Static task
static1
Behavioral task
behavioral1
Sample
NEAS.4721067395e1f8c882277472f9a12ee0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.4721067395e1f8c882277472f9a12ee0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.4721067395e1f8c882277472f9a12ee0.exe
-
Size
725KB
-
MD5
4721067395e1f8c882277472f9a12ee0
-
SHA1
723bec681051ed14769998ce1391e345ff03c548
-
SHA256
f3f1efa1af64d8832ef4dcf7047d1e9d4b0e5b3cb6271439b96acbde83b78e02
-
SHA512
6859c4cb733d4e9d7ec0298b9856940e0cd3cce95763ffff7b734d21ce15104d1ff5d662c1d3f41c73b7fdb394ebd7a05ce16a6b1e14d9f129f73eb84d00a7ea
-
SSDEEP
12288:2bXWwv2D+r7s3OoFY3I7XHgZRKhJgeaX4Lxr+z8xcsOhkCVSWjqkanTX81Ye1n:2bXBvlrgeoFY4LHgZoJ8448xmdnjUnk7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.4721067395e1f8c882277472f9a12ee0.exe
Files
-
NEAS.4721067395e1f8c882277472f9a12ee0.exe.exe windows:6 windows x86
9b3314c33767d8502e19ab7585a1abef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
advapi32
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
EventWrite
RegEnumKeyW
RegOpenKeyExA
RegQueryValueExA
RegGetValueW
EventRegister
EventUnregister
RegEnumValueW
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegQueryInfoKeyW
SetSecurityDescriptorDacl
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorDacl
GetLengthSid
EqualSid
CreateWellKnownSid
CopySid
AddAccessDeniedAce
AddAccessAllowedAce
GetTokenInformation
OpenProcessToken
kernel32
ReleaseMutex
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount64
RaiseFailFastException
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileSize
ReadFile
GlobalMemoryStatusEx
GetSystemDirectoryW
GetVersionExW
GetNativeSystemInfo
GetProductInfo
GetModuleHandleW
GetProcAddress
GetTimeZoneInformation
GetUserGeoID
GetUserDefaultUILanguage
GetSystemDefaultLCID
GetUserDefaultLCID
CreateDirectoryW
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
CreateProcessW
GetTickCount
GlobalFree
LCIDToLocaleName
CreateMutexA
OpenMutexA
GlobalAlloc
GetACP
IsValidLocale
RaiseException
LeaveCriticalSection
HeapAlloc
HeapFree
GetProcessHeap
GetCommandLineW
HeapSetInformation
HeapReAlloc
HeapSize
EncodePointer
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsWow64Process
SetLastError
InterlockedDecrement
GetCurrentThread
HeapCreate
QueryPerformanceCounter
IsProcessorFeaturePresent
Sleep
GetCPInfo
GetOEMCP
IsValidCodePage
FreeLibrary
InterlockedExchange
LoadLibraryW
GetStringTypeW
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringW
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
GetFileAttributesW
GetLongPathNameW
GetShortPathNameW
GetSystemWindowsDirectoryW
lstrcmpiW
CompareStringW
CompareStringEx
GetSystemDefaultLocaleName
GetUserDefaultLocaleName
LocaleNameToLCID
EnterCriticalSection
GetLastError
CloseHandle
WriteFile
SetFileAttributesW
DeleteFileW
DeleteCriticalSection
InitializeCriticalSectionEx
lstrlenW
GetModuleFileNameW
CreateEventW
WaitForSingleObject
SetEvent
RtlCaptureStackBackTrace
InterlockedIncrement
LocalAlloc
LocalFree
LoadLibraryA
GetTempPathW
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
GetModuleFileNameA
GetShortPathNameA
ole32
CoCreateGuid
CoRevokeClassObject
StringFromCLSID
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
StringFromIID
CoRegisterClassObject
oleaut32
SysAllocString
SysFreeString
LoadRegTypeLi
LoadTypeLi
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 211KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 282KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ