�$ޜڤ��.W_�G����7������"�-(*tռ���VXK?��[O!�0{����K7���t�T'h\�|N���~t����N�5�������R�Hs��V$��~N���}�u�ۄ���tԿK��|s� �/ϊl�#>a�0���V�X̩�f��9F����;y\��ZG;���z�pbP�ȓF��1���՛����> ˿������o�'$+��I�P`�E��5����86m�LW8EMs~G�k��l���,���r��$v��@R%�.}?M����[�������)�1�O���=đ(�?���=8��Ȧp���Q�������pF,k3��c�_{����� ��1ܥ�F%��M��I�] .Sb�ο!��=���\���·�X ��w�� U��x9���ֺ=��M�����v�������|L.���D�a�N]�B�3ѫ��"� ]��l�8o�B��� ��8���Cߪ����n��ܡ��;��}�������L*4A��z����<n���i��dx�*%�i��NZ����*����k�����L\����7'X�?M�hVu���W�q}i�eU�3�uj��U 1�@��Ϳ����m{�df�+^$�י`��j/�w�S:�H�Q�+Hg�[/l�MP��c����Lv�I��z����!~M�����7�����n�\�_�\q �[�?�健E ���5L+�����(��Z�6R[�R����Jj=Sj��E���c L�h[�c�l\�o�D�(ÕD,S��rt r>v��@�͊�8�/N4�JuAH���}Vi�%�:}~��Xv/q>ko�e�)k�mG7��c'#��� A=���bxƳ�Zz���jBL�h\��{v:�w�df�P�~[i�S�i�D�փ<�o6�1�6�.��[�-����\jg�M�r���6nZ�;�y����O��NԞt��!ʾ�8Ϲ�)��j������q�Ef��}�d��vqY���\� ��ճoW����Kh��I�``����n2EB�O��D��)t�Í�W2QD�J��d �Pn/�<���Ħ����gޖ6S֏�y�Ѷe��@]��Y���.I�5&x�.N簨`���U��̈���^N�/O���:���Y�����Hg������tHh`�鹒�U�r�Bl��y4�0=�$�Ϊv>���:�������0�� dD_������Q�rh�ñK=�MB�^�:B;�zc쑏����c�RP�-Ђ��a���v8�Og'��N�}ö�&���GGKל�[ ��"�t���n���7(T� #�-�I?�h8">��hx�H�e�s{%�/��B���(���hG�I�D����]Y����K����VK�*���^��tؖ��k ~�Icr|����Zec������`n���{Ҽﷱ� _����8�-_/���6��A�6�P�����:m���i����Ya���{��;w�������F�+}5���h����*�|��Z���c��b&�M�1�MQ%oCX&eX�2]�9tH�>y`�e�)�7ܣ�[q�A�����rPZՅ�K�4#h|n��m���z��Uk���ػ0� ���<{L9Ј�h�믃���!.�"Y�(9�OD�ʢmύ�f�#��Q7�S"� �d�\8�9�K}譖l�M�l���p.�/���bR�Z����A�b˯H���d�sƩ[��nxTU@��bԵ��ER@im9�[~3ܪ-�/��}�_���t+��S����4�*�L���~�DKg�N0��,��) f-Rŝ\K�nj:����iw�&Т��ܒ�~���c�$�Q5X�u2��̄�"aff$�Z�\��8�l��M����9�I��w�vLQfHN�6z�'dfDN�@:��k �º�yPN=����Dm�ץ�!4�8Wq*���y��;�~zA�:���<Z����2�k��;�|u1F���������[�F~�����#�j�#S"ե����蝗ܿm�I��{/+r����B�óaC&Fu� �cT�Q�I��ڇ���I�=;�v�.`%�A���җ���q���)|ڢ��0����Ѩ�Ԟ5)aO�R�=k�X�R�q�m3���q��5:LQB���q~��6e�$K���bk_7�ɮF|x��Jl�O��h�����t3W+*6m�̀_���iM!u+]��[� �lw�msxl��N�����Ӽ�]��2p��M��*l�x��)��o����=Ğ �� �3�y��6�V �����+�H3f+���U�iǵ��a�+,��d$k�!�vq�n8��I[�Y����U�wX���/�OM2�u�9%.G|�Іt��X�o�*��vvҍW�{���$������1��.���Uv\�F�S�YP��sk���2� .q]ݚ7���L}�XgZ"-p�2�t��Ŧ���.Fip��Kx��Bo)�߀�sG�(�'��&o�+���$b��6�S!����^��)y����KL�����Yɢ_�?��پ����F�'~�`�� ��#?(��e�J�w�� ��^H�$.<����$��|�r�0��ӵdb���\�=�#�0o�[��'Z8��������H�-82�S�Ng���K&�)M��6J0�@֩����єީ4��ƹIk9��5�!��QO��~�"&a��A�|#Syۊ >o�9�Is;�\�����;�A4�T�2�L�EY�dW̴aq彀���nXm�W�8�N�Bf$����2s\2g�� pZS��MZ��E��W鬂&r�|�B�b�]��o�ضi�����,����P�E��9v\�Ԓ�?�z}�Ǫ.cQ�Ci^�̌>,Vڝ����c�����B�RJRb� �C���q� �Np�bQMx���0���� "�6�꺉CDy� �,�1�%���ݤ��V�����I�<�S����Z�ڔJ1)R&-a��E�|Y�d(����D'Q���gY��cF������b&RHc��}����0֩baP�������\�-8�"�Φ�ڮ���<W?e$�e�îL��E P�{+L`6Gmr8��Ֆ3�
Behavioral task
behavioral1
Sample
NEAS.b7b967775bda7a472a85bc3b470aa3a0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.b7b967775bda7a472a85bc3b470aa3a0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.b7b967775bda7a472a85bc3b470aa3a0.exe
-
Size
6.0MB
-
MD5
b7b967775bda7a472a85bc3b470aa3a0
-
SHA1
dbea584fec2d22334cad43d3b6358535adbe05c9
-
SHA256
785a1b87b374979f8512dcdefdbdf9af95719970c29364aa042f5ae20efe418d
-
SHA512
2b71ec8d065c643d36bee63646107b97ed83b332b0dd8ccc7b9d3128b4c7b0f9ad14465ccd2491f742e0c13ad4e9844e202264c4ca1965106df8c48ba4922b87
-
SSDEEP
98304:+BnYL99gi04dbJmlwwPn54PB2vL3xvhO/DkZF6LV0bUgnjXv9sSA3h:TL9OV+bJG54PmhhCD3LV0IoVNAR
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.b7b967775bda7a472a85bc3b470aa3a0.exe
Files
-
NEAS.b7b967775bda7a472a85bc3b470aa3a0.exe.exe windows:4 windows x86
1d156890e7851d6998d873533a9807bd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetLocaleInfoA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetDesktopWindow
MessageBoxA
advapi32
RegQueryValueExA
oleaut32
SafeArrayGetUBound
version
GetFileVersionInfoSizeA
gdi32
RestoreDC
ole32
IsAccelerator
comctl32
ImageList_Read
shell32
ShellExecuteA
iphlpapi
GetAdaptersInfo
lib\key
Key
lib\mylogin
hanjiangdudiao
Exports
Exports
Sections
CODE Size: - Virtual size: 626KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 29KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX1 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX2 Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 184B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ