�$F�Gtʧ�\: 7�������k:��٭D�'�b��ɤ7x[���m��~ �B�ÃXa�dxEMt��̴�3��s� �O�A�����'L4L�oC������o��/��L|�$S;�^ �* �(K�*0�<!�2���702+}U~��O��7���jO�=/�Y�2M��Y�Q/���(��۹�]Q:�7H���}4��;��������22Fg�� ��h�0�?��*��d>@��.9 .���kH����(Iﭭ��R���`��:q���C�߲�$ �ʇ��r�����N�]�0tR|��=~�}V�H?��j�^4�P�0f!�t����'x(��/Q� � �_�S9,)��{��iu�7�f�N�{�����n�c�t���+���?��Wu<�\�51��t�q�T�l�Pb��N�6{^mjV�MT���F��!;i���v�\Ԝ͆��i�+#�p� �0'���4a���U�Ц��)��P#�*��)��@˵O ùy��J�4P����H�T������1�nfC����䳟?���-����z���,�E��_����?�F,��j ot~��]p��]_ �����B�_g�"O9�H�ˬ�9�]吟v��$j� Wx��7e4K�jZ���Y�r������h�o��K�T�=�ڊ�ѿ�"s-8�`{���6�g@.��T7u)���g+� ��'%��L&^Ϋ�2.�}�S�Ϣ�~���w�T���*Em�]�,����8��x��MD]����8������q���[%s6�����W�.��c�_H����N֠�-�;ى2��i�EVZxo���GQ�RZ�P8�T��擦�"�Kػ�3G+O�]c[zjJ�yg*a��p�:v��w��DIU"m��!;[ �>�˃W�1%�"���$AD����n<�b�I;���R1�ۼ#���U�sDWT+�p��\���a�t<w�.D����\&24dA���6'���I�=k�xU�t?�xS'r�~�:�'ߚb���?�b��Fo��橌V�@��0�H� ��0�8Ț/]=��M�*_r~��LS1znt����>��5I�re�[�������/ %����7������+�Ǒ3M_���l?�?Y^+`!j�"a��L�(��a�P�SL�� �䋪u����S/�I+�0�� ���j5����;��'U��K*��-I���"^Tkk:���n�yW��_����m3ۀY_Á�F/��K�{���;�0���վ�r�X|��[���yg2�T�̋Y��C��~q��5��"�|��r����+����v30����W[�N�¡�|�[�����.�)��=*��2Ϸ����V����K�+�ēZ��s�������C�\�X���J?(�9Pp�mOf|�5�Y�mP}a[vֈ�PORnr����1������y��}aWqE��~WH(Д���y_�{�����n�U��ؖ������B�no�H����f�2�D~8�3Fa���_�_�`�l�t�L{��c�-��� <6�U�".wȸ��S`c�4���7���.�Q^���W�;��� �Ѥ�,���|����>S]��u���U��C���kѮnWb����H?~{�bQ�!�m6_,&?+ ��Pj�b�>hQ�9v��@�ͦ]���,���C�/@� �/܅G�����*yAq W�,��W!�ݼ?�}e{�P��� j��Ĉ�6bH�3��PaD�ɲ�<���y3'�Ѱ�t"9����jM�����Z������o 7�վ�������!���nf�*�z1�-ia���qX�Kf��4�� v�9��(��\����F�G0����Hs�D�%!���W�O���#-�΅�=B) �8]���#��y��*����+�c��S�Ӡ�ш���_`l���ٖ�5D�^���$�����'�ɵ���*2]����!�F��n���o�֊���M��U�@t>!���=���,W֕��9�:ݮy_��n7� �F���(� �� ��u1�5MhK)��%U���Mۚ꩞6��e�f��L�e>�83Ey��Zs�2�F,�5`����{����}4����^����������P-�6`p\:���FqR���U�xpT����"�*!ی�3�)`>ML���^�����ˈT���ԮK��0����������M�-t&����|��La19��]PXaAظ�&�Ħ���͇δ�I-�蔄0� ���B1C�ᆼL���>�t..��^�o1X�T����� �_vv�K�2��Lje`<b�4�8)y����o�)�^����7$5t�:�{��O��-� �L�lq*ҢZlM�� 9�y�%�A� T��m��B��%�l^�,�2�Q6��~����e�����w~��q�4�j��{���[�1�хn+F X�ϧ,����Y�����V�[2Dd�m�8P�{-�{d����(��0̀,`��"��'�V�:8w7���w�W T �P/#׃���S�Mfhtl�*��ZV�$o�0�g����0;�%K� cc.��\!�[4��l�=������!7:�}�/r�,��vڀ'o�4��g�P�`a�$�����V��X]�a���n��x[��?���MǾ� s�ƒvu?�uo���%-x��{�ڕ5 .�f����O���B�!羺i1�f �.e� ����s]�C�q:�{16~`� 8�5�"-����a�=n0�YX����%��{�l�F���Ҭ9J��"dp^k�{̉���"�O�$���ڲO ����oZe&�n��k�pB������k��u��#�(�?Ed�$�Q��E��~�:�����AC�EM���Q�������-����$Y�i����9����Z}�w�k��f Z���&{�Tş�(��q�|�����#;�;��z���SC'.�"1�a��c`A��+R�6F��a�`?���|k����J�Ѧ=8��K�~�k��i�al�L%�'��"�� 5v������� �E{��oh��;�Ls��i
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b365d2a2509e3c3c29e61170875800f0.exe
Resource
win7-20230831-en
General
-
Target
NEAS.b365d2a2509e3c3c29e61170875800f0.exe
-
Size
6.3MB
-
MD5
b365d2a2509e3c3c29e61170875800f0
-
SHA1
f432afab906338d5e7ce1e7648e7a35d895d6fd2
-
SHA256
b5f653d96b84a454d780e8b7e8414a5dbbdd330bc145ab9b37919e8df1ce1200
-
SHA512
33f8a7a123b7a5109f56d93e37aec49b1fa4337e571710fb829d40589662812d83be6f83365fde9c20e08e071d39839bebe4e21653bd94b51142fd38f6731416
-
SSDEEP
196608:w2WLwZBKa6qC4QNYeQ3t1/Ku/fXHQL2VQBWG:waKa6I+YewbnCB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.b365d2a2509e3c3c29e61170875800f0.exe
Files
-
NEAS.b365d2a2509e3c3c29e61170875800f0.exe.exe windows:5 windows x86
5ed34984463359416da0a53852c9d7ad
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
AddVectoredExceptionHandler
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__dllonexit
winmm
timeBeginPeriod
ws2_32
WSAGetOverlappedResult
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 92KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.911s50 Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.911s51 Size: 5.8MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE