Static task
static1
Behavioral task
behavioral1
Sample
NEAS.618b0c3d398a92e9777bd04b3cfd6c20.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.618b0c3d398a92e9777bd04b3cfd6c20.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.618b0c3d398a92e9777bd04b3cfd6c20.exe
-
Size
2.9MB
-
MD5
618b0c3d398a92e9777bd04b3cfd6c20
-
SHA1
204914965854f0138d1396cae21e7e2bce038491
-
SHA256
ad354d0b72bb74faca1c836910467f9e7e2125b645b1f3d72ab6a82b89616d71
-
SHA512
47c9dfe1427b8559654c7a3142c1bd713cfc96498aa5521009c0360a5b37215150d53081bd0c72c645ff9bd15ca6b2b75993220695d282775a6eb9d6f023ea2b
-
SSDEEP
49152:1ft++k9PPhbYplbA3TWw3dszkbnbZE7wYuzNRlN1QV5ZySLZAPd:1F+vPOAyw3h7bZE7wYuA5ZySad
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.618b0c3d398a92e9777bd04b3cfd6c20.exe
Files
-
NEAS.618b0c3d398a92e9777bd04b3cfd6c20.exe.exe windows:4 windows x86
0806754c293999cb8a45bb24f7671a02
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
GetModuleHandleA
VirtualAlloc
GetSystemInfo
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
RaiseException
GetLastError
TerminateProcess
OpenProcess
Process32Next
Module32First
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
GetModuleFileNameA
HeapFree
HeapAlloc
GetProcessHeap
CloseHandle
CreateFileA
GetProcAddress
SetFilePointer
GetFileSize
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
GetTickCount
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
WriteFile
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
FlushFileBuffers
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsBadWritePtr
HeapCreate
SetUnhandledExceptionFilter
GetCommandLineA
GetStartupInfoA
VirtualQuery
GetCurrentProcess
ExitProcess
RtlUnwind
HeapSize
HeapDestroy
VirtualProtect
ReadFile
VirtualFree
user32
SetTimer
SetWindowTextA
RegisterClassA
DefWindowProcA
KillTimer
MessageBoxA
CreateWindowExA
LoadCursorA
RegisterClassExA
IsWindow
UnregisterClassA
LoadIconA
CopyRect
GetClientRect
GetClassNameA
GetWindowLongA
SetWindowLongA
UpdateWindow
PostQuitMessage
SetWindowPos
PostMessageA
GetWindowRect
MoveWindow
EqualRect
BeginPaint
EndPaint
LockWindowUpdate
IsIconic
ShowWindow
SetForegroundWindow
GetMessageA
TranslateMessage
DispatchMessageA
InvalidateRect
ReleaseDC
GetDC
SetFocus
GetFocus
SetCapture
ReleaseCapture
RedrawWindow
gdi32
GetDeviceCaps
GetStockObject
shell32
ShellExecuteA
ole32
CoInitialize
CoUninitialize
CoGetMalloc
oleaut32
SysAllocStringLen
SysFreeString
SysAllocString
VariantClear
urlmon
CreateURLMoniker
Sections
.text Size: 76KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 856KB - Virtual size: 852KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Shared Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE