA256
c0e15122b358530fff53990651e7e19357d2af4f1fc2d27927de26c41ebfbebd
-
SHA512
77e56fe9a8cbba1e2c1f8883e1cac7d5d0883535f5f8e8e8f8fe976caafab2b7ec7d08e680e22d65dcd981d4c1a1fed97ef48db6e5e04426f0759aad5039fb45
-
SSDEEP
98304:wfLfikTg7AC6TPsQFt0blU/r+qqFSYxJ0UXsIY4z+qYxRK3UIruIb8d:wfLQFsWmzj0SSKUfqxSUm8d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 977b14133f2e843cb9bf96509a6e4b50_NeikiAnalytics.exe
Files
-
977b14133f2e843cb9bf96509a6e4b50_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 46KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 66KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 15.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE