Static task
static1
Behavioral task
behavioral1
Sample
NEAS.345cff45c38273f47e207eaa255b9240.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.345cff45c38273f47e207eaa255b9240.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.345cff45c38273f47e207eaa255b9240.exe
-
Size
2.3MB
-
MD5
345cff45c38273f47e207eaa255b9240
-
SHA1
97121df4a976e27d61d5a93ed7f38ddf329789a9
-
SHA256
8bca1a090c5b7d6dc7a74dfca4818a859ba641b205b63bfb0bea7c80006e9a21
-
SHA512
287f87940a3d1d566743d28edac2fd9d2fbfa44386f5ed314d6fe496c138c9d0ee8c49c62971400d362438c2c593ca4b58ff0c1a01a53cd048ff781375e78b35
-
SSDEEP
49152:GGLkoJ5pXUhdyYXCruuporAOwCBmDSxbjAOdnGvHKy:GGj/XUhMUGuAOB7xbkOdnGvqy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.345cff45c38273f47e207eaa255b9240.exe
Files
-
NEAS.345cff45c38273f47e207eaa255b9240.exe.exe windows:4 windows x86
ab2e583b5b14e73af1fc91e46f646724
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHDeleteKeyA
kernel32
GetModuleHandleA
InterlockedDecrement
GetFileAttributesA
GetTempPathA
CreateDirectoryA
DeleteFileA
CloseHandle
WaitForSingleObject
ResetEvent
CreateEventA
FindClose
FindNextFileA
FindFirstFileA
GetCurrentThread
SetFilePointer
CreateFileA
ReadFile
SystemTimeToFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryA
SetFileTime
WriteFile
GetCurrentThreadId
LockResource
LoadResource
SizeofResource
FindResourceA
UnmapViewOfFile
GetTickCount
FreeEnvironmentStringsA
GetStdHandle
SetEndOfFile
GetLocaleInfoW
WriteConsoleW
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetEnvironmentStringsW
Sleep
SetHandleCount
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
ExitProcess
HeapSize
GetEnvironmentStrings
GetConsoleMode
GetConsoleCP
HeapReAlloc
VirtualAlloc
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
FreeEnvironmentStringsW
GetLocaleInfoA
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
GetLastError
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
HeapFree
GetProcessHeap
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
HeapAlloc
GetCommandLineA
GetVersionExA
GetStartupInfoA
LCMapStringA
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
VirtualFree
user32
GetWindowThreadProcessId
wsprintfA
SetForegroundWindow
GetDesktopWindow
GetWindow
GetClassNameA
GetForegroundWindow
MessageBoxA
advapi32
ImpersonateSelf
OpenThreadToken
MapGenericMask
AccessCheck
RevertToSelf
GetFileSecurityA
ole32
CoUninitialize
CLSIDFromProgID
CoInitialize
CoCreateInstance
oleaut32
VariantChangeType
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantCopy
SysFreeString
SysAllocString
VariantInit
Sections
.text Size: 140KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ