�)��.� 7+����T�/4�\'q<����g����� (�Ƅ͊{���'�(���$��^*%��-p��p2��Ul�>�5f���YK�)gZ[ie��@R$-���~݅c�����7젂>���MNt@�p���YX`���A�N��V �k�u�j�ѹ��O����?����[T_�f���5�s�eA6�G��V�&], �(M��'e�Q����EA��g�pH�ef��@�_��&�6�K.8&�D"&��&����/��/q[�8���撇/��я<_8�ڲ�rO��&k!i��v���D�Z��nܞG�����m80Q����_GD���$�yS��D����?h���J{�����7Pt4X'3ڔQ����Pz���~^!�����%�H<��Ԣ��|��Q�`0"�v���BE�[�Pj�Ͷ�j��\������^I0�Y�www�� 3��8���Y�8���tn@%R9web�j���u:_�@�00�?}�lj�q�]��6�"����dR^&�������r_3��nͶ@![C|�+��,��m)H���� :� >١TR������~9���b"�U�T���yϳ|�y�c}������%�i�)��B1QN�[�`L?��N� ~|]�g�ᨇ�\|-D���}Bm�=���|/��`�V�v������~��a{G��Nd���L���EI��&�����$(8�<�]HK'��Qq���8����vGe�ɋb��'�x��<��G'�o�jTh==����O\�j�I4-��l�v;pd��t�3����`����-�۞���fj�s�,d��UYCc�)/k�J��"��(��^69�T�n��)G�XFc���\�gMX��a�v"�A?����݆x��dФo�ZCً:�_�u�q(Y�Rl��Z2m��Ε��]V��{!� ��x�������Iu�$�ʐ��_Q@L&���#'}L�?���YȺ���XZ�i$�fD�ijm0W���������)�P ��`ۼ���)����4�K�ң0�˩���k�u{���ƥUEO˲�O���k�B�8�<�E�s9�u���.$��q�^a�m���/,,��8��Q�x��JQ�:����+ �O�uE'.��fÑŮ�<����v�K���[���L�q)Ѭ#��"X�8O!��:�L8V�úxmv�ĉ�������2�Q�!��q{�.�7??D �ttF.�� +�:�S�nz�:����3�B4]���܊� �3��Y&���M��`��e���QZ��F�s1y��BeC����ױ{,`�� �t6�4�?�E$m� �}�}���HQ��@,���N���9e�T$VA ����D�ifX�4��!5��������G~��r#�h#�s��N[��v!�F~����F��9��ѿ���v����3�>�U�7T���6�v� ���x��� ;XϬ�A��ƣ]{��]QI~����m����,���.��0n�B��&�.d{�(�O���U��X �A�I���;M��p]��ލ��>��!4����\����3�+�%Y��k��?�gϡ�c�����J���\��;02��ë}P~� �{�kZOΉ��ΤN[�xF3hw������ pzVف�!O�ݩ��J�:�<��5Cǣ�i]:��A�)��!�A�J������(��s�{�(���#Ӷ��9!� �=H�)Ʃ�+���p3���VO�������&$\I��H0|<2���{���8����)H'��%tV��<#.���R�,�zۚ�c�M4�|l/�w� *c�ܱ��f8����s�ۀ�?S��y�O|�����C�i(�2v��z�̾�-0 u������BY������@4�;[VDL7XS��CW�%�� ���p�{V+^����@ǏUR:À)6�6Hh���p �6q��b��{c!ة2�M� ���ڂQ>'m�(VQ����1x�`l�%�'��$;<�7�F���'#�a�쵪~�3��A�RQVL�\��V&���Mٻ~�t�~=z� <v�/U�����&�kLW=�vMk�hmI�����'��}���2�ΰ �ۄD�5�T��2V���{W&W�fi���>��s��0�����T�����Ch����Yv�pm��DV�w�q�`U�h����0/K�Ǽ��bM�Hges�b�H��c6A��������a�ܤ�oӰ�m~2��0�_"����:�Uk��T� ] ��~G�0tjD�6Ύ�Y s(C��QF{'�֢����>y�g��84����� ���sr�qd���6������%)��k�ͷf,ڕB�iǐxj}�IZX�>�Ȓ�����e�vf<+ݑ��S�t1:��7ne��!�a~uG��>�b�� _�]R��5?���;�8���y�O=)�f��=��4H�L�����Ve�^��B.�%/|G�߿�Ug�p��1�a^)�vy�D��W!�3���v�G�:1>~��!Ua�v�= �yH��tdb����4�6�k��r���^[�I�/�XWUEܵ����.l���rس�{�!E���a���(k�o�<�z;�[x��z���bW�����,�� [��Fb���i���o)�w>QVコ��;�������`|o��KzΦ��=�V^�(�s ~�o��t� �@!�s�f�I�3�e����O$Ym�0j�i�|~��.�u ����,�bu6��ŗl���>� \�5��w���nhg)�,�*(�|�����;��zV����>Kk�ט5��0��������n����%f��f}p�!����:��cH��W�9v6%�ԩ���s����fLT���)���)^�/�m�a�w��#���@,V���J!(����k��5 p;���Kw9{���$��l��;�gu��viJx�T��4>��ղ��_��v���:��,_4�c=f����æ��(���8;�+�����*]ُc���� |�,O� ٘P'*�eWY/'g������n3�'d��t�����謺;�o1�2#NI8�O<mh0��`���^����o�A
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.df75839c0a7e6cb1af8c4ca6e0f85fb0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.df75839c0a7e6cb1af8c4ca6e0f85fb0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.df75839c0a7e6cb1af8c4ca6e0f85fb0.exe
-
Size
6.8MB
-
MD5
df75839c0a7e6cb1af8c4ca6e0f85fb0
-
SHA1
cbb2dfb09117ea3951be3ef8d637b716f69db0cd
-
SHA256
68ec035e5d7c81a43dc9763400918afed4f018ea6543edf1c2a764ae3f7036e0
-
SHA512
76654968106e9a327f3d1e16b691f2675502fbb43fca861bfb5c778ea8bdd194b7948afb29e25dc6207fe6e54f9e681c8b9217a0d471a48dfb3e0aff6a8627a6
-
SSDEEP
98304:vvsdKskZ5lMQDIWnAYSmm9+2l2M0Dd21hlac10V/zKG56dd/cVDHRR4fvqA2:vvsk3JIWkdME9a80zG/s7A2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.df75839c0a7e6cb1af8c4ca6e0f85fb0.exe
Files
-
NEAS.df75839c0a7e6cb1af8c4ca6e0f85fb0.exe.exe windows:6 windows x64
67d5e7ca8df21029e0799db5cfd963a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
kernel32
SetLastError
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
CharUpperBuffW
advapi32
CryptGenRandom
shell32
ShellExecuteA
ole32
CoCreateInstance
imm32
ImmSetCandidateWindow
msvcp140
??1_Lockit@std@@QEAA@XZ
userenv
UnloadUserProfile
winmm
sndPlaySoundA
ntdll
NtResumeProcess
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFindExtension
ws2_32
ntohl
rpcrt4
UuidCreate
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
sqrt
Exports
Exports
Sections
STREETL$ Size: - Virtual size: 715KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREETk< Size: - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
STREETkI Size: - Virtual size: 791KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
STREET03 Size: - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
STREETt8 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREETw8 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
STREETA% Size: 6.8MB - Virtual size: 6.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
STREET(] Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ