C:\Users\immih\Desktop\sefism\bypass\bypass\x64\Release\bypass.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6c17b4f50dc228db455019f9d6675b50_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
6c17b4f50dc228db455019f9d6675b50_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
6c17b4f50dc228db455019f9d6675b50_NeikiAnalytics.exe
-
Size
1.7MB
-
MD5
6c17b4f50dc228db455019f9d6675b50
-
SHA1
ddbb82edddf9e0e30881757bb950769a67fed8ab
-
SHA256
bbd2bef9090dd6e80f1641829007ea029d79b2b3585e9f2a63e128ffe8b54d35
-
SHA512
9f711842348a7c584665908878de328f3f5c6f6de38682522bda5bc60e5e9632b37de3f8b672b682769f8619b54bcb55c067087f08037dba14d4ee215e9c807b
-
SSDEEP
49152:NMDcKIV5I22GgDpJNwhmaGkfwFgtDMnuJ:ynIE2AwA9FEv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6c17b4f50dc228db455019f9d6675b50_NeikiAnalytics.exe
Files
-
6c17b4f50dc228db455019f9d6675b50_NeikiAnalytics.exe.exe windows:6 windows x64 arch:x64
064ea34b663196de0c0f128a543e684e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
urlmon
URLDownloadToFileW
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
WakeAllConditionVariable
AreFileApisANSI
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
SetFileInformationByHandle
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetFileInformationByHandleEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
ReadFile
GetFileSizeEx
CreateFileA
CreateThread
QueryPerformanceCounter
VerSetConditionMask
DeleteCriticalSection
VirtualProtect
CreateFileMappingW
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
VirtualQueryEx
GetTickCount
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
GetLocaleInfoEx
WaitForMultipleObjects
PeekNamedPipe
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
LocalFree
FormatMessageA
SetLastError
GetModuleFileNameW
WideCharToMultiByte
FreeLibrary
GetModuleHandleW
CreateProcessW
SystemTimeToFileTime
ReadProcessMemory
ExitProcess
GetProcAddress
LoadLibraryW
GetSystemInfo
CloseHandle
Process32FirstW
Process32NextW
GetLastError
Sleep
CreateToolhelp32Snapshot
OpenProcess
GetModuleFileNameA
CreateFileW
WaitForSingleObject
SetFileTime
TerminateProcess
GetCurrentProcess
WriteProcessMemory
SleepConditionVariableSRW
InitializeCriticalSectionEx
HeapDestroy
HeapSize
user32
ShowWindow
GetActiveWindow
RegisterClassExW
DispatchMessageW
PeekMessageW
GetWindowRect
SetWindowDisplayAffinity
MoveWindow
TranslateMessage
PostQuitMessage
GetDesktopWindow
DestroyWindow
CreateWindowExW
CloseClipboard
GetSystemMetrics
DefWindowProcW
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
EmptyClipboard
MessageBoxA
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
SetClipboardData
GetClipboardData
UpdateWindow
OpenClipboard
UnregisterClassW
FindWindowA
GetKeyState
GetMessageExtraInfo
advapi32
CryptGenRandom
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
SetSecurityInfo
CopySid
ConvertSidToStringSidA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
OpenServiceA
QueryServiceStatusEx
OpenServiceW
OpenProcessToken
ControlService
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptCreateHash
CryptHashData
AddAccessAllowedAce
shell32
ShellExecuteA
SHGetKnownFolderPath
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
_Query_perf_frequency
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??1_Lockit@std@@QEAA@XZ
?fail@ios_base@std@@QEBA_NXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenStore
CryptDecodeObjectEx
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CertAddCertificateContextToStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
ws2_32
WSACleanup
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
accept
htonl
ntohl
gethostname
listen
ioctlsocket
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
__current_exception_context
__current_exception
_CxxThrowException
memcmp
memchr
memset
memcpy
longjmp
strrchr
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
__intrinsic_setjmp
memmove
strchr
api-ms-win-crt-stdio-l1-1-0
__p__commode
fwrite
fgetpos
fgetc
_lseeki64
setvbuf
ungetc
feof
fsetpos
fputs
fopen
fread
_read
_write
_close
_open
_popen
_pclose
_fseeki64
fclose
_set_fmode
fputc
fgets
_get_stream_buffer_pointers
ftell
__stdio_common_vsscanf
__stdio_common_vsprintf
_wfopen
__acrt_iob_func
fseek
__stdio_common_vfprintf
fflush
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
realloc
calloc
_set_new_mode
api-ms-win-crt-string-l1-1-0
strncmp
strcmp
strncpy
tolower
_wcsicmp
strpbrk
towlower
strcspn
strspn
isupper
_strdup
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_errno
exit
abort
_beginthreadex
strerror
__sys_nerr
_invalid_parameter_noinfo
_resetstkoflw
_getpid
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-filesystem-l1-1-0
_stat64
_fstat64
_unlock_file
_lock_file
_access
_unlink
api-ms-win-crt-convert-l1-1-0
strtoull
strtoll
strtol
atoi
strtod
strtoul
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
acosf
sqrtf
ceilf
cosf
fmodf
sinf
_dclass
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 544KB - Virtual size: 543KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ