�ͰWl(h���]�ӭ��_���d�á��v{.�{2VF؟�t�?ݻ�2�s�r���=� �j(33T���m/A�V�� ?��1-���Md�>à!��.}=��Ö�1��0�u}�B'��5�Xպu;}�KVu��+�=���!1�^�V ��͚�8 c�m�b�"�/�����(�Dm'�v~V���{�ʭ�h��i�u(N��^�� �c���kv1���<�`�z�w�Go��V��5%8'�m����:V�9��=��l��v<�]"/[?OS8���P��T}�j�\\�{�?�Y^�w^i�kc8уf����:]�w�r<oc:Ts��f�-�����B1&QYDU5y[���&D��(�I�H�g0p�_�F�*z����{�ȱ�]�b��p#QL���a�6G�aBG�z���'�L�'�y���\�w5��S(����m�/���o�����%�6x�����N��"�Ŝ�bO���ý�A}���E�{�Ω��]�KC�C�m�]��p�"F ��t���ˆL�c,�,7�MJ�Q/��<��w n=� �@�3㟟$$ĪpyJR�g�6���w��xZwzTS8�"�O�@>v:>�_~�E��p���j��X���d���t}J�kH[�)&��C�������Y��ӯg��H�]�P�ͶR��gz���Ǿ+�v��B��#�^��)�ܨ �Wl��FB�p�-�.�3��o����5��^�q����l��m�����%o��>xn&RAJ����y��s�u]�t�HO�|����*������!8_TvV�����0�}�6\�.CK����/���M����Oju����x���V��8���ő���2�Q�*V�2�J<����3�����Q]��Jg���ˮ'�%x[%9����j�����%>ɟ�=�Pw�{4Ψ���b�F��+F�wE�S�i�V/`�F2q��S��ڳ}QKإ���4�{�,5e/�vH���ѷL\`����:��L�ppd�/�<yz˭�-� %��ۉ�D�@Vn�s O����U !H�[�K凁 �,9 0��a��[�%o���Y��b���� <ں������MRQ�p�F�����=!����"�c����?���$n�'�튗�F���H<F�k3)���K#n���D��F�5�^�r�l`��v�R �Rx�������f�,��D�s�M��@?g�D��L`����,��r ���r���ܾ��%��z��j�� % Ԧ|c�kOm$�lܣ��!'0���'W#Zb?W�\��!��I��p^ѩ�|���������F���w�T�Oz �*� �ư�u���f��}��?Q#��b �v�G84����e�拂P�I���v��!�5h���ګch������!i�i�i^"�k<_̹�����P8I��z���\��*�%ZL�蕽�q�#��.�B�u���w��e�nLx#=Z�#�pa�Bz�x�M��!������EA�/<S���;�/-S3יS�Cs���u\��f����Be�dyݫ����4���ŧ1������$�܇6m��j/1���}�j�:Ƽvͣ������.zص�_&�װ��̵��?�F3 �Q���aN"czBeu���D%������|����R�ƍ���G��Ά��Ґv�*9��%���Nc)tBNmi�����H?Z�x �/p�����>������nq �빚�#D�C)�.ڂELG�1����7qé:�ڊx���v�.��=qB�l�W�-О[\��D���>TX��x�0JM���i��%nc^�ρ`[�)�kj�T/B�������1����S���c��+��ȝyx��V�F*O�%JrV��($LF�~��.��M� 9L<����W�z�g���ӵ�ls�]��DH�~�'�J�5��mG�Ȃ��SW�͡��àR��\`#�C?��*��n���*2�@�?A,*�ƍ���Z1�-зu�I�H�ʗn^�9��53�g �hɨ�c�\�� i��c��#������ЎC����!%�b���_T�����qF��E\T�(X�������R��|��u�=�f���RR���B��1L��������@ ߣ�5{�{k�� ����/ ,���к�s�a�>�4�0��|����]�nʯ�������$O`̆D(�p�&�ٜ�厓���M�l:s_�a�a��ɵs�������Y��+�O���~�] 4,^� T������}�3��o�)��K����z��p�W^�A�L+S���Q�c��k�/R.�S瑤�@�p����5[���d&h�g��=_1iiY�D8�2"�+���� �V�X�,�D���=耷�;_*�j�r��+` Nn���l�L`��>Qd��;<OcB~1���OL�q.3p��fdέѱ��_��{��������RX\�ާ�X�VZ(�N��E�qn����f���x3i=�[�vA�^��Ƈ���l�eQ%%{|e�vvy�?D�9%�֣G��[����u�t�'�Tv�#���|��������F^� K��W\�C;�����3���Si�1$��*�%�� �I7&�;�z ��i� @9iB�z�h9+-d��MMҦ^7(r�m��Td)��~���=gP�b�#�(�,�~FmHւb3TJڭ�~�r�{bؐ'VLzc�:ۥ�jm�p3k�������tTd��c�<$"iƑL�O�sX�+���N.���8�Q����B���Q���K߮��B�����-{S�H��]�"�#�J�2�G$�e�BOYZ�\�����ͼ��d�����˝/�,ݑ0�AB},�P�����h�Eeh��7��- ���.�>U$��e)!��c�5���6��(�>:�����f|����^��=o;ܜe�2�/m�7Vfq���u������vX���ȴF�e#]��2^��n�2�������Hh���imn�~����ԭ�� ���kJRO.qd8���'���$rz�/U������؝�q5���b�>�W-�+a\�MČ|�Xq�r�q"/)^ΧJ0�
Behavioral task
behavioral1
Sample
297cf7a8b57a66d4b87c86ce3ff88cb653a8dbc31637dd19bf13785e05e26a40_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
297cf7a8b57a66d4b87c86ce3ff88cb653a8dbc31637dd19bf13785e05e26a40_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
297cf7a8b57a66d4b87c86ce3ff88cb653a8dbc31637dd19bf13785e05e26a40_NeikiAnalytics.exe
-
Size
4.0MB
-
MD5
bd4e7b7f0ce43eba03fbb5889301e3f0
-
SHA1
099aabc498d359dad66bed298c37e411961983bb
-
SHA256
297cf7a8b57a66d4b87c86ce3ff88cb653a8dbc31637dd19bf13785e05e26a40
-
SHA512
fd9400acc9ffa4cc170f6d9c788b83e59e244a03401c63deb13c3fecdcc74858147200cd39462b5e76b9ce759d6514d88a96343c48936bedbc6de380de97a0fd
-
SSDEEP
98304:qTcWvxLHSQWVRgFGtgFGuH2x33GRR3GRxAA:4ZpWVeA
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 297cf7a8b57a66d4b87c86ce3ff88cb653a8dbc31637dd19bf13785e05e26a40_NeikiAnalytics.exe
Files
-
297cf7a8b57a66d4b87c86ce3ff88cb653a8dbc31637dd19bf13785e05e26a40_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
b05892e127899357377a409cb4f7e66a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
MessageBoxA
advapi32
RegEnumKeyExA
Exports
Exports
Sections
.text Size: 408KB - Virtual size: 407KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 148KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc1 Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ