��ņ i��n+�F��! &��}������`����\ϩ�t��E�~fR}l{�����J{������HyG'a� ��`�@�O�B�Ps';駐!hw]he�}��g�����W*wH�P�f6�.�#U~�Ԁ��#�Y��7$ĺv��cX�@�>��:p&��� �N�R|�vF@��n�6�|��0J�շQ��&�7Tuz[Z�H<�1���T������l���}1z%�Za��{S-r5��x|1ԩ�eY�������,�XrH� ���c�ʄ��Sw�L�S���� P�-h�<ϖ4kʈ���M�:�9(��C�.O�y�oDrI{`2y0c���}v/���JÐ�h;��Rr3)���5Q<�������!�m�����H��]X^G)`�6�BQ@�`�J.3`CN1�O��e(���?E�H&���H���z���g<���0��������FTԊh �Öi�����~!�N���Y���l�,HL��$���g��!PB�k��GQ^L�-����?�8`���GZ�����#��+��j!B�G��AE�{)�W+�I_4�Q����t����Na p��挎u�bp@�6'>���,�q�+5�9?M�j��z�鍈�|�ao!�W{�:액Ǎ�QC�(��t���wo��I��V�5=n������YwI�}ӆ�6V\�A��� ��g��y&K��KU��T������G0�#���O _Nr����E��Wtl�����f��v����ٸ*����.�C� �`�۩ �6��e9V͗����d��iX����y�9�ʟ����xL���y�c�������X{��1��"M��½ȕV u(���,�G������<�>��Jq��Mv�(��8ti�׳�|�2��T��n�"�&�c��k�H�Z�O��V�D1:�6�5x�K!���#��>/�����V1̩�A������O@�X��T�3\��}Z��HӪ�����n�BwiEJ9�r7���jο3���^�g�C�F�s{��~2�D�����,Y3�H�;�S\�<���^�_���pY~���W�=.B^�3�B�=�SY)/$P��T��� N. ������I�����\>?fx1���S��v�Rz��]�����9�\� a~m���Z����e��E�q�OB��� ���uh_�g m|�tW����v'���o����0�yѾ���{6N| "bq��qX�tv���&S���.ᓬp�Q*y/۸( BBr�O,��?�_�a��:��0���V���ˋn#W��h�>G[F��� q�\&�+<�V3����Kf���@���OO"��ˏ���8t��6'�%�af��PD�W{�*���K��L���w)k.�s���XXVFp���ݾ���!$��4=n{��bL47e6��va�<�Q��E0����'[���?j蘼��IV��������x���J�u�h҃���-��3�܌r��T�:����%**�\�M.uڝP��'9ۻ���O�2p�6[�-�g����{�qN�G���L(�����y��K���r_�Z/�u��y�0�k,���U'�2��?O�P}p��5�_��;6)�� ��NCu���7\�|�%�ݸ�<�K8o�[1^��M�:%� 9����Р�"*�Kv�&�3��u�zt���m7>��D�>��:����������$-UʗJ_*�j��ݟOx2�"��.]�Wql鳩�<�N%</�nrR.�P���?����ZW����$>�c��]o�Ӌ��V�,��@z����z6�U�"r �۬����Eqf��r2aV&�9��4��+�[ T��R��"���"��;���KV� �Pք�����5~aX&���T?��c[�mI�D��p.:�S>Whաy�q�ݖ�|5������y��h�@�^!65q����b�P��s��V!**�����C�h�� ,Vm��k��\*��)lU�oΘ���F&�V���Mk �a���֚@ �����r�]�����DP+��u� /�l���D����-j�Fg�������?胁�����7�a�dy���3S@7�&��c�� Ue�;%�ht��R��T�+}��Kٗvgf��1��(�O�ҋ��F��(���(l��+^� �9�ذ�#;BI SE�FBİ�7D��86o�]"��([� ��~ua�.�j�q����(S�o��k��s�`�HH� 9���@-�#�����VD��`���|S��3�G��L������&�-�%��Z�%�kq����9M?ܖ6:lmI.G-���. �jCq\������������C���i+r�$����`��ӗ͜6q�vKވ���g8 ��:��x���RG�n!����~w�XWC��+��qǞ������<6���Mi�z���C� �N�ԝ����G��yBd�5��lL^gh���w+�p忰q#��D����:����ae!�~�"~�=�Cb�Q"���J+��bQ��<�K����a�$�iې��˥��v��v�����������MĠ�_�/eѐt���k��{'I K�2x?K� ���or#X,���{�&� M]���ך�({��!��L ��9�h���5�*���nj�h�<)�_\+^�1��a�?��v�����<��_:uc��X:�櫢2�:�d8#���F�¡)����z�~8/ܬ@��� �w��5^Q7�2��Dx�U��a��%?�Kc������ƙ���wz��4�b�#�L���-��M,G�X2ވ`��)%1�|�r=R��!���^�����yi��k�'�c���g7�xlH�lv,� q"��;�v��ra;Τ`8�Q;#b��ӠWZR%� �@�������c@O7��ѳ�_�.�ck�y�\�ֺ����8�R���ڀ���!��M �{����FljY� ;^�k��~E�vƐ���]�tI Y;w�>��`]�� Y��vA܇i��ɁZ������Օc2�)Ӛ�%a��-KP����a�u�9����ڶZ����N��iK��BsyXB]w`���a'���
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.3c322e87bb2b531dcb3363b6157d0db0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.3c322e87bb2b531dcb3363b6157d0db0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.3c322e87bb2b531dcb3363b6157d0db0.exe
-
Size
2.0MB
-
MD5
3c322e87bb2b531dcb3363b6157d0db0
-
SHA1
4e79e39bf91f999bd158da00809249c6830dd784
-
SHA256
d9d5d3fcec29b5518d3f172adb1be719d22ce456e06a9d0868d14e2d1b89affc
-
SHA512
c8627e54db278c45d5b6d622845eaa307f97ac26e3f9c7d867d093d8ae7a715809e17b990990c3127ce486a165e673b95d430546ec0c076a3d00e1dc6e03f4ea
-
SSDEEP
49152:VmuiW3bHdY3NYx2+hqHIoqJUNgi7VYuECumnosd:0udLHdY3NoZhacCb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.3c322e87bb2b531dcb3363b6157d0db0.exe
Files
-
NEAS.3c322e87bb2b531dcb3363b6157d0db0.exe.exe windows:4 windows x86
83444d0cd4dd2e75a5715efd0aa76ecf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFPException
kernel32
FindResourceA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 942KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE