Static task
static1
Behavioral task
behavioral1
Sample
NEAS.95423cba99f3bb73f016c0a746d477b0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.95423cba99f3bb73f016c0a746d477b0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.95423cba99f3bb73f016c0a746d477b0.exe
-
Size
65KB
-
MD5
95423cba99f3bb73f016c0a746d477b0
-
SHA1
4d86c7957235753ea20a02184c63e6b6c43ab5d8
-
SHA256
3e42c967eb37633a45137e72460e8705c783a817ba1a7418d002033b2be93cbb
-
SHA512
c6a8c644c279cb828fadb1317e4a9632ac0be7161255eb3f17ce1b378a40fa457ffa8cf13b319f8d2291aecc5c52e8a2066530f6dc4a3ac13ad04de6746b6e87
-
SSDEEP
1536:3r0a+0LZcTjRSs3dRtgIByvmSr4HOqLLe:3rJ+0LW11dXgIA7qOoe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.95423cba99f3bb73f016c0a746d477b0.exe
Files
-
NEAS.95423cba99f3bb73f016c0a746d477b0.exe.exe windows:4 windows x86
49cd973b58cfcf1547b30a16e54a01bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord1775
ord354
ord356
ord1907
ord5161
ord5160
ord4742
ord4948
ord4358
ord5265
ord4377
ord4854
ord4998
ord4710
ord2514
ord6052
ord5186
ord2770
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5287
ord3798
ord4835
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord4078
ord5261
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord489
ord768
ord4258
ord4976
ord941
ord4160
ord5953
ord2642
ord3092
ord1783
ord2864
ord5162
ord2938
ord4905
ord3098
ord3097
ord6215
ord2446
ord2818
ord1151
ord1199
ord3318
ord3616
ord1147
ord3178
ord3319
ord2781
ord924
ord6385
ord1779
ord1146
ord1168
ord2393
ord5355
ord2763
ord5353
ord2683
ord5356
ord5808
ord1075
ord5204
ord3229
ord2638
ord1228
ord940
ord3663
ord535
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord4424
ord3738
ord561
ord815
ord2528
ord2621
ord1134
ord1908
ord4715
ord1690
ord6055
ord1776
ord5288
ord4837
ord4439
ord2054
ord4431
ord771
ord1008
ord497
ord4259
ord1979
ord665
ord1567
ord537
ord2764
ord800
ord825
ord6010
ord1980
ord926
ord1105
ord668
ord350
ord3126
ord5651
ord1832
ord1243
ord823
ord599
ord690
ord389
ord3638
ord1988
ord268
ord540
ord353
ord5442
ord5773
ord860
ord4277
ord858
ord4129
ord939
ord1193
ord3127
ord922
ord4123
ord2614
ord1576
ord600
ord269
ord1578
ord826
ord1176
msvcrt
_exit
exit
__dllonexit
__p__commode
_onexit
_XcptFilter
_initterm
_acmdln
__getmainargs
__setusermatherr
_controlfp
??1type_info@@UAE@XZ
_EH_prolog
free
_strdup
_stricmp
_CxxThrowException
__CxxFrameHandler
_adjust_fdiv
_except_handler3
__p__fmode
__set_app_type
_setmbcp
kernel32
OpenProcess
lstrcmpiA
MulDiv
SetEvent
Sleep
ResetEvent
CreateEventA
ExitProcess
GetExitCodeThread
TerminateThread
WaitForSingleObject
lstrcatA
lstrcpyA
GetProcAddress
GetVersionExA
lstrlenA
DeleteFileA
CopyFileA
GetFileAttributesA
CreateDirectoryA
GetDiskFreeSpaceA
GetFullPathNameA
lstrcpynA
IsDBCSLeadByte
LocalFree
LocalAlloc
GetModuleHandleA
GetStartupInfoA
CloseHandle
TerminateProcess
user32
SetTimer
PeekMessageA
TranslateMessage
KillTimer
DispatchMessageA
wsprintfA
EnableWindow
GetParent
SendMessageA
PostMessageA
LoadIconA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCloseKey
RegEnumKeyExA
RegSetValueExA
shell32
ShellExecuteA
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ