�>��U��������M<��<�r�x�1��!�G�dz�ȟ�7V^����~|VD�>���Υ?��+��*Wn��I��R�3�"\q��"�~Nv�ୠ���� כ����� w��o�,"[��Ǩ�ct5���4�Wi�T$nG|(AX���Ac�0��v1���/m��%���Ī�U�����,�4�h���s��/��OW���C�u�w}�S|M��v˭�C\%�TF��%"%��P=����\2��ʹ���>]�;<r���d' ���^���G�jIB�"jT���x�h��|-��<� �o�{#6��i��� ��A��3�+�R�x��g��� �7� � ⲡ��gpW>��:)Z�z���]��[�&k*xa`�?�aM�h�-;�f�W�/I�)_y�A����K\��p�%U۴�o8~0W�>��O���!�+�7lWR��gk�MIk��� ��KOH�o^ӝ������p�7e�1�B��j���>H����L(��Ѿ�5�큌J�z��ݔPv!E���4i�������n��[����6�xx����(�i��?!�.2�"�F��e=ÀB j_Tz^��|Ơ�Y�at%�������� �C�r,��=�RR�A�iy�E0n�2|(�o]��ei���Z��5�ހ�=�sܷ7iJ�n*A��,%n�pMk�, ��(t�c��ٮ:g-�KYv"o{���<�E� 6��k��a�X��$K�R�m������G͙4�ؤs�s�U�\Mu6¨�E{F����`5b�aX�m��鄀1�v��>��i���#Ah!�h��;f6�$���lMoG!}͟m�����D�3s�h2՜�Nu��8Z���D�R�^�} �0���9f)Td��hq�D�Tk,-�V�"k��h�x��b�z��z��ꗛɺ|D�ʍ�/��\�ܓuewwa���̧�Y3���Ս�&&g�cqF��=A�=z\�� �9����*��qC�x�J`��ۅ���x\dA�1d�"��߲�6a��������Q�����?tj&J��n/� \y��>p��N�=׳�7���̀�?��|����N8� �~�1�$�r�;�x{�l�)���i�(�Po��a'X��&�M��pd&KF�y������!YAM�V��w�� `�, <.�c�D>W��\i��~�^��Tw��ê¸���{�T�A�a����(���@0r�q����O!f1毞滫wA�3�?��8�F�Q���hK�@��㕡��'f�\��Ar��)-�$c���'@�Y~TnN����h��"�Oi���&C� ��X������K�J-�v�>���O��-pb�`��&x�L�VWͬ.nTrUV�͋���:z�`,țK7�s�,��l=��5~"`'��j/�j��H��PQl�[���%���,+4�SL*�C��o�D��&&�W��E�5�g���K�\ӯ���aMH�'?j"�Z��$z������F��gͼ�%;��!O���6��ʮrq7PNc9(��E��4���~�V�t,�����bLZ�� ��mSK��F�:��؏�Y�L���B�4���)Ӂ/NG�R�8����Y�0���NR'2�]�+%�k)�'ʁ���ݦv�<ܸ������;��7��M�x,�ר ��$W��hl0R���7lR � "c�� �!<�B!�� |�N$@�|e�e�r���7�D-���GE"�rb� C�����E �"%�J+�.K�����#����e�=x��;H}�]{��^!L�e�U��-1Zk�EL�v��Dz67M2�TC�ax��PFg��GK�n���ݖ�`�T�{!��ۺ�nI���lG>���u����Y����p����ٻ�Zn_�vvB�+WӥÄ<zGo84H���E�E��4q�����1jf��V�}r��\�����{Z�|x�>,'o��B5��aG�cmP?�Y'�q�S�P���*�x����rr1�F�=*5AY8f�XE4�&��a���+k������s�V��4����_�~ߌX��_��$5�k<W�����1" ���n�����N�,�w�r�;�o�������k� ꏽ�1�C���51��I��5��t;b*�,�q��W�)?蓥^K���Ԑ�����yЗX�!_��j�.�lRټl�rb��wUq��]SȽi8>ڶ�@p!�>/)B�v�&����Y�%�K�`���u��yn���֪��)�9����|����h� /��A�!j��Y�q�d6���st�˛��x,����k1&e7�Qy�?m��^���^\wM/����~���gL�����9���_���4�ļ{:�(�>�N�f�D���iz^��x��CB�����7 �7U:�/�P�mpV�@�H�d?v�i��U��{���� I'�A��,��w�/��5��V�����R�%=lBJ ��?��k��y�WY��K&y��ɂ}G( =��&��s�����M?��I K�}'�����Re� �Wgoٰj�3lp��J����0��Yr$\Cg1�T��5xO{"h��凸�Cwp~w����X�xC���Wi_X����s7�c}k�Jg4։����s>�������u�b�f�fr��@gRF����]eT��fB�d��Ee�)�Н�g+���]� 0���L�=���SoxAtq�4��q���(t��k[;�&�卥4P���� �,��K'ꀐJ8}�I�7��<¥k�V�vG�l��S����ƪ��S5�n��_]��}�ۏ�/+�,���a>������ݴ�}��Z����5���y�⿍�ŋP���H&���G�5"*-��2�2�Di2G}R�D:HSb����ԝ��� ,�k���}ۜҜ��}lZI"�I���Qk�%�B%4D�Ec��S��*���&e��M�,�hBv�s�f�M�J�������9X��G�ޟ�\���q�x�L����U�E���]hc�戰�N���a�F���C}��j7��<C�Gh�Òf��-�����\���y�U<�(�!���� ґP����)+��Q�#Pe�3�{�'ү��� ����LT(� /ڠ��K��)+u��A7q����MR����TU?���<�b���Fx/9�_��n���e����q���q���'o�E�=ן֢$8GyFۮj�8̲�iZ�� U�����nZ/�ڒ
Static task
static1
Behavioral task
behavioral1
Sample
98c97bbd612c0d12ff9aeb90164a779c857c720ecf62b6710ce37fbcfdf24199_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
98c97bbd612c0d12ff9aeb90164a779c857c720ecf62b6710ce37fbcfdf24199_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
98c97bbd612c0d12ff9aeb90164a779c857c720ecf62b6710ce37fbcfdf24199_NeikiAnalytics.exe
-
Size
7.2MB
-
MD5
7119c5a741100e47b0c1bce928e31f10
-
SHA1
498d6d0d16b77423d2d72991f0f7d94e79a675e0
-
SHA256
98c97bbd612c0d12ff9aeb90164a779c857c720ecf62b6710ce37fbcfdf24199
-
SHA512
08d80f31aa2528dee892aae0b79d92823ecf6892929b9ee3d6dfedf0d9981d033092a02719aeca684905094b37fcecd2f74e974fb30a80898152295f7050e52d
-
SSDEEP
196608:0QWT1MJu79g/ZxNuqWZeJuvXPpnhzasonTu4m5JlCwo1bh:0Qia1huoGhBa7npGlCwo1F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 98c97bbd612c0d12ff9aeb90164a779c857c720ecf62b6710ce37fbcfdf24199_NeikiAnalytics.exe
Files
-
98c97bbd612c0d12ff9aeb90164a779c857c720ecf62b6710ce37fbcfdf24199_NeikiAnalytics.exe.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 530KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 51KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 34KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 3.3MB - Virtual size: 11.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE