����Y�Wȫ]�+r�/���m~��i_��>U<��M ^o.r$#�G��O <�?�����\�.���D��M6ԅ� �I��&^��c��Y(~���&dszم��Y2B�n���ǧ�3�����N=�=���#��"MF}��BŚN��]l�x��h�Y����'T���j,�^��G-��������)<x�[w?��-Ya�G�)րu=�[~ڀyR���n�Ue9%O6�2~�R�ݖ�+�F̶t4�G&�w�&���d���)��n��=���F�������~�eg��Z��[Z6��ϟ!��Ã�NF��Y�(�>��ҵ�q�)���� ��Ub��4�_�a���m�2dj��q�M%uo�fLE�t��Ĕnq�`�l=�e���_�\�r�0#2�gk���\��E�36CX�y�3�Y���g�������S u�T�3�Va����%׀�k�W �$�WH��.����P]1�mᆼ�Xc1l�ժ?����qU�uk_��u��� 1ܵB������J'o1Ҝ&���I*��^�n���1��I�59��!��s�V.���9>{�J<u�]�|[�� �1+�S���c|6�o�4B�s���6?�h�c� ͅO��gs�J�{P5{��ʘV:�U��,�^��>��I���1{��֚N!��S @��W�,��RP�w��!o�,��5{���b<�:=S�hǶګ��ϫ��ܬbL�J��ڪ�-���<$qF|�@d}�#�62����y�@6Z2д�R`��k�8��*]Y�h�݇Y�Ɇ(:�W�N��~}+&e��d�)z�݉���b��ޣD� ey���G��B�k�qV�������ra��%D3�ok���^7E�V�C������E��k5�B*���f�!��d ��C���i�Rwھ��n��Ӻ�t�^�����9�����m��)�,~̂��p�S��_S��.oX4���s�~X�C��Lx�3���K?�6b�E�W��J�Y �셳��� �7��픏�[�M����� �pP��V4w3]���Г�j��+�%�v�h|Q�9dBD$���2wX��h,\���c�#A͊�|����9 ��H�qꃪ�����\D�^t�xR���`�D�[R��\��y���$P-��r�B!���b@�X�<䙕#�T.*Ĥ�)���:\�9S���^*�L�q,b��p@0D��y�t�96��6;J����RZ?��MpOU����f:�:λID!�ϒ�~�N�ԏ6��]��o��uV=��K ������A$���S{秧�-;e��5*-�Z[;��f*m�*�6��/Z��x%��)汾���������N����e�7yK��� 5"DqJS�d�n��\H.�E9t��{��X���0���ٵ&}�(�Lޒ�E��_�J�i��WuYx��>�*�B�9Ŕ�� h�aT�BP6a��J���v�2��\�})�+i[�=���M�ܡ��ͨ������M���������=��Q�{pL5sDno��@��69:�]%�Yxcd������0�<��ai�j���5��/"s��-��A��Dw���՞�3U �i2���SM��&�̡xu�U`QsD�/�>�c�fvKoo�\�k���UE�jv5 ����J�W��"��n6�Slt�A|o��P"GwD"�~��F1��0a�����\ V��6���4���"�\ ���j���(ߢ�1gO�Q�\��c߳�\���kUE��w�]�1��V����f��ʼ6��D�Vi/���r=3��U}r�dS���PM6�������O�}�D���iM��^�\I�A��ޡ-�-�/f�!1g��+�L8Hw̫d�Go��껇��נ��%mf%�߯FZ|d��q��H�$$ȳ��]��E�&�Y�dGH�!��{����Gېv�?��`�:bD�մ j6lZ�-~�O�-KhU�y$U�l�/�)�@<M&E�����+R������c_r��ۉ�?F� �V�r�� a$��(4�T�#w�-Q>�2^y�������&���)[���P�o�r����:5�����^\Ր�p�X�.��鳷��K��u<Z�DN�ڟ���p���]�t���8BM*�������<}Ng?��[����I�Gq�����_&�z(�6��*ы�Ỏ�aw�z�F�[��ݼ��虉Q� V�"E��=����̤Ԣ����g�Z��g(��β7}�d2��a�j����d�s�M�\����o ��o� �G=f��:b���7S3oJ��hΐ��!�~��о;���Imn?S�l_�&�C1����a5��*�{+e�3��h�ȟQ�q iSa����{P���c�Þ�o��Bgw��>������.����w;}�4�曘ڀ���<�(�h��z+;%WC�%�I�tfk��E�Ѓ�;���+�m���0��M�{�'���쇂�=⮱�O���@NĎ��s����%*(��ϸ� �n%*�` !|Tq�5�Ĵ~H���S�� #�kGȸa��Ⱦ1;�)����e�aЁG��EF&���v�|��<�F�B?i"��ln��� ��;���V7TK|楰F�b������k:-�.��i���l�����RX�-�a#wp�uQ(�>��8 �+5�s�~D)q�s�pI2�ȯ���`L������i�b(`�/�����eT[��4��F���wo����4zy�m��K��3B��B��>�W{�ʠ��7��KL�DW�N���}a�~��dZ�K����$����R���e<-��wrm��<����b�z��-G�c?9k~�܃%4��_X@�4�8]�u�bY���vt���ڽ�Ș���3�����S�@OP5G��V� �K�����ֳȦ��U ��apR$�����'�Њ�X��V���5��o��%�*%��6/A��]� +-�;d�Pl[�v_Ȗ�5���H�c��&9Ԓud�.�@���C]k4�7���� ~��=^ř}�V���G����2������Ғd��1��(c�q2Rr ��|�O����AWyc<wk�{U��;5�>oT|�U=^A
Static task
static1
Behavioral task
behavioral1
Sample
2e72787b72ec18c1eaadb243475682c5aea086277de1199c21eebb427fadb77c_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2e72787b72ec18c1eaadb243475682c5aea086277de1199c21eebb427fadb77c_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
2e72787b72ec18c1eaadb243475682c5aea086277de1199c21eebb427fadb77c_NeikiAnalytics.exe
-
Size
2.0MB
-
MD5
f6196f8b3fedae1219e1c6153758c7a0
-
SHA1
e66bc0b677a28cd0b20f6fd60160bfb2a5c92fb6
-
SHA256
2e72787b72ec18c1eaadb243475682c5aea086277de1199c21eebb427fadb77c
-
SHA512
63605dfb7bc02a5121796ce56dabd44a34b90317cdc2d410f3eaeb13f1d4ed07ce4de0961b0674358ff3e7327593351b5e0165040feb21b9ccf073846bce3e9b
-
SSDEEP
49152:B7GxXkLYGheKa7s3ikAFNkC85CtJVOBGqP/wE2EXdy+vr:FftYKa7s/5CTVOBvwEm+v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e72787b72ec18c1eaadb243475682c5aea086277de1199c21eebb427fadb77c_NeikiAnalytics.exe
Files
-
2e72787b72ec18c1eaadb243475682c5aea086277de1199c21eebb427fadb77c_NeikiAnalytics.exe.exe windows:5 windows x86 arch:x86
f28a02eb190479f29829bde11d5e6e2d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
advapi32
OpenProcessToken
oleaut32
SafeArrayGetUBound
version
GetFileVersionInfoSizeA
gdi32
SelectObject
ole32
CoInitialize
comctl32
ImageList_SetIconSize
comdlg32
GetSaveFileNameA
shell32
SHGetMalloc
winmm
timeGetTime
ntdll
ZwSuspendProcess
Exports
Exports
Sections
CODE Size: - Virtual size: 888KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ