Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c388c0ad5a67b43965f94307a08781b0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c388c0ad5a67b43965f94307a08781b0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.c388c0ad5a67b43965f94307a08781b0.exe
-
Size
204KB
-
MD5
c388c0ad5a67b43965f94307a08781b0
-
SHA1
c9051f788b3ad50fdc05f9bf179588957d1be152
-
SHA256
9673d04d6d931cf9f343dc0853b82d65064b8213259069c566a87827661404ac
-
SHA512
2f718d00621ad5b483a76c705d0c9462cf6c0eab93551d567655ec82e9cbf21222313842eb183bdc4bdab1cf4906404ff1c114a4f29c7217894e45e972ce2360
-
SSDEEP
3072:0WuQKdB16HzGAgnD0bE3NLI4Kau0AVPOUd7F3XjwuXzenq1OH4:0RQAYzGjn4bGLT7u05U733XzIY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.c388c0ad5a67b43965f94307a08781b0.exe
Files
-
NEAS.c388c0ad5a67b43965f94307a08781b0.exe.exe windows:4 windows x86
8840905b566a925158bd4fe5c60b9453
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord5442
ord3318
ord5186
ord354
ord6334
ord2575
ord4396
ord3574
ord609
ord2358
ord2642
ord5953
ord4224
ord2915
ord4129
ord3097
ord5572
ord922
ord3874
ord6880
ord3811
ord926
ord291
ord3571
ord3619
ord641
ord1641
ord324
ord3663
ord3626
ord2414
ord4234
ord755
ord470
ord1168
ord2393
ord1567
ord268
ord3706
ord6453
ord6378
ord6197
ord6380
ord3797
ord4538
ord2866
ord2078
ord4284
ord4710
ord4476
ord3920
ord1795
ord640
ord809
ord323
ord556
ord2405
ord4275
ord4809
ord613
ord289
ord3573
ord1640
ord1088
ord2431
ord2122
ord6320
ord4673
ord4274
ord6375
ord4486
ord1979
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord815
ord541
ord561
ord801
ord4278
ord6663
ord2764
ord6283
ord6282
ord2621
ord1134
ord6883
ord6143
ord798
ord4277
ord5465
ord532
ord1105
ord1200
ord5683
ord939
ord6877
ord861
ord2725
ord1146
ord5981
ord3721
ord795
ord2859
ord6876
ord6930
ord6928
ord4202
ord3181
ord1997
ord5194
ord533
ord940
ord6778
ord4204
ord5440
ord6383
ord5450
ord6394
ord413
ord711
ord6307
ord521
ord4160
ord5785
ord2243
ord2452
ord1949
ord818
ord665
ord1779
ord2301
ord656
ord3610
ord356
ord2770
ord2781
ord4058
ord3178
ord5710
ord2086
ord1980
ord668
ord3317
ord2860
ord2818
ord2645
ord537
ord1576
ord535
ord2864
ord567
ord616
ord3582
ord4424
ord3402
ord5290
ord4398
ord1776
ord6055
ord2578
ord4218
ord2023
ord2411
ord2514
ord6215
ord858
ord2379
ord823
ord860
ord941
ord540
ord4299
ord6605
ord924
ord800
ord6199
ord3092
ord5875
ord2302
ord825
ord3597
ord4425
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord4998
ord4853
ord4376
ord2554
ord5265
msvcrt
_wcsicmp
_stricmp
_setmbcp
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__CxxFrameHandler
wcslen
sprintf
wcsstr
sscanf
swprintf
_mbsicmp
wcscmp
_mbscmp
_CxxThrowException
_purecall
_access
free
malloc
atoi
__p___argv
__p___argc
_wtoi
_ftol
wcscat
wcscpy
memmove
wcsncpy
exit
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
_mbsnbcpy
kernel32
GetSystemDefaultLangID
GetACP
Sleep
GetModuleHandleA
GlobalFree
FindResourceA
LoadResource
LockResource
SizeofResource
GlobalAlloc
GlobalLock
GlobalUnlock
GetProcAddress
FreeLibrary
CloseHandle
CreateProcessA
GetPrivateProfileStringA
InterlockedDecrement
MultiByteToWideChar
OutputDebugStringA
InterlockedIncrement
WideCharToMultiByte
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
MulDiv
GetStartupInfoA
TerminateProcess
GetExitCodeProcess
OpenProcess
GetTempPathA
TerminateThread
ExitProcess
SetFileAttributesA
FindClose
FindFirstFileA
SetCurrentDirectoryA
SetEvent
CreateEventA
LoadLibraryA
WaitForSingleObject
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
CopyFileA
DeleteFileA
RemoveDirectoryA
GetVersionExA
lstrcmpiA
GetModuleFileNameA
lstrcpynA
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateDirectoryA
ReadProcessMemory
GetVersion
GetCommandLineA
GetLastError
LoadLibraryExA
GetCurrentProcess
SetEnvironmentVariableA
user32
GetDC
ReleaseDC
SetWindowTextW
LoadIconA
FindWindowExA
GetWindowThreadProcessId
SetWindowTextA
RegisterWindowMessageA
PostMessageA
GetDlgItem
ScreenToClient
EnumWindows
ExitWindowsEx
GetClassNameA
SendMessageA
GetClientRect
IsWindow
GetDlgCtrlID
GetWindow
MoveWindow
AdjustWindowRectEx
EnableWindow
GetParent
ClientToScreen
BeginPaint
EndPaint
LoadBitmapA
FindWindowA
InvalidateRect
SetTimer
KillTimer
GetWindowRect
SetForegroundWindow
ShowWindow
DrawIcon
GetSystemMetrics
IsIconic
EnumChildWindows
DrawIconEx
SetWindowRgn
OffsetRect
SetCursor
LoadCursorA
EqualRect
PtInRect
RedrawWindow
SetWindowLongA
GetWindowLongA
CopyRect
IsRectEmpty
IntersectRect
IsWindowVisible
FillRect
MessageBoxA
GetCursorPos
gdi32
GetDeviceCaps
DeleteDC
GetObjectA
StretchBlt
GetTextMetricsA
GetTextExtentPointA
CreateFontW
GetBkColor
CreateFontIndirectA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateSolidBrush
SetBkMode
CreateRectRgn
CombineRgn
GetPixel
SelectObject
CreateFontA
GetStockObject
CreateDCA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegSetValueExA
RegEnumKeyExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
shell32
SHGetPathFromIDListA
SHGetSpecialFolderPathA
SHChangeNotify
SHBrowseForFolderA
ole32
OleUninitialize
CreateStreamOnHGlobal
OleInitialize
olepro32
ord251
gdiplus
GdiplusStartup
GdipSetRenderingOrigin
GdipSetImageAttributesColorKeys
GdipDrawImageI
GdipLoadImageFromStreamICM
GdipCreateImageAttributes
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipLoadImageFromStream
GdipCloneImage
GdipCloneBrush
GdipFree
GdipNewInstalledFontCollection
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipGetFamilyName
GdipCreateSolidFill
GdipFillRectangleI
GdipDeleteBrush
GdipBitmapGetPixel
GdipAlloc
GdipCreateBitmapFromStream
GdipDrawImageRectRectI
GdipGetImageHeight
GdipCreateFromHDC
GdipCreateBitmapFromGraphics
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipCreateHBITMAPFromBitmap
GdipGetImageWidth
GdipDeleteGraphics
GdipDisposeImage
GdipGetFontCollectionFamilyCount
msvcp60
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAF@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??1ios_base@std@@UAE@XZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?_Xlen@std@@YAXXZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1_Lockit@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??_8?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@
??_8?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
??0ios_base@std@@IAE@XZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??_7?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
modfrwk
CreateModContainer
shlwapi
PathFileExistsA
SHDeleteKeyA
msimg32
TransparentBlt
rasapi32
RasDeleteEntryA
Sections
.text Size: 148KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ