Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2ccb98f544d00af5d9d28b12b47c26c0.exe
Resource
win7-20230831-en
windows7-x64
Behavioral task
behavioral2
Sample
NEAS.2ccb98f544d00af5d9d28b12b47c26c0.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
General
-
Target
NEAS.2ccb98f544d00af5d9d28b12b47c26c0.exe
-
Size
165KB
-
MD5
2ccb98f544d00af5d9d28b12b47c26c0
-
SHA1
cd8e2595829d19e59cdd81adee13e37d4b7eea7a
-
SHA256
17fc163f7b3290f360551b3830e59550d0befb71c3e8ef6cb64e47ef149bd7de
-
SHA512
12a49208efad78bef9ee548d83a9ebb928885884bd7f2f2e8434bcdb0f71e13692a0ccb01e8bc248d680ee711020367fdc57dd015ed723f6304ab3511ebac75d
-
SSDEEP
3072:DX0y706/h9qErCL08uEauOkmdU8JyofyEWftymB58:A0089RrCLBauz1EWNu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.2ccb98f544d00af5d9d28b12b47c26c0.exe
Files
-
NEAS.2ccb98f544d00af5d9d28b12b47c26c0.exe.exe windows:4 windows x86
bbd1d97084a29ad9ea0b3f1dc10c5f78
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
quazip
_ZN10QuaZipFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN10QuaZipFile5closeEv
_ZN10QuaZipFileC1ERK7QStringS2_N6QuaZip15CaseSensitivityEP7QObject
_ZN10QuaZipFileD1Ev
_ZN6QuaZip12goToNextFileEv
_ZN6QuaZip13goToFirstFileEv
_ZN6QuaZip4openENS_4ModeEP19zlib_filefunc_def_s
_ZN6QuaZip5closeEv
_ZN6QuaZipC1ERK7QString
_ZN6QuaZipD1Ev
_ZNK6QuaZip10getZipNameEv
_ZNK6QuaZip18getCurrentFileNameEv
qt5core
_Z11qUncompressPKhi
_Z21qRegisterResourceDataiPKhS0_S0_
_Z22qInstallMessageHandlerPFv9QtMsgTypeRK18QMessageLogContextRK7QStringE
_Z23qUnregisterResourceDataiPKhS0_S0_
_Z5qrandv
_Z6qsrandj
_Z9qBadAllocv
_Z9qChecksumPKcj
_Z9qCompressPKhii
_ZN10QArrayData10deallocateEPS_jj
_ZN10QArrayData11shared_nullE
_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE
_ZN10QByteArray10fromBase64ERKS_
_ZN10QByteArray11reallocDataEj6QFlagsIN10QArrayData16AllocationOptionEE
_ZN10QByteArray6appendEPKc
_ZN10QByteArray6appendERKS_
_ZN10QByteArray6appendEc
_ZN10QByteArray6expandEi
_ZN10QByteArrayC1EPKci
_ZN10QByteArrayaSERKS_
_ZN10QJsonValueC1ERK7QString
_ZN10QJsonValueC1ERKS_
_ZN10QJsonValueD1Ev
_ZN11QDataStreamC1EP10QByteArray6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QDataStreamD1Ev
_ZN11QDataStreamlsEs
_ZN11QDataStreamrsERs
_ZN11QFileDevice5closeEv
_ZN11QFileDevice5flushEv
_ZN11QJsonObject10initializeEv
_ZN11QJsonObject4findERK7QString
_ZN11QJsonObject6insertERK7QStringRK10QJsonValue
_ZN11QJsonObjectD1Ev
_ZN11QJsonObjectixERK7QString
_ZN11QMetaObject10ConnectionD1Ev
_ZN11QMetaObject14normalizedTypeEPKc
_ZN11QMetaObject18connectSlotsByNameEP7QObject
_ZN11QMetaObject8activateEP7QObjectPKS_iPPv
_ZN11QTextStream7readAllEv
_ZN11QTextStreamC1EP9QIODevice
_ZN11QTextStreamD1Ev
_ZN11QTextStreamlsEPKc
_ZN11QTextStreamlsERK7QString
_ZN11QTextStreamlsEc
_ZN11QTextStreamlsEx
_ZN12QMapDataBase10createDataEv
_ZN12QMapDataBase10createNodeEiiP12QMapNodeBaseb
_ZN12QMapDataBase11shared_nullE
_ZN12QMapDataBase18recalcMostLeftNodeEv
_ZN12QMapDataBase8freeDataEPS_
_ZN12QMapDataBase8freeTreeEP12QMapNodeBasei
_ZN13QJsonDocument8fromJsonERK10QByteArrayP15QJsonParseError
_ZN13QJsonDocument9setObjectERK11QJsonObject
_ZN13QJsonDocumentC1Ev
_ZN13QJsonDocumentD1Ev
_ZN13QJsonDocumentaSERKS_
_ZN16QCoreApplication18applicationDirPathEv
_ZN16QCoreApplication4exitEi
_ZN16QCoreApplication9argumentsEv
_ZN16QCoreApplication9translateEPKcS1_S1_i
_ZN18QCryptographicHash7addDataERK10QByteArray
_ZN18QCryptographicHashC1ENS_9AlgorithmE
_ZN18QCryptographicHashD1Ev
_ZN4QDir14setNameFiltersERK11QStringList
_ZN4QDirC1ERK7QString
_ZN4QDirD1Ev
_ZN4QUrlC1ERK7QStringNS_11ParsingModeE
_ZN4QUrlD1Ev
_ZN5QFile4copyERK7QStringS2_
_ZN5QFile4openE6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN5QFile6existsERK7QString
_ZN5QFile6removeERK7QString
_ZN5QFile6removeEv
_ZN5QFileC1ERK7QString
_ZN5QFileD1Ev
_ZN6QDebug12putByteArrayEPKcjNS_13Latin1ContentE
_ZN6QDebug9putStringEPK5QCharj
_ZN6QDebugD1Ev
_ZN6QTimer10singleShotEiPK7QObjectPKc
_ZN7QObject10childEventEP11QChildEvent
_ZN7QObject10disconnectEPKS_PKcS1_S3_
_ZN7QObject10timerEventEP11QTimerEvent
_ZN7QObject11customEventEP6QEvent
_ZN7QObject11eventFilterEPS_P6QEvent
_ZN7QObject11qt_metacallEN11QMetaObject4CallEiPPv
_ZN7QObject11qt_metacastEPKc
_ZN7QObject12moveToThreadEP7QThread
_ZN7QObject13connectNotifyERK11QMetaMethod
_ZN7QObject13setObjectNameERK7QString
_ZN7QObject16disconnectNotifyERK11QMetaMethod
_ZN7QObject16staticMetaObjectE
_ZN7QObject5eventEP6QEvent
_ZN7QObject7connectEPKS_PKcS1_S3_N2Qt14ConnectionTypeE
_ZN7QObjectC2EPS_
_ZN7QObjectD2Ev
_ZN7QString13toUtf8_helperERKS_
_ZN7QString14compare_helperEPK5QChariPKciN2Qt15CaseSensitivityE
_ZN7QString15fromUtf8_helperEPKci
_ZN7QString15toLatin1_helperERKS_
_ZN7QString16fromAscii_helperEPKci
_ZN7QString17fromLatin1_helperEPKci
_ZN7QString18toLocal8Bit_helperEPK5QChari
_ZN7QString6appendERKS_
_ZN7QString6numberEdci
_ZN7QString6numberEii
_ZN7QString7replaceERKS_S1_N2Qt15CaseSensitivityE
_ZN7QStringaSERKS_
_ZN7QThread4quitEv
_ZN7QThread5startENS_8PriorityE
_ZN7QThread6msleepEm
_ZN7QThreadC1EP7QObject
_ZN7QThreadD1Ev
_ZN8QProcess13startDetachedERK7QString
_ZN8QVariantC1EPKc
_ZN8QVariantC1ERK7QString
_ZN8QVariantC1Eb
_ZN8QVariantC1Ei
_ZN8QVariantD1Ev
_ZN9QDateTime15currentDateTimeEv
_ZN9QDateTime22currentMSecsSinceEpochEv
_ZN9QDateTimeC1Ev
_ZN9QDateTimeD1Ev
_ZN9QFileInfoC1ERK7QString
_ZN9QFileInfoC1ERKS_
_ZN9QFileInfoD1Ev
_ZN9QIODevice5writeEPKcx
_ZN9QIODevice7readAllEv
_ZN9QListData11detach_growEPii
_ZN9QListData11shared_nullE
_ZN9QListData6appendEv
_ZN9QListData6detachEi
_ZN9QListData7disposeEPNS_4DataE
_ZN9QMetaType22registerNormalizedTypeERK10QByteArrayPFvPvEPFS3_S3_PKvEi6QFlagsINS_8TypeFlagEEPK11QMetaObject
_ZN9QSettings8setValueERK7QStringRK8QVariant
_ZN9QSettingsC1ERK7QStringNS_6FormatEP7QObject
_ZNK10QByteArray3midEii
_ZNK10QByteArray4leftEi
_ZNK10QByteArray6isNullEv
_ZNK10QByteArray8toBase64Ev
_ZNK10QJsonValue6toBoolEb
_ZNK10QJsonValue8toStringEv
_ZNK11QJsonObject4keysEv
_ZNK11QJsonObjectixERK7QString
_ZNK11QMetaObject9classNameEv
_ZNK11QObjectData17dynamicMetaObjectEv
_ZNK13QJsonDocument6objectEv
_ZNK13QJsonDocument6toJsonENS_10JsonFormatE
_ZNK13QJsonDocument6toJsonEv
_ZNK13QJsonValueRef7toValueEv
_ZNK13QJsonValueRef8toObjectEv
_ZNK14QMessageLogger5debugEv
_ZNK14QMessageLogger5fatalEPKcz
_ZNK14QMessageLogger7warningEv
_ZNK18QCryptographicHash6resultEv
_ZNK4QDir13entryInfoListE6QFlagsINS_6FilterEES0_INS_8SortFlagEE
_ZNK4QDir5rmdirERK7QString
_ZNK4QDir6existsEv
_ZNK4QDir6mkpathERK7QString
_ZNK5QFile4sizeEv
_ZNK5QFile6existsEv
_ZNK5QFile8fileNameEv
_ZNK7QObject10objectNameEv
_ZNK7QString8multiArgEiPPKS_
_ZNK7QThread9isRunningEv
_ZNK8QVariant5toIntEPb
_ZNK8QVariant6toBoolEv
_ZNK8QVariant8toStringEv
_ZNK9QDateTime8toStringERK7QString
_ZNK9QFileInfo16absoluteFilePathEv
_ZNK9QFileInfo4sizeEv
_ZNK9QFileInfo5isDirEv
_ZNK9QFileInfo8fileNameEv
_ZNK9QFileInfo8filePathEv
_ZNK9QIODevice11errorStringEv
_ZNK9QSettings5valueERK7QStringRK8QVariant
_ZeqRK7QStringS1_
_ZltRK7QStringS1_
qt5gui
_ZN5QFont12setPointSizeEi
_ZN5QFontC1Ev
_ZN5QFontD1Ev
_ZN5QIconC1ERK7QString
_ZN5QIconD1Ev
_ZN6QImage4fillEN2Qt11GlobalColorE
_ZN6QImageC1ERK5QSizeNS_6FormatE
_ZN6QImageD1Ev
_ZN7QPixmap9fromImageERK6QImage6QFlagsIN2Qt19ImageConversionFlagEE
_ZN7QPixmapC1ERKS_
_ZN7QPixmapD1Ev
_ZN8QPainter10drawPixmapERK7QPointFRK7QPixmap
_ZN8QPainter10setOpacityEd
_ZN8QPainter3endEv
_ZN8QPainterC1EP12QPaintDevice
_ZN8QPainterD1Ev
_ZNK7QPixmap4sizeEv
_ZNK7QPixmap6isNullEv
qt5network
_ZN13QNetworkReply16staticMetaObjectE
_ZN15QNetworkRequest9setHeaderENS_12KnownHeadersERK8QVariant
_ZN15QNetworkRequestC1ERK4QUrl
_ZN15QNetworkRequestD1Ev
_ZN21QNetworkAccessManager4postERK15QNetworkRequestRK10QByteArray
_ZN21QNetworkAccessManagerC1EP7QObject
qt5widgets
_ZN10QStatusBarC1EP7QWidget
_ZN11QMainWindow10addToolBarEN2Qt11ToolBarAreaEP8QToolBar
_ZN11QMainWindow10setMenuBarEP8QMenuBar
_ZN11QMainWindow11qt_metacallEN11QMetaObject4CallEiPPv
_ZN11QMainWindow11qt_metacastEPKc
_ZN11QMainWindow12setStatusBarEP10QStatusBar
_ZN11QMainWindow15createPopupMenuEv
_ZN11QMainWindow16contextMenuEventEP17QContextMenuEvent
_ZN11QMainWindow16setCentralWidgetEP7QWidget
_ZN11QMainWindow16staticMetaObjectE
_ZN11QMainWindow5eventEP6QEvent
_ZN11QMainWindowC2EP7QWidget6QFlagsIN2Qt10WindowTypeEE
_ZN11QMainWindowD2Ev
_ZN11QPushButtonC1EP7QWidget
_ZN12QApplication4execEv
_ZN12QApplicationC1ERiPPci
_ZN12QApplicationD1Ev
_ZN12QProgressBar8setValueEi
_ZN12QProgressBarC1EP7QWidget
_ZN12QTextBrowserC1EP7QWidget
_ZN15QAbstractButton7setTextERK7QString
_ZN15QAbstractSlider8setValueEi
_ZN6QLabel7setTextERK7QString
_ZN6QLabelC1EP7QWidget6QFlagsIN2Qt10WindowTypeEE
_ZN7QWidget10closeEventEP11QCloseEvent
_ZN7QWidget10enterEventEP6QEvent
_ZN7QWidget10leaveEventEP6QEvent
_ZN7QWidget10paintEventEP11QPaintEvent
_ZN7QWidget10setEnabledEb
_ZN7QWidget10setVisibleEb
_ZN7QWidget10wheelEventEP11QWheelEvent
_ZN7QWidget11actionEventEP12QActionEvent
_ZN7QWidget11changeEventEP6QEvent
_ZN7QWidget11nativeEventERK10QByteArrayPvPl
_ZN7QWidget11resizeEventEP12QResizeEvent
_ZN7QWidget11setGeometryERK5QRect
_ZN7QWidget11tabletEventEP12QTabletEvent
_ZN7QWidget12focusInEventEP11QFocusEvent
_ZN7QWidget13dragMoveEventEP14QDragMoveEvent
_ZN7QWidget13focusOutEventEP11QFocusEvent
_ZN7QWidget13keyPressEventEP9QKeyEvent
_ZN7QWidget13setFixedWidthEi
_ZN7QWidget13setStyleSheetERK7QString
_ZN7QWidget13setWindowIconERK5QIcon
_ZN7QWidget14dragEnterEventEP15QDragEnterEvent
_ZN7QWidget14dragLeaveEventEP15QDragLeaveEvent
_ZN7QWidget14mouseMoveEventEP11QMouseEvent
_ZN7QWidget14setFixedHeightEi
_ZN7QWidget14setWindowTitleERK7QString
_ZN7QWidget15keyReleaseEventEP9QKeyEvent
_ZN7QWidget15mousePressEventEP11QMouseEvent
_ZN7QWidget16inputMethodEventEP17QInputMethodEvent
_ZN7QWidget17mouseReleaseEventEP11QMouseEvent
_ZN7QWidget18focusNextPrevChildEb
_ZN7QWidget21mouseDoubleClickEventEP11QMouseEvent
_ZN7QWidget21setAutoFillBackgroundEb
_ZN7QWidget4showEv
_ZN7QWidget5closeEv
_ZN7QWidget6resizeERK5QSize
_ZN7QWidget7setFontERK5QFont
_ZN7QWidget9dropEventEP10QDropEvent
_ZN7QWidget9hideEventEP10QHideEvent
_ZN7QWidget9moveEventEP10QMoveEvent
_ZN7QWidget9showEventEP10QShowEvent
_ZN7QWidgetC1EPS_6QFlagsIN2Qt10WindowTypeEE
_ZN8QMenuBarC1EP7QWidget
_ZN8QToolBarC1EP7QWidget
_ZN9QTextEdit7setHtmlERK7QString
_ZN9QTextEdit7setTextERK7QString
_ZNK15QAbstractButton4textEv
_ZNK15QAbstractSlider7maximumEv
_ZNK19QAbstractScrollArea17verticalScrollBarEv
_ZNK7QWidget10redirectedEP6QPoint
_ZNK7QWidget11initPainterEP8QPainter
_ZNK7QWidget11paintEngineEv
_ZNK7QWidget13sharedPainterEv
_ZNK7QWidget14heightForWidthEi
_ZNK7QWidget15minimumSizeHintEv
_ZNK7QWidget16inputMethodQueryEN2Qt16InputMethodQueryE
_ZNK7QWidget17hasHeightForWidthEv
_ZNK7QWidget6metricEN12QPaintDevice17PaintDeviceMetricE
_ZNK7QWidget7devTypeEv
_ZNK7QWidget8sizeHintEv
_ZThn8_NK7QWidget10redirectedEP6QPoint
_ZThn8_NK7QWidget11initPainterEP8QPainter
_ZThn8_NK7QWidget11paintEngineEv
_ZThn8_NK7QWidget13sharedPainterEv
_ZThn8_NK7QWidget6metricEN12QPaintDevice17PaintDeviceMetricE
_ZThn8_NK7QWidget7devTypeEv
qt5xml
_ZN12QDomDocument10setContentERK7QStringPS0_PiS4_
_ZN12QDomDocumentC1ERK7QString
_ZN12QDomDocumentD1Ev
_ZN12QDomNodeListD1Ev
_ZN8QDomNodeD1Ev
_ZN8QDomNodeD2Ev
_ZNK12QDomDocument15documentElementEv
_ZNK12QDomNodeList4itemEi
_ZNK12QDomNodeList6lengthEv
_ZNK8QDomNode10childNodesEv
_ZNK8QDomNode10firstChildEv
_ZNK8QDomNode6toTextEv
_ZNK8QDomNode9nodeValueEv
_ZNK8QDomNode9toElementEv
libgcc_s_dw2-1
_Unwind_Resume
__deregister_frame_info
__register_frame_info
kernel32
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LocalFree
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WideCharToMultiByte
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_iob
_lock
_onexit
_unlock
abort
calloc
exit
fprintf
free
fwrite
malloc
memcmp
memset
memcpy
signal
strcmp
strlen
strncmp
vfprintf
shell32
CommandLineToArgvW
libstdc++-6
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZdaPv
_ZdlPv
_Znaj
_Znwj
__cxa_begin_catch
__cxa_end_catch
__cxa_rethrow
__gxx_personality_v0
Sections
.text Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 136B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE