B��g�H�(&��!yqDv��jk���5C��Z���bK���� ӕ�L� #``pt �.��^��`�?��drt��+���$��L]|��bi��5�T�r-�>�����G�1�L���#��~u��+T�\j��j���D�P#2J@5R �������x��{{߄��$���yJ/������}2[,���|a�L��!��p��ă/͞6���\�p0�'���hͺ�ux����6�������9�n@��g\�� �9��i�����3�ۮ�4_��ş7[K���-d�U���A$�R�q��q��rU��"8>���&�� h���ӂ���<�-'�"�2���$�>%���/�6��"����R�� ��h�� '�!��Ă��2l��B\��1����k�L@�Q}��e�XK��|��@������*\f����ь���������oZ/zͬ�I�\gq��`��.5��їZF^f8sy/(��u��0��T%�������`��u�/�HW� .#�@��K��}�Bq�EXӡ����%���'�� hg��Z���� ��Į�\��Ě���"��H&,6��ne�'1�X�,���^�B�R�����)��`_K?M��%C_pR�s� R����Eߓ�Rb�)/c���&ۚ@Z�T�!2(��0���7����q�]ŰW��]1]���T��OJ[�b 1xw|�P7&4Z��8)3��t��X����P��3��7�č�kZw�O�c���)�~�%��G���ު:j�A�V)�hI�kw���`�����W���07�g��j\�`^t$6���*TG����n�1×t �n��(p\ ����*6����NG��z������a���;1.�-֗fnO{�Gp]�#�zU)RT�lY(�#}r�7��C�c�g�D�(�Xk�����r������}�O�ܐ��<Ek�2�%�b��1��j�O�#w ���`}�x�Wi�kj�G��v�ɰQP<.��X>4 ���F;�j�/��S#�. �߁�ov͙��FYP!��"��p;�ѿ�#!� ��zA`e���\h��!O�q4m߁h�O�?G�L�V�b������a�)�*��S�0�[�_���"�Ō�G�3���RL�uYҧY���, ǎh�T������:����Y�毁�p0��2��zjR��3�wj%3yt�W!�/8!DŐ`��?��h �N��"��V�g}��QyBX�o5��}ل�4�ű7ݠ��.j�1�+T?�$�����Ӵ#���w �u���]6$E����- ��0��[�2;��M�$O5���0�O���d4�.��n�P��2]jH�.� �(}5�M9I�E\��a{~���v�J'����r�ʔ��mt-y*jq'X1�ֈB.I��i��� uv���13U8X* s�in;��P;d�����3��Qg�D�l�|\�8wE���FSȠ;3��͝ ��-��I;f>D���3������?PP��4�Mi��� _QR�����e6{��"ʜ��n�� mƀZ�h����W��.�=$±�"^ËKu��9��y`n�oyqe�����e"����B��HL<� �l�h��\Z���ix���A�\1 �(�(L�P�����#�zY������(�\���Z�����2���3�`6��5,(����2xK�N�a�Y �(�qGb�i���9�MۦAl���+2���"z� 2�������R~�DR)O&�S�!zHe����_]L��{�f�Md^����`m�T��X������O� �Vۢ-�~�=������x�Ŧ#$(po���qM���3�ޤ ^MP�@AŇ?��g��n�H�.y�qs7����n�?[=>���?Z�BY����q��ݔ��߆8K?Zz#�{ǛЅ!w��'1����(�H�gЫ�_��l`��m�`������?Ri^ _��Ɂ��3�ڀWl��.�e����cÍz��u�*+���d�qj��Bi�4@K��'��SX�To3h�� �]zi��k�l�AD gA}o���Eӡ�p~�1�e��J%�C����?���� �&bH�.�^�Wr BG��5W����R���LE,��%�%�A��1��*���ﺄ�!un�o2 Z�!TT=�~�1|!H�/��I�u��N��4חu�Kg�f �мj\5E�ǤI���S�9��$�$m���龅c�V��I�3]q@C���g��Iջ�P!�o�Ah��8A�ƶ�[��M�Y��t��$lXS����;�6_l��q(�c�>ai�/�H��UP�IR6�A�\6dInx�����n�+��V��\���Eb�u�tS�����Hx�<8r�E�k`;�L}���Z�:�v���L>���k�v����w���C�47)Hn�1��t%:W9�67 )k_Duw$b���8f;�6o��{�H�z�����v�������Qn�7�DjߚT�Kk�����}��K�"�(${H�Ȝ����Y�O!�é�Id�/�bU���QP�����)V���������܈�}����鞟�U�{b{�J��[��oB4�ެhH?����;1��oi������-7�~NC,Q�4��c����:D���/��8Y�so��A���W�`0|�9t*�*���Ib=q�#�eB#�����"����_sH!Ž�^������#e�7d1*.\"\>�&�8jl�>)�]��}�h7��~��"S��V�2y��S��zy��092� cJ���C� ����}F�'�$'I�aj[��LMMD���4�dz�![�=��X��)�/���۴)ddy͎�h�a�Ƴ�ۥ����(��2y. �g�8R �s`u��[g!b�f벞��M�� ���)O�mX&a$uU��j����@Ñ�>]����$��Ε<q$����C2�7�i�x�G�v�.a�m'� �?4E����V�����<��-�<?��!Tmvכ�����65�Or��@���w�*��%�$�2%���������� ~�lp]h�:��J� �U�\�PR�V���3� ���G�s2 _���K
Behavioral task
behavioral1
Sample
3cadb7eda042c61519fcf9cc013b9010_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3cadb7eda042c61519fcf9cc013b9010_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
3cadb7eda042c61519fcf9cc013b9010_NeikiAnalytics.exe
-
Size
2.8MB
-
MD5
3cadb7eda042c61519fcf9cc013b9010
-
SHA1
ce1967a53d48e4866d66b07a6f5f64dbc99dc2d1
-
SHA256
ca0c90336ada79ee15e012fd79fa19d18d1de4d3acb31f64564b4a27d024ad5b
-
SHA512
a1b56cc89847d761840158018a15ef3a73ea5960a3e8c06a4cd7cdc493962cfd3a8ac29ca76b229fef241d7fe4f0e4d26f9dfe5a0b7a4ca3d7c8761f397a4a55
-
SSDEEP
49152:mtzNIkXanIO8aoTZVB/wgsvHl9rJarEXwLoVDxDiutgmC03:mtzN/vfagyLX0r4Riuq23
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cadb7eda042c61519fcf9cc013b9010_NeikiAnalytics.exe
Files
-
3cadb7eda042c61519fcf9cc013b9010_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
c504dfe091d9cdc6e459c160c8cf3b18
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamClose
ws2_32
WSAAsyncSelect
kernel32
GetVersionExA
GetVersion
Sleep
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDlgCtrlID
gdi32
EndPage
winspool.drv
OpenPrinterA
advapi32
RegSetValueExA
shell32
Shell_NotifyIconA
ole32
CLSIDFromProgID
oleaut32
UnRegisterTypeLi
comctl32
ImageList_Duplicate
comdlg32
ChooseColorA
Exports
Exports
Sections
.text Size: - Virtual size: 831KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ