Static task
static1
Behavioral task
behavioral1
Sample
NEAS.cfc7907b2f11162fcd70706eafd3bf70.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
NEAS.cfc7907b2f11162fcd70706eafd3bf70.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
NEAS.cfc7907b2f11162fcd70706eafd3bf70.exe
-
Size
5.3MB
-
MD5
cfc7907b2f11162fcd70706eafd3bf70
-
SHA1
b2bbab6a2e6fef8dc720df7bb26765ff2905e4e7
-
SHA256
b0927b4d4b2354facf813744a94af46dca41ac5e097b21674f7a54e1956aa6c5
-
SHA512
e328d9c9f4e0f1825ad26a54cab3f6477d25d88bac4488d1f882f213f433d3ea57eaa443637c71929a81212ad6b87e2c98149df8c8f8fe83a23885ef77b31371
-
SSDEEP
98304:oeCE87SfY0gqYH49SW1sqLsvF8vA1zeVGiYbye15hs0WGStguj6irpKVKNImSb91:Gn1WHt5js9XgCziIiJN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.cfc7907b2f11162fcd70706eafd3bf70.exe
Files
-
NEAS.cfc7907b2f11162fcd70706eafd3bf70.exe.exe windows:6 windows x86
d03694b43198eacd1d868ffa51ca41dd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileAttributesA
WriteConsoleW
HeapQueryInformation
HeapSize
SetEndOfFile
OutputDebugStringW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetStdHandle
SetFileAttributesW
SetCurrentDirectoryW
GetTimeZoneInformation
CreateProcessW
GetExitCodeProcess
GetFileAttributesExW
FlushFileBuffers
MoveFileExW
DeleteFileW
CreateDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTempPathW
HeapAlloc
ReadConsoleW
HeapFree
GetConsoleOutputCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetFullPathNameW
GetDriveTypeW
SetConsoleCtrlHandler
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
InterlockedFlushSList
ExitProcess
RtlUnwind
GetThreadTimes
FindFirstFileA
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
GetFileType
GetEnvironmentVariableA
MoveFileExA
FormatMessageW
SetLastError
SleepEx
SetFilePointerEx
GetModuleFileNameW
WaitNamedPipeW
CreateFileW
PeekNamedPipe
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
CompareStringEx
GetLocaleInfoEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
GetModuleHandleW
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetSystemTimeAsFileTime
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
FlsFree
FlsSetValue
SetThreadPriority
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
SetEvent
Process32Next
Sleep
OpenProcess
Process32First
GetSystemInfo
GetLastError
ReadProcessMemory
FindNextFileA
FindClose
GetUserDefaultUILanguage
MoveFileA
GetCurrentDirectoryA
lstrlenA
GetPrivateProfileStringA
DeleteFileA
CreateMutexA
ReleaseMutex
GetModuleFileNameA
GlobalFree
GetFileSizeEx
FlsGetValue
FlsAlloc
SetFileInformationByHandle
LCMapStringEx
DecodePointer
EncodePointer
GetStringTypeW
LocalFree
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
QueryPerformanceFrequency
FormatMessageA
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
WaitForSingleObjectEx
QueryPerformanceCounter
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
SetFilePointer
ReadFile
OutputDebugStringA
WinExec
GetModuleHandleA
GetCurrentThread
SetUnhandledExceptionFilter
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleA
GetConsoleMode
GetDynamicTimeZoneInformation
GetCurrentThreadId
WriteFile
GetFileAttributesA
GetStdHandle
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
CreateDirectoryA
AllocConsole
GlobalAlloc
GetCurrentProcess
Module32Next
CloseHandle
Module32First
GetCurrentProcessId
CreateToolhelp32Snapshot
GetTickCount
GetCurrentDirectoryW
MultiByteToWideChar
InterlockedPushEntrySList
GetSystemDefaultLangID
user32
SetWindowPos
LoadIconA
SystemParametersInfoA
GetKeyState
LoadImageA
DestroyCursor
ShowCursor
SetCursor
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
FindWindowA
SetWindowLongA
RegisterClassA
GetMenu
SetWindowTextA
GetWindowRect
AdjustWindowRectEx
LoadCursorA
GetMessageA
GetKeyboardLayoutNameA
GetKeyboardLayout
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharNextExA
CharPrevExA
MonitorFromPoint
GetMonitorInfoA
GetWindowLongA
DefWindowProcW
SetCursorPos
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
MessageBoxA
LoadStringA
GetSystemMetrics
TranslateMessage
ScreenToClient
GetCursorPos
PostQuitMessage
GetAsyncKeyState
SetRect
OffsetRect
GetClientRect
ClientToScreen
PeekMessageA
ReleaseDC
FillRect
GetDC
EndPaint
BeginPaint
InvalidateRect
FlashWindowEx
GetCapture
DispatchMessageA
ShowWindow
gdi32
GetStockObject
EnumFontFamiliesExA
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
SelectObject
SetBkColor
SetTextColor
TextOutW
CreateCompatibleDC
DeleteDC
SetDIBitsToDevice
GetTextExtentPoint32A
CreateDIBSection
SetBkMode
GetPixel
GetDeviceCaps
TextOutA
PatBlt
CreateSolidBrush
DeleteObject
StretchBlt
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeEx
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
winmm
timeEndPeriod
timeGetTime
timeBeginPeriod
timeGetDevCaps
d3d9
Direct3DCreate9
d3dx9_43
D3DXMatrixScaling
D3DXVec3Project
D3DXVec3Unproject
D3DXMatrixPerspectiveFovRH
D3DXMatrixOrthoRH
D3DXMatrixOrthoOffCenterRH
D3DXCreateMatrixStack
D3DXCreateCylinder
D3DXCreateSphere
D3DXCreateTextureFromFileInMemoryEx
D3DXGetFVFVertexSize
D3DXMatrixLookAtRH
D3DXMatrixRotationY
D3DXSaveSurfaceToFileA
D3DXPlaneNormalize
D3DXQuaternionRotationYawPitchRoll
D3DXVec3Transform
D3DXMatrixTranspose
D3DXVec3TransformNormal
D3DXMatrixRotationX
D3DXMatrixInverse
D3DXMatrixDeterminant
D3DXMatrixRotationYawPitchRoll
D3DXMatrixRotationQuaternion
D3DXQuaternionRotationAxis
D3DXSaveTextureToFileA
D3DXQuaternionMultiply
D3DXVec2Normalize
D3DXMatrixMultiply
D3DXMatrixTranslation
D3DXVec3TransformCoord
D3DXMatrixRotationZ
D3DXVec3Normalize
D3DXMatrixRotationAxis
D3DXVec4Transform
python27
PyExc_RuntimeError
PyTuple_GetItem
PyInt_AsLong
PyArg_ParseTuple
PyDict_Type
PyString_FromString
PyString_AsString
_PyThreadState_Current
PyModule_AddIntConstant
Py_InitModule4
Py_BuildValue
PyDict_SetItemString
PyList_New
PyList_Append
PyTuple_Size
PyDict_GetItemString
PyLong_AsLong
PyLong_FromLongLong
PyDict_New
PyDict_SetItem
PyLong_FromUnsignedLong
PyTuple_New
PyTuple_SetItem
PyImport_ImportModule
PyObject_GetAttrString
Py_CompileStringFlags
PyImport_ExecCodeModule
PyDict_Size
PyDict_Next
PyString_InternFromString
PyObject_GetAttr
PyCallable_Check
PyLong_AsUnsignedLong
PyErr_SetString
PyFloat_AsDouble
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_SetPythonHome
Py_Initialize
Py_Finalize
PyRun_StringFlags
Py_FlushLine
PyImport_GetMagicNumber
PyImport_AddModule
PyObject_AsCharBuffer
PyCode_Addr2Line
PyEval_EvalCode
Py_OptimizeFlag
Py_NoSiteFlag
Py_FrozenFlag
Py_IgnoreEnvironmentFlag
PyCode_Type
PyUnicodeUCS2_DecodeUTF8
PyInt_FromLong
_PyLong_FromByteArray
PyFloat_FromDouble
PyComplex_FromCComplex
PyString_FromStringAndSize
PyList_SetItem
PyErr_Occurred
PyErr_NoMemory
PyEval_GetRestricted
PyCode_New
PyMarshal_ReadObjectFromString
_PyLong_New
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
PyLong_AsLongLong
PyEval_SetTrace
devil
ilInit
ilSetPixels
ilTexImage
ilSave
ilShutDown
ilDeleteImages
ilCopyPixels
ilConvertImage
ilGetInteger
ilLoad
ilOriginFunc
ilEnable
ilBindImage
ilGenImages
imm32
ImmNotifyIME
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
imagehlp
StackWalk
GetTimestampForLoadedLibrary
EnumerateLoadedModules
granny2
_GrannyFreeControlOnceUnused@4
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetMeshVertices@4
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannyFindTrackGroupForModel@12
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannySetTrackGroupLOD@16
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetSourceModel@4
_GrannyGetMeshIndexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
GrannyPNT332VertexType
_GrannyFreeControl@4
_GrannyDeformVertices@24
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
_GrannyCopyMeshIndices@12
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyReadEntireFileFromMemory@8
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannySetLogCallback@4
_GrannyNewMeshDeformer@16
_GrannySetControlEaseInCurve@28
_GrannyFreeMeshDeformer@4
_GrannyGetFileInfo@4
mss32
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_update_3D_position@8
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_sample_status@4
_AIL_set_sample_loop_count@8
_AIL_set_sample_volume_pan@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_auto_update_3D_position@8
_AIL_WAV_info@8
_AIL_set_file_callbacks@16
_AIL_file_read@8
_AIL_decompress_ASI@24
_AIL_mem_free_lock@4
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_stream_volume_levels@12
_AIL_close_digital_driver@4
_AIL_open_stream@12
_AIL_open_digital_driver@16
_AIL_file_type@8
_AIL_decompress_ADPCM@12
_AIL_start_3D_sample@4
speedtreert
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
dinput8
DirectInput8Create
ws2_32
WSAStartup
WSACleanup
htonl
htons
WSAGetLastError
ntohl
ntohs
gethostbyname
gethostname
socket
send
sendto
recvfrom
getsockopt
freeaddrinfo
getaddrinfo
listen
accept
WSAIoctl
WSASetLastError
setsockopt
getsockname
getpeername
bind
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
select
recv
ioctlsocket
connect
closesocket
__WSAFDIsSet
inet_addr
ddraw
DirectDrawCreate
bugsplat
??1MiniDmpSender@@UAE@XZ
?setGuardByteBufferSize@MiniDmpSender@@QAEHH@Z
?sendAdditionalFile@MiniDmpSender@@QAEXPB_W@Z
?setMiniDumpType@MiniDmpSender@@QAEXW4_BS_MINIDUMP_TYPE@1@@Z
??0MiniDmpSender@@QAE@PB_W000K@Z
advapi32
RegCloseKey
RegOpenKeyExA
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
CryptAcquireContextA
CryptReleaseContext
shell32
SHGetSpecialFolderPathA
oleaut32
SysFreeString
VariantClear
VariantInit
SafeArrayAccessData
SafeArrayDestroy
SafeArrayCreate
SysAllocString
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CertCreateCertificateChainEngine
CryptQueryObject
CertFreeCertificateChainEngine
wldap32
ord200
ord30
ord79
ord301
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord217
ord143
ord35
ord46
normaliz
IdnToAscii
IdnToUnicode
Sections
.text Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 708KB - Virtual size: 708KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 717KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ