GetAcrobatMPPInterface
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.97868f51d76787eb83f3574eeace17a0.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.97868f51d76787eb83f3574eeace17a0.dll
Resource
win10v2004-20230915-en
General
-
Target
NEAS.97868f51d76787eb83f3574eeace17a0.exe
-
Size
486KB
-
MD5
97868f51d76787eb83f3574eeace17a0
-
SHA1
938f33b022993e0f49c75484b1018f2668c30645
-
SHA256
96cd9da20580be909d8322091664b5d4138bef69190b382a1ac662b0beca0199
-
SHA512
80c9fab3292d2f7995bbce268494cea970d7e446a09ddf156120d13536fc130d77ae2fdf4495555a0fdb1b63ffe427a713a9cca317f79542e31233fcab221a2f
-
SSDEEP
12288:JOrTFskySAqe5Zl03jA1dKKws9fmaIVUGG:JkTi7SAqS1dKKwLaIVUG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.97868f51d76787eb83f3574eeace17a0.exe
Files
-
NEAS.97868f51d76787eb83f3574eeace17a0.exe.dll windows:6 windows x86
421a255f9060b0e1daf42f42d8030ad7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
kernel32
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GlobalLock
GlobalUnlock
GlobalFree
LoadLibraryW
GetUserDefaultLangID
FreeLibrary
GetSystemDirectoryA
GetModuleFileNameA
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetCurrentProcessId
IsDebuggerPresent
DecodePointer
EncodePointer
SetLastError
GetLastError
OutputDebugStringA
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentThreadId
LoadLibraryA
user32
DefWindowProcA
RegisterClassA
UnregisterClassA
CreateWindowExA
DestroyWindow
SetWindowPos
SetFocus
BeginPaint
wsprintfA
FillRect
GetClientRect
GetPropA
SetPropA
EndPaint
GetMessageTime
GetMessagePos
LoadStringA
gdi32
CreateDIBSection
DeleteObject
CreateSolidBrush
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
msvcr120
_stat64i32
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
?terminate@@YAXXZ
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_initterm_e
_initterm
_malloc_crt
_amsg_exit
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
??_V@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler3
memcmp
strcmp
_stricmp
free
_time64
malloc
__CppXcptFilter
vsprintf_s
_set_invalid_parameter_handler
??1type_info@@UAE@XZ
_except1
_except_handler4_common
__clean_type_info_names_internal
Exports
Exports
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 220KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 223KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ