Static task
static1
Behavioral task
behavioral1
Sample
NEAS.a154cbea184f501a436943b39082b430.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.a154cbea184f501a436943b39082b430.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.a154cbea184f501a436943b39082b430.exe
-
Size
212KB
-
MD5
a154cbea184f501a436943b39082b430
-
SHA1
b88c76e9d5bf65a2cced7475cd367e55fe45c666
-
SHA256
60607867f1cd6ecdacae064334499cee3f3b342760a402a7f47e8b61cfdb1eac
-
SHA512
23fbf06ccd43efa39a1c36313ab3544c92c47e5217bc798efc537b9ccc43fab14f9c54325088f00386c58366ca5a11e4f6219cb7bb9db410c262afc771a2d674
-
SSDEEP
6144:9d5fzfMI7OVGM1nnGEclij27YR+O2m5Lv8+6bNptL:fVwVGM1nGAK7A+ONg+wftL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.a154cbea184f501a436943b39082b430.exe
Files
-
NEAS.a154cbea184f501a436943b39082b430.exe.exe windows:4 windows x86
34a0f4b55f44147f4a98baf875843e02
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetProcAddress
LoadLibraryA
Sleep
LockResource
LoadResource
SizeofResource
FindResourceA
lstrlenW
CopyFileW
SetFileAttributesW
GetEnvironmentVariableW
GetModuleFileNameW
ExitProcess
GetExitCodeProcess
GetCurrentProcess
GetCommandLineW
DeleteFileW
GetTempPathW
CreateFileW
CloseHandle
WriteFile
CreateDirectoryW
GetStartupInfoA
user32
MessageBoxA
advapi32
RegOpenKeyW
RegCloseKey
RegSetValueExW
shell32
ShellExecuteW
shlwapi
PathUnquoteSpacesW
PathCombineW
PathQuoteSpacesW
PathFileExistsW
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
??3@YAXPAX@Z
??2@YAPAXI@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 206KB - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ