�FB��KV��o �S�w�{P}��5�,�8֬IiEnq!�<�d U,р���j��yLE?V7�\��:��mu���$b�Q�o��$������)6��<�49\'�Z�T)G3����4�gH����2���Y�Ys�f\�1�CS����r�$��?'`������n��g�sJ-�)����N�k%~���'��.��S����V[�-C�j�?����*���>h����\���D����f����������4 ZD;V���Vx�t�c;ѣoՒ�,2��10H6���3��(����� ��:�� P|b�T:(9��b��'���mA��8�����@Bm�����R�����ՉG���!���P�tG��A+�G�Q�us�+`[�k/�H_`(��ۅ���' O�x�7�;�d4`-�9��͎�b6���������UeMbӴJ�� L�E�G��,.�"�PGX�+��c{AW��m�rސPi�,�!4�� �бz��A֖���{��h�;��]IQ����p����+(��TTE� ��!�峳�^?�0�+{�}aghi���+����<���& �V�F���U��x 8�Ș5��s�J�2a�������N~p�[��|�om7�z��*R��A?�Pe��&�L���� ��&#OKGy��PZHq?,�a�����/�:'=y���������8��C� �;����zc�p ���Η��;R,������"�����ŰםDq���8����(p�jG/Gk>5i��C�������}�7W �,G0m] ����b���%�����z��}Z��.�]<b��eȀT�'�ZS�2\����5p�İGN&�7���b3�o]������R>3k�9.���~L�K�<sm+�<����{1&ɾ�����3�ּ�)��7d�p�e�/;�(\�~�R��rpZrC�;�P��~{����͘0�a��P����9�Ex�(0w��C,1�uV+���b�4n&�K%�]N�C;[�^V���[h7�B�8������l&�6HY1�T-��n�d���p���4�������G(��Ǿ)��@���~��W���@ �BN�x���!����]f�6Y���g��IB�Fux"��cE�8��[�����:;��q�0�'�L��7�:���Ŗ6�Tt��l�^lÂ��s�;p��j�lv��ڙ�V��]�.F��}�!E�K�f[A��D� �E�=}6�rHbw�Ŷ��w�E~��d�xG�8�Au2n/i}�g���" �\��p�I���ĹNh(��U���wp���]t�ek��/�3�Zl�|h]��s;w���k�AX��,�����S�Q�E`�����-9��h�.��Ϧ��}c�;�v^�Ul>�vP��3d��(}N\�������4`���[�>{����fp��ubH���;� ���Rq6��kv�۴S}x��ob*����Оs�@�q@�]h�a�u��G���g�h�6{��Eܰ>��B���ԣ`)�r5�h��k!��`5�����m�%��8�")���浴�>��W�������J갍��U�H� N����%,m?�H��H����x�\���>������ޤP�1�3���1 ў�(_�H���U��T9�!ϝj��f.6\�t�<"]�������r��U��٥�[չ��W� ��W�a���Ľ�N���@�8�B�+c�ȅ���?�}�Q��@��ťH,�꒥����N\<JθI�%��{��4��y�w����85�=t��t�17{�z�aե��H"1���,�D�xh18^/B�h�5��{]�'�~�E��z|]�&��tި��)H��q�`x�<���:5��0�p�#Y���[=��}(�<S��W_$\ӓ4Ô��!1q%V�@|!.��L�J��61�8H����V'd��v���n�Vj-Җ���� !�db>pw�"�����^��V�ᖋ+MoJ:y /ˣkC�C�D�0� ��������ܝ.v1%haǀIi���'z�lb e#; f�����A��j�p�>}�;,�P�(! '�7�J|��ڒ�M��1%�'Gv7:m�+>�5�7 z�at74=�r��xu�a�a擐�ܪ���)* dQ���=�Ks^HM��3zL3��e�.J�<]�G�Cm�Fy�6=Z<��������˔c�wm�uC6a������Bp�w`0�.s���'����P�� P�������Ԅ�}v�7���nm����O��m�8:xWZG��L�/��N��A&I�Pt��N}[��P��8�oV��&W5A����M��W, nj��^��� �X�}.R� �E9&�4�ٜ�(OxD#�?�ħz~~�v���]�i��nxN��U�`�]i�ׂn�U���sʅ�Ҋ��p�7f����~�_�5�.�3���0g��|bM���l�OzA6���J;W�F�Az��\-Z��c�1G�' �����U�L���t`��.q���O��)l�u�j������K���YF���_�y��u� ]�o%{��H�/ߤ��9�݂�!��)���i���{�����\��P����=a��"�uN�A(����0�T-� �Ɣ������ϑ�� >��'�r�^0�8���ᇛ��A���^E�KkI�i�B�KL<>����B�iZm$�>�Ǥ@>�����zS:*����=F�����0fI÷��<r̜�VP�8E"{d]3 f��ε�2F>��T�֦����}T����E����M�?'��L ��,� �sT�r���d��}J�5ޞQ�Fk����H�%B�}���f��&øi���?��q��"kΪ馭)�[��L��/�U�]�<M8���laP�a��cFZ@���8p���`&)��#!��@U<��V��'p��P���4�˅�L<��a~F���Y}v^�^,� �����ÿ��h1��m��u����$.e�oI�($d�^�+J&v��NW�CNܪ%��4|7��_��7�U$5A���٪�����x]�b��ľ���?'��B�@Xų/0Su'<E��n4��-��^�pe���RxlE�W;}낧���yUl? wԅ���`���@`���c}O#��<�>䀋���O�bm�[t��s�Cu�yz���E�����&7Q �&�_c�.��ϛX+|Y��ʬ�qq�k��\�dy�j/;ؑx?s%�ҙJyx���.U$��=\8z�[�<0b���{"��:��ˤ��W�H=��mFO�\Lw� Ǐ�������� O�/F�h��/���%�S.a���L^��ih� V�����b*��fň��@I��
Static task
static1
Behavioral task
behavioral1
Sample
6832ee2c6da47d9b4d8bdd98f69ee821d183fda37f0c5b27313757083040abda_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
6832ee2c6da47d9b4d8bdd98f69ee821d183fda37f0c5b27313757083040abda_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6832ee2c6da47d9b4d8bdd98f69ee821d183fda37f0c5b27313757083040abda_NeikiAnalytics.exe
-
Size
3.3MB
-
MD5
81172c373f8b2ecb6e08faa72c398010
-
SHA1
f6382daab13868adf187e887a7bd7cf9692d13c6
-
SHA256
6832ee2c6da47d9b4d8bdd98f69ee821d183fda37f0c5b27313757083040abda
-
SHA512
6f35adf7c8f0493d85b942bfca24b61e96879d80b9ed0fbf278bc086866592d5c8005080f183e24588f527db9feed60038723a3d99530058580c913187a53a1b
-
SSDEEP
98304:A7JcFLvk1n+AqxdX2Ln1iKTWQG/VFDIhi9WcvZAt0BqYBM:A7okn+jaEcWxVBIh7ceWBqyM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6832ee2c6da47d9b4d8bdd98f69ee821d183fda37f0c5b27313757083040abda_NeikiAnalytics.exe
Files
-
6832ee2c6da47d9b4d8bdd98f69ee821d183fda37f0c5b27313757083040abda_NeikiAnalytics.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 14KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 22KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE