Static task
static1
Behavioral task
behavioral1
Sample
NEAS.41aedd10634b1f7b2b33eedd226d4650.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.41aedd10634b1f7b2b33eedd226d4650.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.41aedd10634b1f7b2b33eedd226d4650.exe
-
Size
1.4MB
-
MD5
41aedd10634b1f7b2b33eedd226d4650
-
SHA1
db72c29edd8c9b9186203655d8ee356deffd1319
-
SHA256
845ede0fabd528e5239320b1cfe9a05d8e2173056f677e832d7c967fe9edd0f9
-
SHA512
84596d2eca9ba452b6041e802f84a2701d17eb2b39c9b11a58cf1b9ec3ff14dbc6cca292a202eb05478cb0af722db4994714c965895b41ccb9dad4d25c1fe697
-
SSDEEP
24576:zL69RNi07Rx8t2zxfK3QPAy6SoTdDSuX9yJmMSlUCuD7tLEz:S9RNiYRGtt3QPkouEJmMTTB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.41aedd10634b1f7b2b33eedd226d4650.exe
Files
-
NEAS.41aedd10634b1f7b2b33eedd226d4650.exe.exe windows:4 windows x86
2d6215ccd292634a98ddc87050aeda6b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEnvironmentVariableA
GetEnvironmentStrings
Sleep
ResumeThread
SuspendThread
GlobalFree
ExitProcess
GetVersion
MapViewOfFile
CreateFileMappingA
OpenFile
GetModuleFileNameA
FreeLibrary
lstrcpyA
GlobalAlloc
IsBadWritePtr
GetCurrentProcess
VirtualProtect
LoadLibraryA
CloseHandle
GetFileSize
GetCurrentThread
GetCurrentDirectoryA
GetSystemDirectoryA
CreateFileA
GetFullPathNameA
GetVolumeInformationA
GetDriveTypeA
GetLogicalDriveStringsA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetTickCount
GetLastError
ReadFile
WriteFile
DeviceIoControl
SetLastError
LocalFree
lstrlenA
FormatMessageA
WinExec
SetFileAttributesA
RtlUnwind
UnhandledExceptionFilter
TerminateProcess
SetHandleCount
GetFileType
DuplicateHandle
GetProcAddress
DeleteCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsGetValue
HeapCreate
GetEnvironmentVariableA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCurrentProcessId
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesA
MoveFileA
CreateDirectoryA
SetEndOfFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapReAlloc
HeapSize
SetStdHandle
GetStringTypeA
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
FlushFileBuffers
GetLocaleInfoA
GetLocaleInfoW
CompareStringA
CompareStringW
CreateThread
GetModuleHandleA
GetStdHandle
GetStartupInfoA
user32
KillTimer
GetActiveWindow
SetTimer
MessageBoxA
wsprintfA
netapi32
Netbios
rpcrt4
UuidCreate
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueA
RegSetValueA
RegQueryInfoKeyA
RegCreateKeyExA
RegEnumValueA
GetUserNameA
RegOpenKeyA
RegSetValueExA
RegCreateKeyA
wsock32
getsockname
bind
socket
closesocket
Sections
0000001 Size: 844KB - Virtual size: 842KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0000002 Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0000003 Size: 56KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 156KB - Virtual size: 154KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0000005 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0000006 Size: 61KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0000007 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0000008 Size: 279KB - Virtual size: 279KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
0000009 Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ