Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f077cc6c443d4e4b064774ec4e1006c0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.f077cc6c443d4e4b064774ec4e1006c0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.f077cc6c443d4e4b064774ec4e1006c0.exe
-
Size
731KB
-
MD5
f077cc6c443d4e4b064774ec4e1006c0
-
SHA1
528c1ffb93fa4234be08a024bff34cf0145aa38a
-
SHA256
250675c4f4547db3104d0e0bb8e9c95f7c4eec33bd6efdacb812922e1b9663be
-
SHA512
ffc613fcad963f533e8c4bbbbcc359ed649d5afe827b26a8b9cb9218c3f55a91ce881dd75005a731a31967883509c01d87ffc23f22ab9b8daa3aaa16199ac424
-
SSDEEP
12288:xKsJ9wIrTOKUop71xWrvkSdbPGxX1d8PUTl4dC2iD1iKx7LWtVRAJ0eT1kdWkqBD:xhT3GGxX1d8py1iKxnW7RAOasDe2Vt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.f077cc6c443d4e4b064774ec4e1006c0.exe
Files
-
NEAS.f077cc6c443d4e4b064774ec4e1006c0.exe.exe windows:6 windows x86
ecb2f59e8151e4ba3e421d3696c7b00e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
CreateThread
GetCurrentThread
CreateProcessA
GetThreadContext
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualProtect
FreeLibrary
GetCurrentProcess
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetStartupInfoA
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetLastError
SetUnhandledExceptionFilter
CloseHandle
CheckRemoteDebuggerPresent
WaitForDebugEvent
ContinueDebugEvent
IsDebuggerPresent
CreateDirectoryA
GetModuleFileNameA
FlushConsoleInputBuffer
GlobalMemoryStatus
GetTickCount
MultiByteToWideChar
WriteFile
GetFileType
GetStdHandle
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetCommandLineA
user32
GetProcessWindowStation
MessageBoxA
GetUserObjectInformationW
advapi32
RegisterEventSourceA
ReportEventA
GetUserNameA
DeregisterEventSource
shell32
SHGetFolderPathA
msvcp120
??1_Lockit@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
msvcr120
ftell
printf
rewind
sprintf
exit
getenv
free
malloc
__iob_func
fprintf
memchr
strncmp
fseek
strstr
_stat32
_access
_mkdir
fflush
fgetc
fgetpos
fputc
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
_lock_file
_unlock_file
memcpy_s
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
_lock
fread
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_except_handler4_common
_except1
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
fopen
fclose
memset
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
_strnicmp
_putenv
wcsstr
_vsnprintf
raise
feof
ferror
fgets
_fileno
_wfopen
_errno
_setmode
isdigit
strchr
strncpy
isspace
realloc
qsort
_time32
strcmp
isxdigit
atoi
sscanf
isupper
tolower
strtoul
_gmtime32
signal
fputs
_getch
??0exception@std@@QAE@ABQBD@Z
memcpy
__CxxFrameHandler3
_CxxThrowException
memmove
??3@YAXPAX@Z
??2@YAPAXI@Z
_purecall
_unlock
strrchr
Sections
.text Size: 432KB - Virtual size: 431KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 59KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ