C���@��@6a)�I��v�N�zj�-智������� �p�Q��}���M���T�c>5IB������!��!�=~��aܷw[R�)�4����:Jfw�TH�ڝ�y^��Ϩ����nZ�I�c+=�z��\B�Hp�r�˫ !�� D/����݁�ó�N��\�����}<���0�a�h�����7#v0�v�Y�}��b�� �5!�]" h��B %�1��������#�����#�h�n�=��j(p��N�e�`�.�v9y9�ٲc����� ?oI��f�(���I�֭?�Z����6��f�U�F[ht���(Ӣ�E�|a�V���?WSp�å~�k��W��٘�����֬2jYu��+}��u������B�F�>��ʜ�V�<�m���X^�:/���-�F6�s;+%0_��8�N%h����9&��(���*����H6��j*b^� O��1���<A�� d����?aZ,�k�t��o���?F"�rn�(��ˠtȴ��|=w��]����%��Y� �i>8����� ����{�L�)�S��}�plè�� ����4��6�Ah�J@�<��%"!S��At5�� !;���=�{�'�IpN�J��-i�x�:�ky�����z/��O�D�kE�ô.+�d)��C@iWb��l��}��:K���Ӭh�Z�'C�D���/�<�P�P���=���1�����|Ҁ���N�}1��DF�Yh� �� ���� �H_CM����J! �~d���}d�u �$��C��M�k�a_6Ҙ8�5���14i&�>M��?�������0ӂJC�\���J�a8=����H7_xߣq��5���~�~�����G sH��6R�鼛��Π�cI�c^(��!��W���Tb�����;NsBT����#=�������xu���'<�T���W"�D~����N�������lgFS6=�y�E�7H��O��j2����6��ɜ� h=�v�D�f�3B�Iṣ]�Cy���ޔg��\��6�7���i;�%n�)��5�1�����ϹSV�Sm�����i.6�9%��$?���b���>Xނ��4N<�ln|�(���v���)�j J�\��-f'��!��;�KO��,o�.�3 ��M��&�Cql���4f��I�������=�0���*� j�(e�6��^pp;sO� � G�ЕXL2T���+W�ݪ�eSdBk19�H�r�\���g�.d����X9������g� 7�[�$h�(�%��ܪ��`'B�i����aJo���$�h�<7I��#x%F(�=\5_��l��K5��r�����T��e;�������?�|��L��w0��U����k~�ػ�?8?\ L�]���㼎��w#V�?�p]�p��+���J �ņr4{T�X��5�<��1Em䬍2e����W4F � �����56m�Ɍ�����ߚ���+ۈN[�oM�) �{�����R�����K��_6�5pL�����@�R{TS�0��M/�� "�X�Df�8T�+�2��E+(Ò[�%�����r����bD��1���0K�r��(���}�B�0[�A4 t9���F��yCf�{HB=a�"���C��s�t�BqC0��@/7�lȥ~��oq��J��1�VU?o�#ȹ���e�������� �њ�C;��guz���;��tE���&;�Z$ {o�YN��2PF�`��� %��Y�W>��5e�2���g̢�J*����-R���~��a<z��Ћ�$���Kn�_������Hg�k�H�:cc���n��uy���_O%`1�$BT0+��7�jg�ϑ��&�l��2j$5��]e�%�x����oO�9�]"�ϸ��ˇ0 ����s�p�O�x����p����n����*y #gO���GT��!ǐ������y��"�z.qa���AG�LjB3�͍9�v��7I�)m��<��¾=���w����Z)�z�x]O:v�x�7�LV�m9b� B-E�F-)b�ZyB�c�|j�_2��w�� ������u�Bx6�����y�n�Φ!��b5�MK#2_����"�z�K��B��}��-�Fo�ޛ�H���Q����.$�ɮfJz��^A:&`�u���I��*3�L���I���%FQ*(�鳂#���� 0d>��x���j+�v�Y�,[*��B<�RMb t2o�ғ�����)t\[IU�n��4d�7j�,/��,wh9��`:�y��ng�z���� ~�͊B���y�*M0?`eԯ�+�`0��2��l����T�9k�t��� lp�<�bV�]��*��ƴ���) ��e[�b;I����.ѥ`�.⎳��𮝌�oi��;8L������*���ߞ�b6� �J�ψ&�6����~���08�E-���/6��v�pj��*(�m����_ܶ��x�;� :���g�z��Oŭ=�.���w��)��/��l�CÖg�����% 5Ǻ�%9�c���9�����[N]ؤ���RQ�ڻ��0&�Σi����Z���z|��� 3���Q`z��p��'��X�8�c�l���9b��L�ŷ$7N����+}\+$8�E~\��%�����_���z^,/0f�[�٭uQ��7���sDm�>�1�V�.�*Q�:���\3ặ��Hx꩟����[o��J����������̎U�ÕՉ��Qj���l����lb�&;�]4I�_ םΫ�N�%,�q�ݹ_4RIC4���C ���ѧ�|����6�qb�pe�R,5;\���'V��(�����R�txr�{r.�c�GJO��� �3�Y9�3ᤵpE]�ꎤi��,ᢉ0m�8�q[g�U�(�_W���]��@�/�2���{��.���\����+aG10�<�Ђ��7�A�2G�jlc*��$YB��H��+##���M�v�X&���v�������U�{���2�r�cu<��������R�=DiS��8aU�=cԚ�����0� P�d�k�����yJ�<���>˂�z
Static task
static1
Behavioral task
behavioral1
Sample
1ffb660bda10c515731c41a63e7f5b5e3b03b98ba2c50bd45c38f0a37539ef7b_NeikiAnalytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1ffb660bda10c515731c41a63e7f5b5e3b03b98ba2c50bd45c38f0a37539ef7b_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
1ffb660bda10c515731c41a63e7f5b5e3b03b98ba2c50bd45c38f0a37539ef7b_NeikiAnalytics.exe
-
Size
8.3MB
-
MD5
cdb0347929f3b5578fec0d877f435500
-
SHA1
1c3f7a41b568127b42dcbbcc4cd281f7159ab0e7
-
SHA256
1ffb660bda10c515731c41a63e7f5b5e3b03b98ba2c50bd45c38f0a37539ef7b
-
SHA512
b97c2c42cfb68d7f852a688f8d25165e401e9806699ef2159caeaa5b94ba8e3a28f6f8ef11f20c6f81f9a28f1e0e4d6af0c2cbedd877cdac05d17a94f9e65117
-
SSDEEP
196608:UyjFFJDE7NbqqtoEJC4mTK1xD2i9iCk9WV8fzpu2:UwFJDE7Nbqp1K1xD2i92cV8pu2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1ffb660bda10c515731c41a63e7f5b5e3b03b98ba2c50bd45c38f0a37539ef7b_NeikiAnalytics.exe
Files
-
1ffb660bda10c515731c41a63e7f5b5e3b03b98ba2c50bd45c38f0a37539ef7b_NeikiAnalytics.exe.dll windows:6 windows x64 arch:x64
b9bf514eb93deadf13df1e1b2342cec6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
WriteProcessMemory
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetCursorPos
CharUpperBuffW
gdi32
CreateRoundRectRgn
advapi32
IsValidSid
shell32
ShellExecuteA
ole32
CoInitialize
opengl32
glBegin
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
imm32
ImmSetCandidateWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
RtlLookupFunctionEntry
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertOpenStore
ws2_32
select
userenv
UnloadUserProfile
rpcrt4
UuidCreate
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-stdio-l1-1-0
_write
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-math-l1-1-0
sin
Exports
Exports
Sections
.text Size: - Virtual size: 938KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.g,g Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.,4C Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.%1C Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ