�`}�$§>��^��q� E�t�W���ɡ��\�(S�վB��"L��m�D�� lF'��l�:P��rn�/�i1�r+��e��tO��9"e_��ͬ��� �lpq��nċ���U������h�h�Y� ��_^��D�_�����֝��X��bc��UFv#mM++݂x� �F3�j�'��!���19#�=�\t�����LS�K��+�}Ě���ܞ[HZ���i�o���)+mqO��/��A-���6�$��c��q��٦�\�w����4*��� 됶���tc��죱**m��5T��(a����{�RᜊX��H��tw#�>l������H�P������p%�lBA�z�)�|��˴���&}Iv� �_��7�K��ܓ�R�����\��(��O�~⺣9�!�lh�"9J�W���gu���I���A\lI�#�OV���&u��[d��W�H�xdٽO`G�}2����9���^Ѷ���$ϡy�T�����筺i���O!������AR�fE�p�a���í�"p�LHC������x���Ԫu������hZk��Գ�ZUuV`乮�I�3�j��#���`b_���OO�P���k�yGZ<i��3e�c!��Ez��ߠ�wk���Ւ�ht� 1:�PN^��~��gOv��w6P=��d����xŴ��}(SV��&�_İ��-�*[��j���HI3Lǝa���������(ڹL��)������s�N�����m�݃�+�F�Pm��A��ud�}nt��_umk����+���q��N�XA���$������4Z!�zڍP(K� �M��5������~(I�� �ƽ���j@��� ��|(3��0�� �r��ݘ;��J��d ��g�t����s�S^�v#͖N��p��sT.ƍ蘎v�T�Կ�7�p$��$\�CZ�=�qw;�� j. ��=d{������?j����f��kv� �VU��e�_����:X���Z�q�[�UM��2z��I�X�y��GrR6<aX79�~u<\�:c=Ջ� �ѓ'l���c~��)���Yb��H^�V4_l�5s��0@R?WGn���='�@By��>#�Y���)If��"�`U�6��q� ������nB:r�q�y���e�P\'�:*��e��s�Z��'Ȟ����F4�꓅as���)�u�&��K�pK��.���?��7����FXgQ�J�<#�J��p��,m_���Lj��r~f�!�#��'�[;� zv�������\ZUW{;��`2L��I!W=�1W�)kA�u��c��X4e~.���*�O�����v�@o�1��s�w[�ӵ���h�?�M4}�B �0�3�3Dxǎ��HJl�sQ��~ M�\č[�ξ��3��$�[&I��>����CK����������8:D�1e/�,���j�0z��p�?E� �\�[������6�RGSf����'fE!F�Z������o��lLu��O��QԷ�q��bB��Q=:x���:���2���@��-���P+�Ϫ�ml��v��M�3�_4� �B�Px&�������.C�U�܀K�Spٰ��z`�0�J�Cs$�z�Ϝ�C�"�h��@���C�y�'��bX�F*0,L���N�n�{�d�M��(B�~g�z�J=��p��I��np�ĭ����>��xz�:;9�8���V(o�U��r�o1��� ρh�&��J��;�~\}���z�<�x]���\����oQ��r�p��\�'ST��Nܳ2��'[n{���[@�W�b��A�wf� �Q3挃 �Bo����i��T� q��ږ�+�כ��G��3c�n��+�,��㆗��fip�r�sc�V�.��t��#�۫���M��6�"������ZN�;�����|����AΔ�n�P3?f�-:�v��B�x�?�x`�Iؙ��h�+�Q�� ���M Ql\�Y鼣G:�v�^SP�c�7�ҹ�mh����VyR���\��>���\JK��݇$۟"^��%tӼ��6�]3UH!����Z�ͦu�O�͚�ԕ��=>zCZ��n~����"Z�E��w�9Ⱥ6`��y�foq>1�`Bc"l��":���q`d���_ݣ��?�y�[Ө�S-)�#�����t�3�fٜ�b<��@�e#"0�^�@�a����C���� ��o[{}7x����pT������������S�_su�u���y����r��+~MU�f�cko�>�ї��s��|�b��Y�@J9D���a��ƍ����2�$������j�5�R�ө���͈+7{�lNa,�o�}ez2f;"H�W���:�!6H�s�(�������N��P����A�mt�o��`����1�l�ӪDr㬮�Rj��Llc�p��D� ��&�Vq���������i$�]�H���X��w�9<-�8,SYG���*�}o������D�F����UcC�L���6�e�~����Z��c�;~�p��Dy�z��1��D�jǯJ ��O ���4���XL�4���@�nR�5p��$벅�@���!�!D"�w֏����C��JX�D~N�&4�u��>��JP出c�Z,��1�ij�*J�MY����� ����S7� ���S<���{��t�Aۨ���'M3�7�D|������D�����3��RiҴo9��H��6�0�u7�^%�� �G�3 �ڈ'�-㱛5��F�4�|+�w�*a�` +�~��#��� ��?�}cPN��#�lw`��X<W=[�*�¾2���Y��3�r���(��ԥ<���Pd�(�(��m��I���4��q�K\Sr}�nV|���q���%�Ƨ��Dv���:e҃ըiZm�[Ej�L��]��!_� �WVCۏ���-+|%p��\[~�����4�]5��N�ف�rY��8���_�y�\��$����� ��X�[)�%���XU/�`֬���U�Z�s��}X�>rh�zZ��W���m߲�)�u�A(�<>7�b3B��G�60�W��g �� %Z/�c�o�ݽ�c���'�Y������m��
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.a7b4c1529e2e4548d74a297563671540.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.a7b4c1529e2e4548d74a297563671540.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.a7b4c1529e2e4548d74a297563671540.exe
-
Size
830KB
-
MD5
a7b4c1529e2e4548d74a297563671540
-
SHA1
5ce8c74162c9c9bdde66527c6be206a0d47d92c5
-
SHA256
52bc6ef278dff346505837045d52bf0b2214a3cb7802053a9255ec98af22ee55
-
SHA512
b997fc79e1acd04361c526c7f048878ea91ca85076b66849aac075b153a05ae37a4b7729f86ba72666fb6a8938a8a8770a6a9ee6f83d0d146570d436b3ef0f8a
-
SSDEEP
24576:WsiiBGdZUJC/emhA8kg0Fo3Jhp0s9UHdr:s5LUJC/DANfo3Jhph9kB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.a7b4c1529e2e4548d74a297563671540.exe
Files
-
NEAS.a7b4c1529e2e4548d74a297563671540.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Exports
Exports
Sections
CODE Size: - Virtual size: 900KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 40B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ffe0 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 20KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ffe1 Size: - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ffe2 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ