Static task
static1
Behavioral task
behavioral1
Sample
NEAS.4287aab0d09a64e7c8539eef6afb3c60.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.4287aab0d09a64e7c8539eef6afb3c60.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.4287aab0d09a64e7c8539eef6afb3c60.exe
-
Size
252KB
-
MD5
4287aab0d09a64e7c8539eef6afb3c60
-
SHA1
882678bd3eb7a6783b184496d72f6a5f4e620301
-
SHA256
1ca673a376fabd4cd684bd145b967b12cfcf72f05ca821e8498d06fe3c976d02
-
SHA512
321dde4f1d30ff898aac4216305622962730c043f80b062e30e8358d10e3c1e29030ef79d2ec6e8b38f116fe4ba60011669880e7e80dad22910de759ec7c6ae5
-
SSDEEP
3072:H/jGa9mLfXrpbUxmJgcskdC74rwvhcUtIFjy:H/Sx9bUxmJwkY7Is
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.4287aab0d09a64e7c8539eef6afb3c60.exe
Files
-
NEAS.4287aab0d09a64e7c8539eef6afb3c60.exe.exe windows:4 windows x86
317c7c5d3bb50dfdf443a14078486515
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnmapViewOfFile
CreateThread
GetLastError
CreateEventW
ReleaseMutex
MapViewOfFile
CreateFileMappingW
CreateMutexW
SetEvent
GetModuleHandleW
MultiByteToWideChar
ReadFile
SetFilePointer
GetFileSize
GetStdHandle
CreateProcessW
GetStartupInfoW
GetExitCodeProcess
GetCurrentProcessId
DuplicateHandle
GetCurrentProcess
OpenProcess
GetCommandLineA
GetModuleFileNameA
CreateEventA
CreateFileMappingA
CreateMutexA
GetModuleHandleA
CreateProcessA
GetStartupInfoA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
CreateFileW
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableW
CloseHandle
CompareStringW
CompareStringA
GetLocaleInfoW
HeapSize
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
RtlUnwind
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
Sleep
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSection
LoadLibraryA
GetCurrentDirectoryA
IsDebuggerPresent
SetUnhandledExceptionFilter
TerminateProcess
VirtualAlloc
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
VirtualFree
PulseEvent
WaitForSingleObject
GetModuleFileNameW
GetVersionExW
GetCommandLineW
SetEnvironmentVariableA
WideCharToMultiByte
HeapCreate
SetEndOfFile
HeapDestroy
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
GetProcAddress
ExitProcess
InterlockedIncrement
InterlockedDecrement
GetFullPathNameW
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
GetDriveTypeA
FindFirstFileA
GetFullPathNameA
WriteFile
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
user32
GetWindowThreadProcessId
MsgWaitForMultipleObjects
MessageBoxW
SetWindowLongW
GetWindowLongW
SetClassLongW
LoadIconW
CreateWindowExW
CallWindowProcA
PostMessageA
FindWindowA
SetWindowTextA
LoadImageA
SendMessageA
DispatchMessageA
CreateWindowExA
LoadIconA
SetClassLongA
GetWindowLongA
SetWindowLongA
MessageBoxA
GetMessageA
PostQuitMessage
CallWindowProcW
PostMessageW
FindWindowW
GetParent
GetMessageW
GetWindow
SetForegroundWindow
IsIconic
KillTimer
MapWindowPoints
InvalidateRect
SetWindowTextW
GetDC
ReleaseDC
LoadImageW
SendMessageW
SetTimer
GetWindowRect
GetSystemMetrics
SetWindowPos
ShowWindow
BringWindowToTop
TranslateMessage
DispatchMessageW
gdi32
SetBkMode
GetDeviceCaps
GetStockObject
SetTextColor
comctl32
ord17
wsock32
connect
ioctlsocket
htons
socket
WSACleanup
WSAStartup
recv
send
Sections
.text Size: 116KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ