�x����u�h�w�É;� �Շ �3�x����ă�����Y2ϮJP,�jE!� Kʯ�<�s�0��/�%��;����҇�I��Ֆr��s�{V�?������/����}�uZ�S�[�����|p�ݝ{u;�%#f�o����F��&?=|W*_老86V:F/Ė������� �w]-EqW��o (?8nx�t�Mƕ����_��NO7g�Q��U�4v����]�������Ji=��LR��x@�h&ӳ4X'��,J�;L�:�xU���-x�C����C�ᵔj0ï13��� ���*]E.l(�������sG���1�{7���~��#m�a��!�F*�!�ǖaiv�_�7OD���B�'�e�!?��?3t�8l���җs�~�.q���Tֽ:.��J[������IƤqH.X׳ܘ���:�_��F��5�]~/�U:������)���ȼ��|�dP��ɤ��o���Ѝt��O@_�A��aϬ�0Q��E��Y����n�;� ���K�]6�6�s����"��,0��5�Ҫ����x{y�Bc\Z��I��dSz��X�#�z�#D�07�nu�����pg�Q�`%6 w�/q��4|pb�i~uwv��ąy� �ׁ��<�&Xfn{��:���3wLjo�/N����y�Q��+�d��,Ζ�}zJ-��~�05ً{�A�ܘk#�5x�����{ȔV�/!�1�������Ր����eÐ����G:c��m�UJObY�)''�m�K��/��N6_���TΓ��h��e��E)���P-�A�Iڅ�d"���w���M�6ŷb!�E3 �=����D�^�{���agy�Uj�5��ݓ��|^ػZR�8$�8����9���R�������1 q����b �5����g"�;O%��Λ���)���s�ڸ��1+���Cs��C�5`L����l��-PqԩϫC4qtO����0R�a�_N 6�E��$����v<3���`(�Ö3�3��s���?�I��ѻ�8��\}D��8%tK�L*��6�]�.K��:-�ʮ^�ρ������j��re���X�("��I�i8��]u_)R#-� ��������a���ԟ����39W/����l�b!�l�p��8�#2��i��������G}��)�5Eb?�#��ᛯ�T�����F��,&R��U�H��D �Ԅ�S� 8i�S &B�0���6[ S�e�cm��i�Ŷ�d�l6��w9M̞��'-&�������n�\4#�� �J���X5����s��)]�O� ]r�3�<=�qWؗ=��_@Smw#��2�e��|Hל���;!ec$��?��vZVh29�i�?�+rKp[�0��(^�*z3���l��bQ��]~�n�,�������G�Ɂ�n�w`��Q {Z�����'{Η^�Nv�V,`CZ�J�+�glj�`*��Dl���L��q�bx����l��0�4oy`δ�\�� WO㖹[�CEG�ڼ��툿K�5ro`��k.��A���%�^�L��;C8�`F���4&��:?w t�9������ב`)B�8:ь�4��&��7m��<�b~G��;ܨ���lE xȂ���V���<Q���t��m���O�+��Z�M�5��*��ז�ftWB��m�u�9B��]�[(|O8�瓧-SG�����dP�����Q?.��lgH�txXn>�AF��\��wC������YDoc�$%}S�?��ϯ�`�ci7���0t�fݿ1��49c���fea�+bb�)� Ө۹!)���F:��v��4�u$-��Q��3�O�;�qX=f�����]Q%�~��]�@jkf�����̼Q���$�M�%�>�Jq6` �ۚ��b��n P5�x��f��,܇C�ةHΓKh��n�{�9������Y��R�Y�b������qi^���R�ZD���C(ƴ� ��mJ�fwQ;�+X��� ��}���av�!���w])�b8����r� �/��QyL���73\�ut�Bd��w�Zt^���7�0���2�M��ɟ����s"2���@;@����O�v/گNH�P9�6��l�襔M�g��Ð]#����L���������\.��?D�P� 7 ���=\� I�w���QZ������?�)���w�ӧ��K�+}�U2אI-":Y&�8�^�P�zcB���-��<nI�O�@�������O�wfb8%r��H8����f�{& M�'��"�WO�$����A/�)�d2����At�<���S8���A�d�qj��q�G�j\-�����ĕjtұ���%����+>���2�����(�˕ۥ�@@x���U��V�?�m��.uU�j�&EO�Y=��7�4���ض�o4Y�{S��R�A���y���'��VI����x�,8\�8�ͅ�'PY�@v�� �>��ģ� �)2�~2t����g�d�;�2u����+Ƽm�� �T��KB{-�)��� A'o�Ʉg��zK��Y9����R�b®��8�G�H�J�d[M�ԷsæEl��(�X����#��v]��N@n���<,mR�i�����*o�p�;H��2�ZL�Bi�z}o`r�^�ăK�Y�O�x�3.g5@h�,lC��H:�+ɬ��o�q4�c01�VX�ݾ4*�����=�L�v���Vw�ϖ^l�pch��|���+4�w"�`�N����o��\�"J��W���{��ٶ��>q�&�3�):���ƚ�n\XN�_��hX������U;�6�=N\�}��˼Є�5$( �l�5R��;��B%��օ����a�:d�D����(�dޢ��Z<ƶqL�%���Z�E�Y��8�H��i��ָ�����$UV�I�![G#"�M%��+�T���R�E���^����а3LM������3l�V,���h����F'g�dGu��A�GB���'!v����5����wH�~�ܪ�ТG�����8����ޮb$���k2��ڠ��o��y��� �[���ՅB�箜�3�F%=���^�6�69�>Q>�ک�1mM��cԧeKas"F��e�b�&V0C�����jJ@����D�I�-o���h�@�����9�k��0��v÷j<l���:�A"P������d(��$��0S+wNB��n
Static task
static1
Behavioral task
behavioral1
Sample
0c6dada7f65a4b4d6c2fbb52e24dbd46dd05fb01d82b41ac1a13104236adf226_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0c6dada7f65a4b4d6c2fbb52e24dbd46dd05fb01d82b41ac1a13104236adf226_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
0c6dada7f65a4b4d6c2fbb52e24dbd46dd05fb01d82b41ac1a13104236adf226_NeikiAnalytics.exe
-
Size
3.4MB
-
MD5
543db7a1d2648e07cb3d03f1c2f8d3d0
-
SHA1
e2c5e4cdabca524204d2a77fd50005a26e8e22c2
-
SHA256
0c6dada7f65a4b4d6c2fbb52e24dbd46dd05fb01d82b41ac1a13104236adf226
-
SHA512
28fc43457d879e4f2bbce637f9fe1822744c1d3929614bddc2363c8c2863b1676292092eb459f9e8203d0f8664395d62dd1a21bfeb88818c545a2017273e322a
-
SSDEEP
98304:iKpPUTiWAwlgzj7gWSTnPF+w70q5Jb13jyWJLak:lte5AwlgzXP69h70MtDJmk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c6dada7f65a4b4d6c2fbb52e24dbd46dd05fb01d82b41ac1a13104236adf226_NeikiAnalytics.exe
Files
-
0c6dada7f65a4b4d6c2fbb52e24dbd46dd05fb01d82b41ac1a13104236adf226_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 24KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.2MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 7.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE