�M!�:�4� 1ٽ�9p���_: =�jIg��$��XC<�9�����38�� �� Cp�,,�>�GnM���Y3-V��U�z��X��+��S:�Fj�MUf����'[�f)G�m1 F�8e�zzG0���Q/�>�K���2'�?�c$��@ؕ�:|��Yq�jR"h��Ř��T#pC�3ӣ�x"�4p�9qj�ސ�����M��x�^E5�'.��d� ��3����yE���&�+�誝w����K"r:f<PȢ�C�<-�Y崴X&f�^Q��i9U������V�u�>��<��[4�6����T�F�x�{��^R���l���6�|�7��Ӿ|C��*�c�P��<��ME)�lѹϴ՟P��9��#��[�c,�%d������2_��y����JqB�E8�C��z&��Cї�E��%�Zg��YoW�ߠ�oû��٠lK��I�I�������-����lx3(�Fވы�5k�h�ٟ���:�;%��B�U�E�;c�6J�����T�����|ofӲ ��I���GJ�{�r�@�����M� W`�E� �����T�87U��E�D����xu�8��e$�a��%�5������A2��C7�<J��g��=�Y4=���w>;�1�N��~S&/�TB���q;8��am�.k���6o}{�|0[���*Qn��_���OƯ �DG�=^��]��cq�E������������6�)� ���Y�#����|=�}����B\�s$�#=����l�l=�y�J�?��� n��̒�S�.%�cѩ��R�S����:� yׇ����:�y�c�z29�|^����Ϗ��5�nA�gK��IЅ��?�f�;s�hR�W$.�Ϧ�m��JR��ܩ�߭��P� �u�?���?�X.�,�o�� äI������yxe�)J)�N�nݒ�]�'��TB땪c ���,?�MU?]��b:�F��� �1[؏50\�~hD(�}~2��"-�� T"ŵ�g�P�� ��`>�ú?�`���&�E ��CH�i�Zf`P�[�vJ�'�M�o���!D�J}����ل�U��TH���Fş0߲X�ΉH���ȟ>_�?"M�@�fd��U�e-���e�~��'>n*J g����I��9ت~��Un �gp{b���8�Y��0��u�SI�Â�u ��N��q����TS?X(���ɧ�k[�?�qG?N��E�6����fGe�g�#ݶ����LR��lM˞�*t�tm������V��YD%ʽ��CQ��:�]�xL�T�K���]����s��!\ ��4^�� �����btP@���ڞ��-K4�.}B-��%���T�"8|��g;=�W��w���&9_��Z�/��t�����Hp�Io�XB\�A�{�q��j�D�`�2�����V�l^�'V��,ś�q���xS 3�1|���`���@w�Z���!LL�Qi�CJh�í��B���k���ӄ�k3���a%�%�Ċf�Z*a�L'X��HS�V�ޑBW��t��P}��|ڸ�C��<���^"�[��ܷ�{i$�Or� ��Kp�Z�gv����?�m�X���M��@p�|(���ѐc1jg�J%����>�cLS6-��C�v��]L� FTu�U��.�r���jI�u�h|�ZxKb7�\B �����Ob�6�uY��w��h��ϟ�܇I���J�S)�ߦs'4H�r�*��a�r`��x1z( �\����۱{>Q��pw���/��u���3���]�-�5���O�M�;��զ�g�{�up��XXt�.��<���_qS��:&��ah���ǃ���-p�X�����cZ4g�/�mn��n&�m�ք����!��ilN���g�O���U���E">���Kҝ�AQF�ҵ#h��D/jI���� +� }P�q$��ì��A��<c�����h�h��"ȴ${��8��Ie:N�������zT�_��0rH�1\��f�[hQ�H r���x�I����hin���h�C�V�S��U"PQX�Nv[>�O�K��0����'{]@$Vּ�/m���?9c�dw�G��YK{O��/R� ѵ�Ҕ@"`B��ɅId�uP���K������@�R,�ēy7��J��`Ҁ ���sg1�Cցj�!���]���3M�2t��ӇS��$]!t��V�I[[� (��βR�1��Q�*瘁�ɀ���J�FС��^�T��C=ٔ�E�"篭��_S/���I�n=�Z]oE9�Jr�#�g�J8�u�M��R�`>"|���#���(m-OT��%L1�ү�8@W�Ι��cU" ���:п�_7��|u1����0u�s���ӈ�=7�����61��<��x�ڹHN�m�o�X<�'�ϊ��xE0 R͌�}%�� ��/#����6�����^�D⌞�{�#X��,��Kf�H� F�P;�Ϫ�uӸ�2�%�_�ں�TE�Ԃ{wA�Ơ��l$��>)��=�ѽ����u6$:�/�HzI�=��b�M�����'��$�� -͞�=# �װs�N������QHX�� F��t��_��974S���$g�\�vc���'t����{!��b�5��N5�Kn��u]4f�PL Eh/_��+E���B�mߋ�t�;c/�O��k�����iDm��[;R!ḱJ���l�Hp�hy�x����R���g&`<����@_��ˈgz#�I��D��m�л�d�����e�yןHmOc�� ݵ�g�ZF�ޖRI(��l���z]��2�����"��!U 8������Wo��z/|?�6M�]��$� ���2Y+��L�O��ԃ�aU�[����I��qL��"��5e9ř<%�*�\���=§\�:{�y����}?ڸ���V��]��F�"ht���������:3p �T�5�|̦s�Y�k��>C��3�=͞|��&� �V˰�R��.ˊ�����X��L_u��)~W��4� 9J_��=�wBH&�w�[�����w��"�j�\9!oȳZ�q��
Static task
static1
Behavioral task
behavioral1
Sample
83743e123c3986b6f235ddc6e33cffd417d497d77ae73f0077c1fabf2d81353e_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
83743e123c3986b6f235ddc6e33cffd417d497d77ae73f0077c1fabf2d81353e_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
83743e123c3986b6f235ddc6e33cffd417d497d77ae73f0077c1fabf2d81353e_NeikiAnalytics.exe
-
Size
7.0MB
-
MD5
6b53da3aca9a43bc849a12c9ddb43f70
-
SHA1
1744d4d989575c98cb1114c9f03c381c667e45ca
-
SHA256
83743e123c3986b6f235ddc6e33cffd417d497d77ae73f0077c1fabf2d81353e
-
SHA512
1827734257cddffbf252652d768565060436aa730c97c77a20ee9bb570322aa20a4d01953fa56a0dc29a01a4e7b03d37f4e0b2dbf7560c86b1f04d34ee6bdc04
-
SSDEEP
196608:LBH9ovFTS/A+tCJpVUjStOGWrJG2aUYRv:ldIFAA+tCJpVUjO0C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83743e123c3986b6f235ddc6e33cffd417d497d77ae73f0077c1fabf2d81353e_NeikiAnalytics.exe
Files
-
83743e123c3986b6f235ddc6e33cffd417d497d77ae73f0077c1fabf2d81353e_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
8132f35506d1b142d4c8bbac74162fd1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetStdHandle
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetSystemMetrics
CharUpperBuffW
gdi32
CreateDCA
advapi32
CryptDestroyKey
ole32
CoInitializeSecurity
oleaut32
VariantClear
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
d3d9
Direct3DCreate9
gdiplus
GdipGetImageEncoders
iphlpapi
GetAdaptersInfo
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-math-l1-1-0
_fdopen
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_fstat64
ws2_32
closesocket
normaliz
IdnToAscii
crypt32
CryptQueryObject
wldap32
ord45
Exports
Exports
Sections
.text Size: - Virtual size: 484KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.QWBEQWB Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.QWBEQWB Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.QWBEQWB Size: 7.0MB - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 220B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ