� ��$�0�!Cc��X6��/����'KX���?x��!�A�3�Fk�^�9fz+WG��b����(�K��֍?�z��YWm۔][w���;���jw���s���M�gF��D@��r�ӱܨ� 6��}[�li�������v�H[r��w��B��������̧)��E������У?��7�+��Q�tq;B��o�@��E��w/�t?���Ⱦ(Z8�՚ɓ~5�O�3�AM>;�:���#����L�j@Z"��B�Y.f����7Q���� �� ���7h-/+c��$�C�ET���Ç2>��na�d�-�+��h�b��xS��W���UJ�x�i�B�F��o�sՠ�^�ǁ�U�:כnv����L*�PD����R��C-H�I-��7^��r���P�({ ���C��:U�����i>`���&����"��nFg_�����i�����=��|-+��簈!���[���I6<%Zt�>��[���v�2d��[V��h_[�Q�k���[/�ߚ'��)>����& JD�j��eE<b��3�)߯�5�yf�5b��-�`=����Zw�Z�%T�Z���K��" o�hX�^��c05z�meֲ�U�Ƽ��5�2z�Ha:VK6ݚ��J���:�q';��sl�����$�n���E��Fa�� �����#UUѤ�@ZL��A�7]ʟ�P杒�K�\y`�`� ��4��7�����M.ՙô`��`\L��0mI���}S�_���wc%s�<�����nO��,��$oC�b�A�3�oS����q��$��ҙ�o��q|?���A�{�+o�a���Y���k��ڪ뀩֍̻��=�"��sqHy���M�W@�*ް\h���8:�<\�r���l�%�&����2Lij���Vy� ��6�p��-ӱqf��\���3[cxx������lC�"�PE������.2A�J����H�Gg.�I���e�z�:���e.�T��XF����o�Y�@��Ԩ���W�QQ��_��}zA�P ��E��T��1�\�;V.�^�����{�K&[q09's����_l�b�D�^ⶳ,�u+P����v�:wbX�i�䠺�TWI��(��7����)a�������+\�ͪ8��&�-Z�/7s�I��B�9Q�$ I+�|�R����i1T0m#]��] �����Kik�� j�Ϥ<^�Z�N����}��έ�y�R0�7���E�lx�q��ΘD��C�;�g�� H�$d���!J���^����%�a���PN�K�+���{}Z�!籐,��Vb����<?efQ,P����=d!�e���+���BvX~*�����Vgi��9��u���S�-C��A�<�)o?8��b�e"le�<����ߟ������I6w&�*)�dx2J����ci�Sh86�2/a �*���g����j(e�t���Â���L�q��ݰf�/��//M����l)�g3#s(H�$f��L�uu���(3D�D\J���g��������B�F��"*�}�-_e�{UI���b��_�Ap��ml v���I噥;����-M�(�GwRL:��>�YwOrn�[�������-+pR�� �r\���k�������O�v[�p�gū��"�����x�a&d��o�;�_�� hg�����L�����p%LB�����q#�u9 ������hJZ�dMT�9;�w�����;���N8w��)��x f���j+���h�%�u�*t�KJ��y#'/R��H���YGS�f��1s����2� ��+--�^D���lZ ����T���Vx��\���2d�6�����I������AV� �?�����e��<^��R��6+"U�fͨ�GA���[b���l.���Y-�?WE��fRI����$c6�C���rε�F���4�b�+'�(�b?���SZAq��p�U��S (Ze#Q@���2t���q�dk){�� �R�L��W��u�%��5_�}@㋖}����er��@���zo�B���9����v��2��CK���~\"pkͣ�SjQk������������\����Y����N�{� � �J.�Yo��}7ZR���1鶺Ͽl�A'_�r�C�3]jF<B���pbrP}DzUޒ_�~״V/�ޟ�EQ%K��IՐ"�t�� �,�6�ݍ� (>�����������tۃc���g��LƁK�B�A���e�ޡ;����#?�[V>ޕ��"o?w�����'w�"�s��M�o�bz<ӽr���0Jo�`lZPpsO�?���smL4��]���� �}BJ[k��u�[�����Q4��I�7��:�`�K�fQ��~w]F����O�eDŽ�W����Ƨ1e&��� �����E1��7*d�����B���_9-Q�`�?����8�g &���h�Y�;�D�f)��*>�����`)�LnD_���u_��c)��m]?�O���5ST^N�0O-��������^��#��}�.��>�H�� l�8+g����E!�l�cy�K�P|��z�LR�K��F�``[uS�Z�U@�l�y�1���&�y��ĩ�"����-�x�� �q��Ҩ�>{?3�(�=�)�zz�5��ռ�{��GK�O�� C�-=s����\{�?���v�|�>�<ID zlwu,��Rco%�M��+�1A���B%H��/%��Џ"���=U$���`z��?b9e{Cl�Y�cw~Zlp�V� �A�y(I���⪿H�h�b�t8���T�,��an��r>�J6�5\�|�0GB1=&�3�g���9;)9�} ��f�h!������y狧��~Fp��q��K�>�����*�dńw�Kj,�^��Y�����Ss�[ �s#a�P����|\`}�bb�Q5��4���d�0w4:ԡ�`���ml���E���)o��YC���������w��T��ϼ��xT��%��#�5M¢���Ρ��ћ7Uᐞ&�%�Έ�D�҅>++( ��t����W�/�����N��
Static task
static1
Behavioral task
behavioral1
Sample
db72d7151357db8cae710a8263c0a1a0_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
db72d7151357db8cae710a8263c0a1a0_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
db72d7151357db8cae710a8263c0a1a0_NeikiAnalytics.exe
-
Size
6.3MB
-
MD5
db72d7151357db8cae710a8263c0a1a0
-
SHA1
1d1fbb33342d9d213cef7278416998983ab3bfde
-
SHA256
7ebdfd90f98c7317c6f2923c21222bf9496e2ed53076ecf37e7c7e108dbf3b22
-
SHA512
eee7dd0d3615ee8d52fa04e50672c18d39502da12f4ba94e0006b7d160588c2071ac455615e0416d3856ebb23e0d0e70cc4ff895594814bf0aa41c9638763587
-
SSDEEP
196608:swMJkXAzMa4n4QI+fCC/wDO4Rzq+aRJGW:VMJkx/nRrKesq+avGW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db72d7151357db8cae710a8263c0a1a0_NeikiAnalytics.exe
Files
-
db72d7151357db8cae710a8263c0a1a0_NeikiAnalytics.exe.dll windows:6 windows x64 arch:x64
3a3a8e4a4b01677bf70dca981dd0d39c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
ws2_32
gethostname
kernel32
GetProcAddress
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
mouse_event
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegOpenKeyExA
shell32
ShellExecuteA
msvcp140
?rdstate@ios_base@std@@QEBAHXZ
d3d9
Direct3DCreate9Ex
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmAssociateContextEx
vcruntime140
wcsstr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-stdio-l1-1-0
freopen_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-math-l1-1-0
roundf
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
normaliz
IdnToAscii
crypt32
CertAddCertificateContextToStore
wldap32
ord22
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 691KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fikit0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fikit1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ