Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b5c3c099420115ab714fdd8cbb07d500.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.b5c3c099420115ab714fdd8cbb07d500.dll
Resource
win10v2004-20230915-en
General
-
Target
NEAS.b5c3c099420115ab714fdd8cbb07d500.exe
-
Size
40KB
-
MD5
b5c3c099420115ab714fdd8cbb07d500
-
SHA1
4194ff64039d40272b4208a6cd1b9a675fca1551
-
SHA256
4a8585839a3b93e6e8c9c546396c1e683cf99533ae9ed769341c34045ddde182
-
SHA512
29e08b31c217ee3040fe90ac562d3f92a99b639f2be7dc466bd3c73678b2df5eeead868f89a14d482227f711ee2a1cbc308f1af05010e28d12d7b361e20d05d2
-
SSDEEP
768:+xyClJnqK7s0hTrqDdkW0zxuBwGo5lcy:+xyClImTrOP0z41o5l
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.b5c3c099420115ab714fdd8cbb07d500.exe
Files
-
NEAS.b5c3c099420115ab714fdd8cbb07d500.exe.dll windows:4 windows x86
434c548c3cd6ff44ba9411521be26b0c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
lstrlenA
OpenProcess
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
Process32Next
GetLastError
CreateToolhelp32Snapshot
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
ReadProcessMemory
GetModuleFileNameA
GetCurrentProcessId
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetCurrentProcess
OutputDebugStringA
Process32First
CloseHandle
ExitProcess
TerminateProcess
RtlUnwind
GetCommandLineA
GetVersion
HeapReAlloc
HeapAlloc
HeapSize
InitializeCriticalSection
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
GetStringTypeW
user32
UnhookWindowsHookEx
CallNextHookEx
wsprintfA
SetWindowsHookExA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.shared Size: 4KB - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ