Static task
static1
Behavioral task
behavioral1
Sample
NEAS.cd9fc5449da7f5a6d6c9ec7f5f82b0e0.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.cd9fc5449da7f5a6d6c9ec7f5f82b0e0.dll
Resource
win10v2004-20230915-en
General
-
Target
NEAS.cd9fc5449da7f5a6d6c9ec7f5f82b0e0.exe
-
Size
2.3MB
-
MD5
cd9fc5449da7f5a6d6c9ec7f5f82b0e0
-
SHA1
e9bf4c641071179c13f946107eb932fffd830490
-
SHA256
7aca43b2917288e7756e34ca265fc4156f20cf90380f7cd65c98cd71553b8cc6
-
SHA512
38e800a10307f6062c955d24308697ccd3e1379b96903989f5dc690e6e7326e226756ea8985864af35a968b6a18f8e347b8d3fa8f22936b1ee9faf27c9df238d
-
SSDEEP
49152:W5fZHOPOuHqdOet4U2mFxLVV54yBMMVsyL/Vj0YEFP0G:OZuzHqdOe2U2sRcZMdNj0YEFsG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.cd9fc5449da7f5a6d6c9ec7f5f82b0e0.exe
Files
-
NEAS.cd9fc5449da7f5a6d6c9ec7f5f82b0e0.exe.dll windows:5 windows x86
45154259d4ed1f0b452c38e1ebc31d67
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
oleaut32
SysAllocStringLen
GetErrorInfo
LoadTypeLibEx
GetRecordInfoFromGuids
VarBstrCat
clusapi
ClusterRegCreateKey
wintrust
CryptSIPGetSignedDataMsg
OpenPersonalTrustDBDialog
setupapi
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
version
VerQueryValueA
ws2_32
select
WSAGetLastError
kernel32
GetVersionExA
Thread32First
SetThreadLocale
GetUserDefaultLCID
SetConsoleMode
TerminateThread
GetSystemInfo
InterlockedPushEntrySList
EnterCriticalSection
WaitForSingleObject
GetSystemTimeAsFileTime
GetProcessHeap
IsProcessorFeaturePresent
VirtualAlloc
Process32FirstW
SetStdHandle
GetModuleFileNameW
GetBinaryTypeW
GetUserDefaultLangID
CloseHandle
GetModuleFileNameA
HeapWalk
DeleteAtom
LockFileEx
gdi32
SetTextCharacterExtra
StretchBlt
StartPage
SetWindowExtEx
CreateColorSpaceW
Chord
winmm
mmioClose
waveInReset
rasapi32
RasHangUpW
shell32
ShellExecuteW
msvcrt
putc
memset
shlwapi
SHRegDuplicateHKey
ole32
OleCreateMenuDescriptor
HPALETTE_UserFree
lz32
LZOpenFileW
LZOpenFileA
psapi
GetModuleFileNameExW
user32
ArrangeIconicWindows
ShowWindow
CharNextExA
GetUpdateRect
GetUpdateRgn
CreateWindowExA
GetMenuState
SetMenuItemBitmaps
IsIconic
PostQuitMessage
GetWindowInfo
winspool.drv
AbortPrinter
advapi32
RegCloseKey
LookupPrivilegeNameW
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ