Static task
static1
Behavioral task
behavioral1
Sample
NEAS.95b172519c35a761257cc4e2769167c0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.95b172519c35a761257cc4e2769167c0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.95b172519c35a761257cc4e2769167c0.exe
-
Size
657KB
-
MD5
95b172519c35a761257cc4e2769167c0
-
SHA1
33c1b5723d7a8f64ff7d5d9316256ff0c7deb4ea
-
SHA256
a0f43a6dc6ebce36b66beecb444ed202e5e8f9ab880023a3d91126293516e559
-
SHA512
c1614f3997582de97f88baae43e673ee016e48ba6603f12e3397509d4aa0c94053065d213d846bfd774183088962744be1f0cc6b2246300723853275768d0efe
-
SSDEEP
12288:PL0Dvlj3acn/1KIB/s7xT3w6GvsE7V9icWqhFWplTcRoB9/Yf9:DSNj3SEvX7ucWiWPoRq9/e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.95b172519c35a761257cc4e2769167c0.exe
Files
-
NEAS.95b172519c35a761257cc4e2769167c0.exe.exe windows:5 windows x86
f924a6e07cf07fb097a64539c877d208
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdiplus
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipClosePathFigure
GdipAddPathLineI
GdipAddPathArcI
GdipCreatePen1
GdipDeleteGraphics
GdipSetSmoothingMode
GdipDrawPath
GdipGraphicsClear
GdipFillPath
GdipDisposeImage
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdiplusShutdown
GdiplusStartup
GdipGetImageGraphicsContext
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromScan0
GdipCloneImage
wininet
InternetReadFileExW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetSetStatusCallbackW
InternetOpenW
InternetCloseHandle
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
GetModuleFileNameW
GetCommandLineW
Sleep
CloseHandle
CreateThread
CreateEventW
WaitForSingleObject
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetModuleHandleW
lstrlenW
GetLastError
FreeLibrary
MultiByteToWideChar
SetLastError
LoadLibraryExW
OutputDebugStringA
LoadLibraryW
GetModuleHandleA
GetProcAddress
GetFileAttributesW
GetVersion
lstrcmpiW
RaiseException
GetCurrentThreadId
SetEvent
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
DebugBreak
OutputDebugStringW
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpW
MulDiv
FlushInstructionCache
GetCurrentProcess
LCMapStringA
GlobalHandle
lstrlenA
IsBadWritePtr
ReadFile
CreateFileW
WideCharToMultiByte
LocalFree
LocalAlloc
HeapAlloc
GetProcessHeap
HeapFree
WriteFile
GetTempFileNameW
GetTempPathW
FormatMessageW
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapCreate
FatalAppExitA
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
TerminateProcess
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
InterlockedExchange
GetLocaleInfoW
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalFree
UnhandledExceptionFilter
user32
MonitorFromRect
GetMonitorInfoW
OffsetRect
PostMessageW
SetFocus
MonitorFromWindow
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetClassInfoExW
RegisterClassExW
GetWindowRect
SetWindowPos
DialogBoxIndirectParamW
DestroyWindow
GetWindow
GetFocus
IsChild
DestroyAcceleratorTable
EndPaint
FillRect
BeginPaint
GetClientRect
RedrawWindow
GetSysColor
GetParent
GetDesktopWindow
ReleaseDC
GetDC
CreateAcceleratorTableW
MoveWindow
ClientToScreen
ScreenToClient
ReleaseCapture
SetCapture
InvalidateRect
InvalidateRgn
GetDlgItem
CreateDialogIndirectParamW
CreateWindowExW
MessageBoxW
MapWindowPoints
EndDialog
SetWindowContextHelpId
MapDialogRect
SendDlgItemMessageW
UnregisterClassA
FindWindowExW
CharLowerBuffW
GetWindowDC
UpdateLayeredWindow
ShowWindow
SendMessageW
RegisterWindowMessageW
LoadCursorW
IsWindow
CallWindowProcW
GetWindowLongW
SetWindowLongW
DefWindowProcW
CharUpperW
CharNextW
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
GetClassNameW
GetForegroundWindow
gdi32
GetStockObject
GetObjectW
GetDeviceCaps
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteDC
BitBlt
advapi32
RegDeleteKeyW
IsValidSid
GetSidIdentifierAuthority
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
ole32
StringFromGUID2
CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoRegisterClassObject
CoRevokeClassObject
CoInitialize
CoUninitialize
StringFromCLSID
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleLockRunning
oleaut32
SysStringLen
RegisterTypeLi
SysFreeString
VarBstrCmp
VarUI1FromStr
VarUI2FromStr
VarUI8FromStr
VarI1FromStr
VarI2FromStr
VarI4FromStr
VarI8FromStr
VarR4FromStr
VarR8FromStr
VarBoolFromStr
VarDecFromStr
VarBstrFromUI1
VarBstrFromUI2
VarBstrFromI4
VarBstrFromI8
VarBstrFromI1
VarBstrFromI2
VarBstrFromR4
VarBstrFromR8
VarBstrFromBool
VarBstrFromDec
VariantChangeType
OleCreateFontIndirect
VariantCopy
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VariantClear
VariantInit
DispCallFunc
LoadRegTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
VarUI4FromStr
shlwapi
PathRemoveFileSpecW
UrlCreateFromPathW
urlmon
ObtainUserAgentString
Sections
.text Size: 515KB - Virtual size: 514KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ