���{P�BXP"��0��3�=Wޥ��n��R�O'ʂ�� 7zil�eoUdP��͏���g|��g����IN�ֵ͑� ��.���i{]u����m�1/�:�a�cQ.��6c�QV]�>ߞ���w!MT�q�[��8�D��E��g�z�6�)��d.������ZyI`}E1��z:-�I�����n}�\>��� ���d~b��(1\�*�>��[Փ*�������?#`�H�����咱B�����8嘚o�DZ��ҿ�x��~�2L��u�W����eu�-t����x�,�#�Wem.�٬�A�)ǻ���}�c|��a��<( \��1��K�O��J�¹w;��źd��h�C�U8�`u�z15�?Sg�_Ƴ-��N{�ͳ&�,2X�_d/������*�]ؖ���_|nO���͘�Q����9��Vr�eihҼ�Q� �ft����K���fS~��(�W6�����~��x�p�%Ĵtg�n�/�A��ûPbؖ<j&4������6�O��z4\'^��_��p�����{�t��oE��-H�a�DzE��V0>����ѩ��骨c(xț����G����V!1.�j�sܷq3��u"�5�;��;�M�;���po����Y6(5�a�.ڳ�q�t��T���W�"ת�p<l�7�s��Z�Xφ��Y����|2h�봻���Y���������B�j��P��H���ÔJtςz�j��^{�`��n��Wb����+��>�J���!UKXĭŘ�0�aI�~E����K\��{��b[���d`-��c���P"�G���)`�cXܯe,�.c�t@Kw���:C�EͶ��atC�\��FY'w���������o>R7����˳ں�Ӳ��j��� E�}A�h���94s\����n/�]@S@ ��u�]�}��D���E/e-��P+�!N��˽Q�� /�!���QoJs-����R�n�,7��QC' �MǑZ#���Р��� +�Y^���ѩ���Hkќ<SO�k�آ�LJ12��|�Y�hx��j [������K���rE��9&�2���O�m"����_��}��3S����C\�E�iƸ��}+��7��M��1����Nq���)�rh��6r��.��o�>[�w��Uo�� �E�-d� ������c%��<���4~8�2�of��˳��5Ab~�/�.-����"�_| -Q�<��V����'�-���3۠�ylvג�΄G��h~���C[LK��^�憥�#�k�jGL�?D۞t�p����d+)5n.�6vFciif<9���gZ���˔λ�'�ؒN�b߶n�"�z��&-C�Y�q��ax��1�1��r���űF�r4Dh�S`����'}]��� �'-V�r��U��ʵ%��ё)�[��Z��u��\{˳sB�q�E�0M�o��G�HwqyT[����X'f`���ٻ�N���g14�3����K��)Ѐ+�X2��nAa��y���e���w.�`ͬK���O�#^��1����&`?��R�Y�3ً�bm���H ���~�il���!'������.W��?La�u� ��j�P]_pQ���s�d��=�N��>�-%��ϋ���>/��y�*���v3B �3U7Bg+I!��d16��?��A�s�7�Ua(S�a=���QS .C%hA�^8�ZM� �ᾶͰ�A��||j����.ߺ��!%���p�������ϳ��[���$�|�������Y`i=�kd�+���I/�����{й".N�*�?�ͤcs�x�M;���]���jL�pexS�~(� ����I��2I��GL����3")bPC����bGY㢣]�"K���W��i��ІV��_ `9����}p9si�Sa��w^��Ư�ĸ�[6K��\�Oz�d; R[Zz./��*ou��K�=C6M�m� ������_�������(ũ�[w[�₉���������~�<��t,�-dY����fY��f� br�d"���`q-qH��B�x�>2ܶ���ſrH��굋G�WE��8=�%G�b��"u�6�QE^�$�?Rn������#�DO5�,q��� Q�j�Ыću�h�qG���|�Dٙ*�Pp{�u!a ��$�+b�Xgځ���З�(V:��t�� :��X��Pxu�L����ߋG�d_�P�ݺ����X�;:Pn��e�^���7bF�l�.�7��������`W}@H�=b����;�ߠX��ۻ��tg��s�f� w#��ySg��U�wp�h����AiZ ��b�S���AP�^��V"}ǕI�tU�YG�z6K���E(<�� Z&c����I��GN����2�(ع�sFޡ����UY����H8V�1��X>��6�}QQJXmD%��4ӧ�iߐ�?.pyf��qj�+�����E�ђQ��T3���bM��ܬ��_nY�9Y�w]�º.�m��٪��Q�k{��j��+�t�P�j"1Hg�<�b���qo�\�^�ꘌ�R���xTӯ9�(�P�@��Xͳ��=��:']FkiS䒆MN�������I�����G�̗;��%��μ(�#m�qC�}�ؐc���a������)�3;qA.�)�Go��t� �}k��V����f����-$C��Yri����U9�"ġo�`v�2�t��̮Q���њ��R�džȠ5p-nPm��Q�<��y�d�{�h/S��������'�w���f�҈�M-զח�X����]i�~ߵ �k27h�D�Nl\��0t� �e�6L8��2�S�/�_�w3h��Յ����X��֫N<���H c伨y����� Umq�a�u���C.�-�Z�*|�����P#D�� ���g�"� �=Up@ yf�<�H����aX�i����5�KU8��ۦ}�rK�Z4�Й��ᘱ�Cϗ��r��`A���-�d(����ȳ������ ��,�rÈ�ƺ � g�n�vm�����Hvt�J�C�#��E+�Tt��oFޚ���Jr����^��ѯ�Y�C��_φ�D�k)5ca����7�s)�'�L�k?�Ǜp�xN{+�E͏��-F�h�`��7��;�t����Z���ܗ(��ω��Vz�ʅ��]��ʆN9������ۍIZ畤0����p����Q��(��;Ϻ{%���?�lUFh��dz;��^�c�٩����As ~<a�&�m��8��~?�-��jMA@��oT�f��a��:�V���%��z� �㩨F��!�S5���'T S,I<��n��v��[�D�=.4����L%Ys���aJ m�P��r�z� �i/��C+��7@z���i�"I�E��t��l!F�9�}��D���,�c��B��GrA����@J����߈#zHJ���i�}ﱽ�[_� �����𦓶�Nٳ_Y���i!k�:�ft��H(kN��s�������ݜь�`����xo=;\�����X�}a}�(����g.w�W���xC琄:e�������\mA���9�x`�Ht G��l���R ��/x�eP00z���u����(+U�C���ʵk\b9%iU��c�8�D�J��Gcs�h�,2O� R�H50�����N��D���F7,.g���7-��Ѝ�R�G���@v|�I����\�����{���£�0��w��):>�Fr�sy�K�qz�ɵ���_4�w�2�I,ex�Ր�t��a�V7��U=�@��Y����; 5-��s;C�z���O1w`���|Z��~�<~�?
Static task
static1
Behavioral task
behavioral1
Sample
2374bfa5ce9f115700b68372121e12f9a8e490a8d28a5da999e257d969af6a7a_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2374bfa5ce9f115700b68372121e12f9a8e490a8d28a5da999e257d969af6a7a_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
2374bfa5ce9f115700b68372121e12f9a8e490a8d28a5da999e257d969af6a7a_NeikiAnalytics.exe
-
Size
2.9MB
-
MD5
63ac3ef7db5e58ffb5aaea601a38bfb0
-
SHA1
db099e58734b91bc53939896acf7e17d32e1f0eb
-
SHA256
2374bfa5ce9f115700b68372121e12f9a8e490a8d28a5da999e257d969af6a7a
-
SHA512
cceb034bc86019422b180a409810af91a4836d42886fa246f500a62bad6610fa6800f6e851a71dafc5c01f445c6d8b21c95a7ff5108c0118caefd1c23132fdfa
-
SSDEEP
49152:v7Srk6eF6g2yiuBt2Lj3p3VMI0wPQ+iPY7V1RcJSEpFApHuBT3w1n70xcb:v7/6ZgR/e70QQ+F7V1RqepHOTw170ib
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2374bfa5ce9f115700b68372121e12f9a8e490a8d28a5da999e257d969af6a7a_NeikiAnalytics.exe
Files
-
2374bfa5ce9f115700b68372121e12f9a8e490a8d28a5da999e257d969af6a7a_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 272KB - Virtual size: 540KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 192KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 28KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 204KB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE