IehhzrfLieerati
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c6de8016bdde72aa3e5370d684839930.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.c6de8016bdde72aa3e5370d684839930.dll
Resource
win10v2004-20230915-en
General
-
Target
NEAS.c6de8016bdde72aa3e5370d684839930.exe
-
Size
2.6MB
-
MD5
c6de8016bdde72aa3e5370d684839930
-
SHA1
1d11d29dc6db28c600733ac48ff3503565dec4fe
-
SHA256
fca7ab9e75d4044bc6fa03b255ba68e1870a71062a5b13cd1a4c9203d0b4d92d
-
SHA512
804cfe8c03472e4b926af32009756b164532a0c7e56aaac27a958d06fdb8bcb2665e768eda81916a56bda5a3c058823f59876591441c7b3b3965bae7ff5dd2fa
-
SSDEEP
49152:nGEVWj/JVjKqfAd90g6h4Xi15n09zPt6gzETa/6dwsZalOEbi/qdqDhSe:nGLuUumJK4wzpzL+ald6c9e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.c6de8016bdde72aa3e5370d684839930.exe
Files
-
NEAS.c6de8016bdde72aa3e5370d684839930.exe.dll windows:5 windows x86
0b2c37db947e538c767be7fe91b826e2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
rasapi32
RasHangUpA
psapi
GetModuleInformation
crypt32
CertAddEncodedCertificateToStore
user32
GetMenuItemID
ShowWindow
DefMDIChildProcA
HiliteMenuItem
IsCharAlphaNumericW
IsZoomed
GetWindowInfo
IsCharLowerW
WaitMessage
PostQuitMessage
EnumDisplaySettingsExW
shlwapi
StrCmpNIA
urlmon
CompareSecurityIds
msvcrt
putc
wintrust
CryptCATAdminReleaseCatalogContext
version
GetFileVersionInfoSizeA
oleaut32
SafeArrayCreate
GetRecordInfoFromGuids
GetErrorInfo
VarI4FromR4
SysAllocStringLen
winspool.drv
AddJobW
gdi32
SaveDC
GetNearestColor
CreateRectRgn
LineDDA
kernel32
EnterCriticalSection
GetSystemTimeAsFileTime
InterlockedPushEntrySList
WaitForSingleObject
CloseHandle
EraseTape
SetThreadAffinityMask
GetBinaryTypeW
GetModuleFileNameW
GetModuleFileNameA
GetProcAddress
LoadLibraryA
LoadLibraryW
IsProcessorFeaturePresent
GetProcessHeap
SetStdHandle
AllocConsole
Module32First
GetVersionExA
VirtualAlloc
shell32
SHEnumerateUnreadMailAccountsW
ws2_32
select
WSAGetLastError
advapi32
RegCloseKey
CryptDestroyKey
RegEnumKeyExW
lz32
LZOpenFileA
ole32
CoIsHandlerConnected
winmm
auxGetNumDevs
waveOutGetPosition
clusapi
ClusterResourceCloseEnum
Exports
Exports
Sections
.text Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt0 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: 260KB - Virtual size: 258KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ