)�r"û9 �lN�f��t�ֿ���ٛ{}1lV��y�I В=?_:� �e��O�#Z*U&���څ��ǀ�5|��6;4M�.��T�e�b>+�X��<�bKX��bW��7j*��(#�Kl��]��Z�v�C�v���Y���"�K+Th���&5�g��Y?�h$�����t��ݭ����ZM_Lr6��tp4�ǩ�+(I���}�G�'��+���ؼ}ro0��wrn�b�s�Ѧ8\�+�� ���od�-ɖu-��犚����#�h~T�s`��l����D�AE��o���]��0�"��k��H�� HMV����<�tچM�[�KȄb��PՖe����g�M��M��� o��,| ����B�ԓ�G1=?�M�2����� � �>������[���:g8�������)��ޞf�P��H��J1w�[�IK$6�.�6��B����;�6� `kD=D�A�[N��5g��y�)���K�lʎD�yon��)w&J�9�*�OR�:�tbCo ������dHdH���U��>L�9?��ӻ������)E�܂�R��� �j.ө�À��i�l{���[�0T͍t&г�*���� ������!�B����Q��|�4�L�B�e���4�zn�^.>\�'�{�$�U/l�н@�p����dq<k�"��M_P����M�N֓~ؚ�og!V2����/��a�fŮ�7Uf�`��K�-�L�*��:��s`��X>d� u��8���9��]�q�C�^���9|t�y*o���o{�&+3��ϼ3����������@(4k`[�]���<���IW,�B�D�0��Ys�[˹�D[�[��ˎi]L��3ͬk�Ŗ�%��pE��u��D C�d�ᯱ>䪓���y8�N�/�&R�E�����{|��X���g��͓,�"c����bESR+�s�����:�ˎ�p�5ܑ��i��~��j�FS�z-*iV��4f����/���XQ� gl�Ӹ]��$�xT�|RW*�⸉܂.豒�{;W{kP���4`����k�|0#C��\J����C�Iu�������j�̐7��&���M(�����@��%7#�F��_n%�� N�T91�k��������E�7���3�B����L���j4F���������VQ�l��z4��\h��ᓝ-�C��}l�z�7^C��G8���F"55��ԯA�8�e��������!\a�,\���sޠ�^=R���ri�L�M`�����_��νfWv��s�K=��C���k�m�$G/���@A�c��c�K+zm�J�6>!j�L�*v��f=�d�&��b�r7�,?��LurcA�4���C���$�g�︙w�����x�����iVě,q���w�/M 5�ca�̿t���g㴱��1i}���v��Wby�H�V<'��JvJ�;Zk����-��_�O�U�7�����N��S^P=Yǒ����>�K!��#��:r�y�Ʀ�����-���2L��Qj51�N��� ̆���S��D<��ǥ�ִ�dmĂ����O�ƝƟ��l�"NcTx�~�}��J c�>�vXY����ϐ����0������O�?��Ela�'���w��7/{;!MU-e��uo�BGFܝm7~�/��S��*�}ʊ�:Q��6�v6 ��/2j�U}fz�o��'��1�P�K읈�}Ia�u��#W��N�C"ٍxZ����C�(|�ҐFߓ,�|7tN�#�4����m��N���+��4�í��CeRYa���"����*�s�ȷ��fJ�I^lo��l{�~�@�P����/,2$f�&�Xz ���a�����N&ǐ�� �=�ƕz�X�1�3�9�}�fG��]��j���uOO;p�s�ߵhw(&�j�i�%M��g�܂��>�e�ҡ�rn�R�Ç��F�<�ǹ��x�����ZN<������ۿ�X�Y��t�� ��xu ��1%���8���~V@������m�#R�Y��V��B�d�m*�;���S��RSҗv�SIhT⻲�H��4�o��8ߦ0��p=vd ��M����j�(�I`��^��K�:1����L�'�+����d%I9�^���@E�t��1�,?!��_ ݟ��h)���"��L���):C}Q��U�|�f���!#'�n����Et?/x�d���O�qT=����J�f$���'�_r�:lv�q�Ra%B4/�I�7 \%o��dDӾ�Q�w�A�.Ft�zsЉ�����YOF퇂��mq1��a0�2��[�Y����W-v�}�q�c*�:Sd��؞q>-���WϽSz�������`�&š_�6�I�vPha'i9Ԏ�z]i��ELj���)'�5)��)&L�����x�l.z���eݱվG K��� ���n~�����U���� �滶WwP+�5�#Ն���X,����Bp]�^�MR�e��%�TY�s�����.��H��tm.͂�B��c#S��`؋0g�F�=w�)O��ݴq/H�;AK�����>\@�*�I�t�q�v����������[oZ���=�(���ZhG���l�����]Rƭ(ܐ���'�!ӂAk�@��݁?�h���-����Q���U�ȇ�O�����x�.]t��ӥ����V��G�o��-���A�+��h�����ը������� B�~�V,ȒX�s=I,j��qn.��� D�+jLUYU����pX/��_cs�M����;�V\W0e��C�,�B�B�2_��!�w��쐐Ǣ-�d��G�gd�.��z��f���R�B��,�Vp�K���}��7�0"T��)�wo�/Ͱ�ĺ.�<��K�c�8l�Ȝ�������>ʹ�����HxM2z�6���=�i9c��0��5�����{�8~/���8�Ix4|r����S�M�];��%�^����lȘ�� �����` �$���S���U-��<�2�Ӡ�+��|�x��S5|�փ���*�=�,��7$��s�X�x�0�i~ :�-КN�o�%�XhiP]��Ɉ�����lwdic��`n�f�~�4��A"Fyǫ0c/T�]�1�'�L?����v'y<-�~=�t���h�eï���� j<�)"@E�;is���0f*��"�&_ -x�Y�Ms�6���k�����r�������W:q��Tر�}`yV/�^��k.��2̥��*�^?Z�V�x���AE�?�L�(��{���P>�U��� ��:W�\d����|�y���iu$��)3�!;aa������֥`��2UB����h���_�OwM�@���J��"�b t��c�~�(
Static task
static1
Behavioral task
behavioral1
Sample
65ba572e443828193ff459ab747bff30_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
65ba572e443828193ff459ab747bff30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
65ba572e443828193ff459ab747bff30_NeikiAnalytics.exe
-
Size
2.3MB
-
MD5
65ba572e443828193ff459ab747bff30
-
SHA1
ad46b05c8d4c13f20b254490fd7be087f62dc0ec
-
SHA256
621114bfe92b8ccf309935377d8e48ebbae23143c3be1df229fb84c907451943
-
SHA512
46384a815f7ed1f9a44dffdc07e745dd88e7ebb218507eddb20d5f807314fbd0308fc872f12e88a3975dfcb05bec6b3a4b5063a46d8ce0160897a59bba44acc5
-
SSDEEP
49152:9jvk2d9rJpNJ6jUFdXaDoIHmXMupzh72lxakn2YpHdy4ZBgIoooNe:9rkI9rSjA5aDo73pzF2bz3p9y4HgIoov
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65ba572e443828193ff459ab747bff30_NeikiAnalytics.exe
Files
-
65ba572e443828193ff459ab747bff30_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
3034yfwk Size: 37KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
308fmjto Size: 5KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
314wfkos Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE