Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c6bb7cc6c8a4ca37fbfb79aa7dcf5a00.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.c6bb7cc6c8a4ca37fbfb79aa7dcf5a00.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.c6bb7cc6c8a4ca37fbfb79aa7dcf5a00.exe
-
Size
1.7MB
-
MD5
c6bb7cc6c8a4ca37fbfb79aa7dcf5a00
-
SHA1
87f9601dd0a2f88ca885e0fe208664d6b5b42bdd
-
SHA256
923bbba53b06dacfba9ac1d91c410f5237ba69f1608716049bc934c51f26a2ab
-
SHA512
ed86e6feb033e297c4402626925f6c408a3cb4376127bbc3938a7871c524996f159a22a66995c5b0f2f1a04b4b504acbb6ec7777a7a881b68e88bd57dec2ccd5
-
SSDEEP
24576:gDhYARZFIZQte3R7brjEkaNGisGAtq0Oz9KnuCgXDeBn7JJj:gDmMZFXKR0F0V2zgnu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.c6bb7cc6c8a4ca37fbfb79aa7dcf5a00.exe
Files
-
NEAS.c6bb7cc6c8a4ca37fbfb79aa7dcf5a00.exe.exe windows:6 windows x64
7d8d12210c6a12a94d11aaddba5964cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
opengl32
glGenTextures
glPixelStorei
glBindTexture
glClear
glTexImage2D
glTexParameteri
glGetIntegerv
glGetString
wglGetCurrentDC
wglGetProcAddress
glViewport
kernel32
ExitProcess
CreateThread
CloseHandle
Process32Next
Sleep
CreateToolhelp32Snapshot
OutputDebugStringW
VirtualQuery
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
OpenProcess
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetEnvironmentVariableA
WaitForSingleObjectEx
ReadProcessMemory
GetTickCount
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LocalFree
FormatMessageA
SetLastError
GetModuleHandleA
GetModuleFileNameA
GetCurrentProcess
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetModuleHandleW
SetThreadExecutionState
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TlsAlloc
Module32First
Module32Next
GetStdHandle
SetConsoleTitleA
WriteProcessMemory
Process32First
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
TlsGetValue
TlsSetValue
FormatMessageW
VerSetConditionMask
GetLastError
MoveFileExA
TlsFree
GetCurrentThreadId
user32
AdjustWindowRectEx
SetWindowTextW
RemovePropW
GetPropW
SetPropW
ReleaseDC
GetDC
SetForegroundWindow
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
MapVirtualKeyW
SetFocus
IsZoomed
SetCursorPos
SetCursor
GetMonitorInfoA
ToUnicode
UnregisterDeviceNotification
RegisterDeviceNotificationW
EnumDisplayMonitors
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
GetRawInputDeviceList
GetRawInputDeviceInfoA
GetCursorPos
ScreenToClient
GetMonitorInfoW
SystemParametersInfoW
WindowFromPoint
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
FlashWindow
SetLayeredWindowAttributes
GetLayeredWindowAttributes
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
DefWindowProcW
WaitMessage
PostMessageW
SendMessageW
GetMessageTime
PeekMessageW
DispatchMessageW
TranslateMessage
TrackMouseEvent
GetWindowThreadProcessId
GetKeyState
GetWindowRect
MonitorFromWindow
GetSystemMetrics
GetActiveWindow
GetRawInputData
ClipCursor
RegisterRawInputDevices
SetClipboardData
CreateIconIndirect
LoadImageW
DestroyIcon
LoadCursorW
GetClassLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
SetRect
BringWindowToTop
GetClipboardData
ClientToScreen
GetForegroundWindow
ShowWindow
mouse_event
GetClientRect
FindWindowA
OpenClipboard
CloseClipboard
EmptyClipboard
SetWindowLongA
GetAsyncKeyState
MessageBoxA
gdi32
DescribePixelFormat
CreateBitmap
CreateRectRgn
SwapBuffers
DeleteObject
CreateDIBSection
CreateDCW
DeleteDC
GetDeviceCaps
GetDeviceGammaRamp
SetDeviceGammaRamp
ChoosePixelFormat
SetPixelFormat
shell32
ShellExecuteA
DragQueryPoint
DragAcceptFiles
DragQueryFileW
DragFinish
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmAssociateContextEx
msvcp140
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Random_device@std@@YAIXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bid@locale@std@@QEAA_KXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
d3dx9_43
D3DXMatrixTranspose
D3DXVec3Transform
normaliz
IdnToAscii
wldap32
ord79
ord35
ord30
ord200
ord33
ord26
ord22
ord143
ord41
ord217
ord46
ord32
ord50
ord45
ord60
ord301
ord211
ord27
crypt32
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFindCertificateInStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertCloseStore
CertOpenStore
CryptStringToBinaryA
ws2_32
htonl
accept
select
WSACleanup
listen
ioctlsocket
WSAStartup
getaddrinfo
freeaddrinfo
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
recvfrom
closesocket
recv
htons
getsockopt
getsockname
sendto
gethostname
getpeername
send
bind
ntohl
WSAGetLastError
__WSAFDIsSet
connect
rpcrt4
UuidCreate
RpcStringFreeA
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
__current_exception
__current_exception_context
__C_specific_handler_noexcept
__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
memchr
memcpy
__C_specific_handler
__std_exception_copy
__std_exception_destroy
strchr
strstr
__std_terminate
memcmp
_CxxThrowException
memset
memmove
api-ms-win-crt-stdio-l1-1-0
fseek
__stdio_common_vfprintf
fwrite
fputs
fopen
ftell
_set_fmode
_lseeki64
fclose
_open
_popen
_pclose
fgets
_close
_write
_wfopen
__stdio_common_vsprintf
fread
_read
__stdio_common_vsscanf
__p__commode
fflush
__acrt_iob_func
feof
ungetc
fopen_s
fputc
fgetc
__stdio_common_vsprintf_s
ferror
api-ms-win-crt-string-l1-1-0
strcspn
strncmp
strspn
strcpy
wcscmp
wcscpy
tolower
strncpy
strpbrk
isupper
strcmp
strcpy_s
_strdup
strcat_s
strlen
api-ms-win-crt-utility-l1-1-0
qsort
abs
api-ms-win-crt-heap-l1-1-0
malloc
free
calloc
realloc
_callnewh
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtod
strtoll
strtoull
strtoul
atoi
strtol
atof
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_wassert
_errno
abort
strerror
exit
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_invalid_parameter_noinfo
_resetstkoflw
__sys_nerr
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
system
terminate
_beginthreadex
_getpid
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-math-l1-1-0
powf
__setusermatherr
_dclass
ldexp
ceilf
fmodf
pow
atan2f
sqrtf
sinf
sqrt
cosf
acosf
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_access
_unlink
_stat64
advapi32
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CopySid
OpenProcessToken
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
GetTokenInformation
IsValidSid
GetLengthSid
Sections
.text Size: 952KB - Virtual size: 951KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 472KB - Virtual size: 515KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ