�����u,��� (p�gt6x���p��C7���c>������ w�E���^�P3��5�}�k�f��1n����x4����AZ��.�<�V����Б��z����q��La��d:{@�v�a<Y4��,Y�O <��ؓb�ė�Q�f4�4\f�5�0����jo���_t7�~�M�S�Nc*�)êC��pI�X7�{��|�f�͙�Z��t~��`�x������Fn&n�.\��a��"��Ի,�{ijco��p��gT:ژj��x�b��f�Z�>��9���V=��b����Uf���R�5��8�1��C�QP��^Ka�LD�3�Dث�] t�ܴ��4+��(5��h�`�9._6�[F�p�:g�l�N�/�\��c�߱?�����*M3Q�=$�zb$S>9�^P+_�v�����V����Z�9I��l��e�ĭ)i��6j���_��t�m�+vx�%�W�hr����ޓ @�4#Kُnη��I��UO=��+�Q�F+Ut���.����@.�NK;�>]W�V�%R(�!Z2�;-�F}z��N,UW���:��ӐܙBk�G�������8}z~j<����h�Q��߆�P�G>9 ���$@3�O9#kE���"k�����G��u�N�ԥ��R�}7C�3ȐDDN��z� 1�@�S��R��2)mB�ЁƩP�hG�J�8��;�6M��np*�5y=�%���C��O���~*�"�EL��Sk���L�9�,-�x�?�`�X�3�j�T%.����"dJu_�f�p���6� �\���q�Ћv�W�_4��sb �"�W�i���9mu�u`Z\rB!ϸ�P�CZ���Ns�$��%k�h�=�Z��c3�%`���bi����%:�2s��u��R�����Y5�.���eݣ��lS^�zǼ���|.Fe ��Q6/�/����Q��q�3�B|#��Jq�sjآ�y���y5YP��J�%#�ȌI��ߝ��e�{���:z��S8[��ə�!���`X��*�?���0��^�#���L�!'�{ g�ʸ�R����]���|�}n�@��<HOݿd�$�t� }-�N�n���p�,�P�-��f�}kr̀Lj��g�A�w���� �0Kq�D�M��^G؏�<y��,hx�paTBwuGHo��d�����[���J�);�?�i~�"���l�����9o�������{>� ��R�f�+� �AJ���Px^�:��̣�NA��^?�.�0�/��cH"�<�� ��|z�P� ��V:�wHn�����<wVL�w�a=�݈��yR&WB�$����ʜ��m�Rܐ�T�U��NU�>CQ��q�����v=��;��Kq�}<��G��|�H=���Q5>���-���-�EJ:��U��ghtɪ~�T����ƹ�e�ЍœVuʂY��� Y�s�Ȟ��3�q�o%+:J��v��_��S�F��TZ�]�X<�z)���nRV�Z�M<�NR5F������7R�P�N YoA$g���X i�Ǹ�!T��� ��V�0�?U��F����~���[Ɩ��pp����P�[��[��I�?���o����ґ�������/�3Ƚ� �n�GK�4] mY�� ���JQr5��/x|�� ����e.yZ��q�*����d�L�P�7i�̶jf��l8�492�v:�Ѷ��f+�}����Q 1�J8�(a,�i��N��"' �>�b��*�������o��Ø�jiݓ?@�����t�1;�d�@V�P�j������½"-��^�Xs�Q�{{b����,��j<"��{���� 0y��rX-�(���PW��*n�=� �a��5$�Kl�V<�����#��p���O�*�t#�<����"�JyF���ݍx���X�lL��f�UG�q�W�8����EhG����@��V�'x'�`��iK��B �HEf0V�\T��O�cDCw%� ���0�_/ԸI�6�\���<ݹK�� LE5�E��o~rLWJ{����秡7�?��Y�X8x�sV�r��MAc�EW����ZC�WQ��?�m�p���.���`�05����YVR�m�D�Z(��\�.��F���DN�]�: \���3$���J7��, �d�+7=r>h��B���Pԛ=i�L��C͂.V��`�O ]�9�tQ��8\�jv�;��Vl^�qq�(�i�`��4j��^㑔+m���? �7�VB��\�s��h��)v6>\�9�o}�|���C���p�(��O���� |$��~ �ݭ��E�,5m��^fx�dL�d�t(z)����� ҆]�nc�Q"�z{����c"F��؛�<��V"��:7�3����w�>b�|Yz�'m��[ȢfW�b*Y��nV{hV�>��Y��ӵc� �u@��t�F�H��ƫ�{���th8��m9a�=��`@1f��3a�rs�������vd��O�=�|p^��po%�� TwC���:.��no� �g��,XZF��,J�'�N�h�C[ � �Dв�$t��Q��f���(�� ٪R�n��Cߢƕ}���s�z��aR� ������q`Ez���~�m'�����R;��q�D��"���Ii��w���5ljb �G#d�32�Y+���F�ڗ�Ĺ9ٓ��ؤ���H����3Q�/+F!C ��j��Ȼ����KdF��g����J'���p��%b��r�b�y;A���9iy�A��H-� ����� �����< ��x��(���<lC���'0�����La]�a�p�6C��i� ���H�m_K'%���8�F�������O�~�[ZA�;��C��42ͨ�QJ��u7�7R�[���o�����N�Ҩ�H Μ������[p� �A�z����$������.5w!۞D���>��Z�G��?��-�z�X/s���I5��T������� D��s@Yxz���d�#��_�c����0���6�� "��,됟�2���Β����<�d9��'x�χln00���z�:4P����٫��`�ۖ&;uo���y�r�Kҷ���V�����2 =�d_���چ��x9��y� ;�{=˟��l~�=�7�Y���n|Z��ׅ����V�:�t^$��{ٖ;�����n��M��r�k���c'�=�*��������9�K�o�)�K�鏂�������S�z_J[����Pb���5p�����Q>C���������������E 8�(
Static task
static1
Behavioral task
behavioral1
Sample
05fd7fa0e67ce5a0b096f4c49ce9d8f0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
05fd7fa0e67ce5a0b096f4c49ce9d8f0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
05fd7fa0e67ce5a0b096f4c49ce9d8f0_NeikiAnalytics.exe
-
Size
1.1MB
-
MD5
05fd7fa0e67ce5a0b096f4c49ce9d8f0
-
SHA1
099b43f0fdb4dc33c5e7385e0709fb82e1f6f8b9
-
SHA256
7fae2ba82002becb164c613e9066f29729c5a8a69a7d0bbe3e6d75c0b52a35f1
-
SHA512
e2a7d7119bbb174183bdf9a73dbcb338ff235a8c0f3b3ad7853e222feed1a4ac87dec2f7c6ad5ce997a150f46f1d67242902ebec2ebc9bb1d98b85fe772f3208
-
SSDEEP
24576:alZY4bsPPaD/O+wE8GgWz6ie0gMjkLrSGtPYq:alFFDm+wE7gWz6ieZMwLrSGtQq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 05fd7fa0e67ce5a0b096f4c49ce9d8f0_NeikiAnalytics.exe
Files
-
05fd7fa0e67ce5a0b096f4c49ce9d8f0_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 13KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 27KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 429KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 604KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE