��}��s4��L���i�RTc�b4�A`�g�zv���̘�(���C~�����ւ�)R�d鎵������,:�0Q��-����{����+ز��q��= la�����{��g��� Q���[�Q2�64�H���<*�X����Ӂyq�������!o�\ w{>�Ή~�o�.�wo����������j�pdI�nR!��Z���CGs��;�������4TYtB^�TYc�W� d/�?�S��-��z���ܨ���o�)�hlѓqȳ��\" �]{a��߯@:~n�a7L���g������2�+ u/����[�k�`�ZlY�� ' �~�fW���gf憆��?��yOT)KV���vr>T�L@*e����2���6�m*w@e��A���bP�{�U' �CǪ�����`$�t �? ��b�ȓ��!Q���?ow��_>�d����Q$��!Y�z�=�a���0S*j����)��c7��=�~1S���5�Р�S�a3��͚������01LButϻ���CXi���ESO��O�2��ώ`d�Y]'�-�x�$�`�DZ�I�d�� �s7��D�D�bT�T���\���:�&�np�eQ��LGVi�������m�Hx�9�?�m"A!�� QA��ܮCG����j6]�ִU;�p�=�\�)�@ �/悒�3E�&���|r��M�C��vz"Z�� L�P.��ƴ��-Ǜ�;�����s����p������c re�_ ��������4q`/�%����&��,��4W����p ����֎=.��k7y�\����|Õ�Xg��a���#DHi�_����YFڴ'>����1IW���`$���9�er�����p3��$MA�\U7g9�#t���^���ݱd9��<��"�8��T�(K���CL=qpNcW�b(�g����y��X����� Ðe�R���V�m�32����<�Ӟ-F�>d%D������-�;v0�I�.ޓH��E[dJ0'<��k�K�"�;���q�"��_��!�����q ��V�\�3�_zf���G��/PGQ�b�yݓ�=��4^H�GM�ae��u�J#RJ������gBJq� ;#;�ɝc�� ���_���o:�ia���"c�f6�<�K�-�]M}�El8��,��>�Ğ �����3�.��\�SiM�J �2M,t���խA�t���rRvSы�-*u]U���#5�tZ�$\L�S�����u�r��d}�t�^|����%��}pg�V�q&&*D(��� 4��v0W�B*M;�ĥ�Ds�L�J�X#3USf#r�08��BL侕�6 X��\��M�9DB4s=�r�_�{Q�MG.>�(ش�&���6&�+�?}�<ж��rX�����՝��'��HљS��i⃚Ep6�2��L]�)��-�l��U�������4�҉������Zp��� ���R��sN������ů]�7�[�ˉ�D�*�l��ɸ�2�~��zoqGq�MȌq���=��ڂԥ;PF���!`� ��lp7�-��\�ʎŬ[�^�^T?h ��Q�Z�A�`ǘ��U|�u��{-���T�7�XĬ����� ?t(fM�+�t��ͦŔ�L��G�j¸Y���m"�@��3��������y����o�$����)fE�AyA��Y<h��v�E�҂�Q��5��>ɳ�� =��kJ�� ��B���3�7q����<������1+#SW#�>\�$-5����\�)&��6�Ӧp�L��g����1P�!>h�ҏi&�� �������� 7�1�yO�(��[/�N��8��w�N|���V�e|��8|���xG��ي}Ac!m��X�i�z�Ι�I�ɐշ��!{����h�&��kܪ�C�:smN�M�"��!#2���$�e) ��)Ue��6a??81�SG�u��O�� �w�/۔�gT�=F���� �����{�I�'��i������N'I��閁¤AP80��� t�O~l�"�5�=�5����1������Z?�Ǝ{o���I�� x�>ۢ�.�����e%�q�r<��Id4Jx�b��i�W�_�^ӊe<���$V��r(1�%^�wӻ�4+���)�nI%Qn,n���8��[�"�W�~� ��E�./���&q��\��� c0�fd���e�ɼ���ST��q�|P,�Q}ľ =��-H~w�����9س�1��>�n���Ιj���ھӠӈ ���h!6��.VEE�����=��+���l�0&��3��n /�v靼R�/f�lK�)����Odl���� ߃�\D���`:mCP���燸�tS��.x��-�Y)�T�e��C��4z�bF~B� ,�����;6/U����R��ɏ/����$0 �"N�i���:�{�hi��)L�F8����e�zӢy�=P��� be�9-��A_e^��/�ٟܪY��.ώ���b/�o��Ra��*Pu��7$��RNR.F�����R��S$���V��Fsg�����h�3Ձ�=�52oz�7r�q�ٗ���L֡ r����I��"D1����`�Ε�K�]�2�m���$$O݊���Xkh e�g^;'�ӧ�}��e�����8*��H�CA�s=�!48J�1n%Օ��`��[n�qڠ�Xc�P}�A'�u�4]�� A��ؠl�)�>��W{� ��_��k=��.���%8�v=v1�3�:�k?�_`G��;�M���F|�C�h����ن���J�spw��\�Ї����Z߯�����3�~��B#��;����`��(�c��'U��w=�����u�j��x�('߶`�`�N��m���L~�o(B��*��i����I��I���������k��,��q�$&��+�%(��Ȭ��Ͽ��Y����f������C#�-�l���߸Wb1G�+W��H"fn)Q��]���i�/Q���=�w��Mz ]��u��h��8-Җ��S4h�%�0�ݒ+��)��c��G���N����%���hE�b��=�A&(_J=�9D��eu��f��sj�G�c��aX�0�����
Static task
static1
Behavioral task
behavioral1
Sample
076d08020e7c2e942f506d7af41502fb5487e4d3e2ec66842da2385d0b463e0f_NeikiAnalytics.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
076d08020e7c2e942f506d7af41502fb5487e4d3e2ec66842da2385d0b463e0f_NeikiAnalytics.dll
Resource
win10v2004-20240508-en
General
-
Target
076d08020e7c2e942f506d7af41502fb5487e4d3e2ec66842da2385d0b463e0f_NeikiAnalytics.exe
-
Size
9.1MB
-
MD5
539a5d39a9aa1303177130358532bc90
-
SHA1
288161278754e0ceae8749cea8ec903a805c7b71
-
SHA256
076d08020e7c2e942f506d7af41502fb5487e4d3e2ec66842da2385d0b463e0f
-
SHA512
767b14568398d0e95e0c56118b8e8bb82a752b5952665c4700dbd905ecd40c0e41100a4baaf2973897cd367fcff706697c31f68f04980a58935d158e65aef3e4
-
SSDEEP
196608:1ynDEosDcjFohwO1dAnNqcH0TJkJTAlM9eLm0W+GRQEpyYdoBS:1ynDEosDbwQINmklA3a0WTQERdoB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 076d08020e7c2e942f506d7af41502fb5487e4d3e2ec66842da2385d0b463e0f_NeikiAnalytics.exe
Files
-
076d08020e7c2e942f506d7af41502fb5487e4d3e2ec66842da2385d0b463e0f_NeikiAnalytics.exe.dll windows:6 windows x64 arch:x64
e78a587df4003be53fe8a174797a9c28
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
QueryPerformanceCounter
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcA
CharUpperBuffW
advapi32
GetUserNameA
shell32
ShellExecuteA
imm32
ImmReleaseContext
d3dcompiler_47
D3DCompile
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-runtime-l1-1-0
_initterm_e
api-ms-win-crt-math-l1-1-0
cosf
Exports
Exports
Sections
.text Size: - Virtual size: 499KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Hk- Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.b~& Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.>yQ Size: 9.1MB - Virtual size: 9.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ