��>��0�f�x)dZw���yҎ���� q��^�o��6n�j'9nv.� ��ꃲ�2���H�<���f�!W�w��nE�__��9Co���dq����G�|���'������N�Y1��*U�uf�@{�������[lJL7�4��_i�(�����a�(C�x#^<������C̩!Ïb�e���ˤ��v�9o�ػ&O�tw*�q�[�a�����ѣ%�|~(�$�i��`��wLw�=�+D��?��U��}��:ݵPNF��zo��pDN4t1�&��f�R��x�Ir �k60�� ����n��T'T`�2'9��>�}��v����n�3�T�Ǝ!�r�矺+PME�r�2�Q8����:%�IMC� ��aW">������n� 9��GX2C�fE)�0i2`Ը�O�5n�h8�DP�_&a8>3� �<���gX����x'������J�B�8�Hm�r>X��|�9]��� �\�J�[\!U���5�mm�44�כ�%��՞9j$NʹHi�/q�B>��J7-͢��`���<���zn���A��s�8����5< �J#�B+^,���Z�ʾ)��i7}��Fȝ��S�ݘ�6}\�P[@`Wjڳ\�Ll�(�^�\u��k����p���#7�Qp�Ci��%����~��К���-����;�R���L���QSqw�U�:�O"�5-��݇�����%�ۛ����Gͺn��~��$L?O]!=ah�T`���}y�!����)������2�cې�ٌT���|7<^E�����q3�9y�֨J`��k2��Cj�f����ݹS�e���>�:2@EO�·�Z���/e M���1��2��7_��+�� 1)��$%�]���?��!��D�pa2p����r)%�[��_C-՛�z-�FُI��a?�6�~��6�����R�OA�/YU�V�72!� \��cW]�6*�3`��}��S|�zI�:��^o�\j��f�8�,uB�O��E��gG��m3TY����n���N�p�{E�����Ɔ������B���ǖѓ�d�y�T&����'�0Bg�����y�-�zz���a��s��{i#x�G���9T������e���DX���1K��p��0��/���*B�d�B��uX=֏��o4�@+>�9؎�s�ԡ��o6SH-p.��3}���{~ݒ��8����)��?�Ҩ�X��r������DEeE�I��C!������0����{7��T�([��� �X�7��u��A��ᴗ(���R��ͧ85/{�3=,���}0�W*�E5 U��\3 ������w<5���\��z�$��� ��Ns6���W�5���P������?ch����[���Km�3�ٰ��h� ��[���`FHƷ��;�:P#�����A���! �a1��[s�s`����I���U�l0���TD�����^�����`���m-p]�}�O�-��"Y�$�"�=R��Z|��:����6��Z�j�wP�/���1�dg -�koG6>(�Q`�j�h����Ǽ$i���8�isG9�=fQY!���D��"k}�j?�N �����J�Nb��̈́j�(o��1��T��E,�ڍ;�u�SS �|�T5`�L���, ��A�^O��ѐ�g4SQB��C�����}�v�/s��r:���I��"�O�,Q����5@����,4������ 6�OċU�->G��R� �V�l{]�%�:��U�/� ���㙱G/���|`�BS4i o�)�0+�H�t��[�?)�(@�E׳�P�_�E�࢈�6<����&��?��z~D�� 7P��0e��~�9�$/��;��g>�a`�"U�fJ>�y,���K������{�b Z���2c��A�N�CS'� t8)�O$��éy�zK��m�VB�ʋL�d�B�C �iE�/d�k��ӝ�t���U��ЁŢV�#�6sF���sHR'�� �̯sªVI�~����v��>[Mˬ�G Ԅބ ���| d����hE91 �-w�<�S|� 6Ff��?��2�rJ�(Ģ����8�sҔ��1|�k�,��bq����k�����g�x�j�P��o)�5�<.��i�� ~Ҷ�ǵ���4��S��5�#���l�`ۀ���>��Vl�I�1g�҆Z�N���3\��������wlp y� .;��V�&��E�ZJU= M��T'c�}���W�;:�#�Y��}�+iɲ�0c{j��N�� �� �I6�H�L=�NJ�YOd̐]�e����!'p���1�'�F�MO�n.�{p,j�hb&�0��T$�*,mՐ� �[,��Uv����-��ҿ�'�^b5�� `$%�Z���t��_j0JMۏ=���e,�5^MW!���ަ�1ǡ�m-S���A��O�]�)��M�PQ �ȅ���{�Z�9�Z�;�e�q#��]�C8�bn7i�ej�r�06$E2�c����������=H���'ղ; 6=^���=�%��Ţ�``d3#-�������v)$��ux^2)�S ���m�Ӯ��6L�0~aA��}�la��ȸѫ�H���;�����t������wp�[S�Ƶ�+�� L�'�ݦtO��P�b��m�ȉ�ɓr�X-�w&���O?�6��gК1�W=�D�|ڸ�L-�4B��`6�Vn��ʺc����g �����xS���%�8���g[�j]z]~����_=w&�_��c<C_(?����D-���C�ӍHE6�Q���,�:�Q+౺�w�"R�e�0�y���r8b^�3�OO2T/(> �*���9M8r3k�u�@m�<���i� ?VZV��!.�L�C8�Q����E�)Ÿ�*����.F�n���G���.�:#�#'i�4[����i愒�����W����;�R>��{��8oڡc��i�֯suEwe}FG&Q�6��/_XͳT4�s�Pj\hk4t��?{�t����1J;����뫢r��h��W�3$��z�\Hf+��*������>,cn�S�gV�.[,d��c�m�\��&��6H��D DLp�ap�F8 D(��أ4����bR�T�_���T_WL�K�t�w��'+צTc�coP�-:�[jt�ق���ztƓ�ȩq�� �C:d�S^e�o�WV�����@0Y�hM��奆���1���>���"6�9���m}C�\<�Z�%���O�mUAB^x���p1��'�G09� �'����dYi�Pʨt�����}���=�t��A%bX�ĕU� ��(q�P�y:�}ْN�W8��?�����s)t���Co��"iu�w5�y@O����u:�A}^Zh����2��D/V#���C��u.!;�ѧ>`ßc�Cv�`���)!��v
Static task
static1
Behavioral task
behavioral1
Sample
17007f9ec95b9598f6cc86240f06c6a0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17007f9ec95b9598f6cc86240f06c6a0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
17007f9ec95b9598f6cc86240f06c6a0_NeikiAnalytics.exe
-
Size
3.1MB
-
MD5
17007f9ec95b9598f6cc86240f06c6a0
-
SHA1
49cbc91a7b2087e357574a84dbb182fd5343f6c8
-
SHA256
39f1798a7ecfe633d481c9d2418ac0e6b678b0c7f07b8813b5ea2f0522a2ab98
-
SHA512
36e95b36d97e39736399241e181026047a9e9357ee5098c3a5009c6b0b3edc32c50b853dd3186c0d0316bfcafed8c10bfd9f7297e323e0326bdc7efbac9b78e3
-
SSDEEP
98304:msMK03g5X4+xeIsGjtCxTtm3CS+sd94Nk3qJ9iJ76N:L94+xSMMJtmL+s93QsJ7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17007f9ec95b9598f6cc86240f06c6a0_NeikiAnalytics.exe
Files
-
17007f9ec95b9598f6cc86240f06c6a0_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 392KB - Virtual size: 968KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 252KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 44KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 12KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE