Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f417655b56e2934faf6077747e5758b0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.f417655b56e2934faf6077747e5758b0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.f417655b56e2934faf6077747e5758b0.exe
-
Size
1011KB
-
MD5
f417655b56e2934faf6077747e5758b0
-
SHA1
3be984b628888284249c553b6c1ae55768ec0ea8
-
SHA256
629b3f823e7d4715db63e9f8507338920c7c59d31f09ea783a9d3391cb2bd546
-
SHA512
696f2185b76058e6451fc5326643338464214f5424db4461b10a0621b7fd5a2e682e8d8a0f981d523f838dd0d05fd70092f1e730bd93840faf47383aa9cafdba
-
SSDEEP
24576:j0KytXZXB2cILYcIl2ZSM0UNoP+xz3P9vp7/xsaYqLK8:gVLpA9h7/xIq9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.f417655b56e2934faf6077747e5758b0.exe
Files
-
NEAS.f417655b56e2934faf6077747e5758b0.exe.exe windows:4 windows x86
609119cf1dcaa75db71df5075ea5c04e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
ws2_32
WSAResetEvent
shutdown
WSAStartup
socket
htons
inet_addr
gethostbyname
connect
WSAGetLastError
select
closesocket
WSACloseEvent
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
send
recv
WSAEventSelect
WSACleanup
WSACreateEvent
shlwapi
PathFileExistsA
StrTrimA
PathIsDirectoryA
wininet
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
InternetSetOptionA
InternetReadFile
InternetGetLastResponseInfoA
InternetQueryOptionA
InternetCloseHandle
gdiplus
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapGetPixel
GdipBitmapSetPixel
GdipCreateFromHDC
GdipDrawImageRectI
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdiplusStartup
GdiplusShutdown
kernel32
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
QueryPerformanceCounter
LockFile
LockFileEx
UnlockFile
GetSystemInfo
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetVersionExA
GetVersion
GetTempPathA
FlushFileBuffers
WriteFile
Sleep
GetPrivateProfileStringA
WritePrivateProfileStringA
GetTickCount
GetModuleHandleA
MultiByteToWideChar
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceA
TerminateThread
GetExitCodeThread
GetLastError
WinExec
SystemTimeToFileTime
GetLocalTime
GetPrivateProfileIntA
LoadLibraryA
CloseHandle
FreeLibrary
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcAddress
GetCurrentDirectoryA
CreateProcessA
MoveFileExA
OutputDebugStringA
GetCurrentThreadId
SetThreadPriority
CreateThread
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
RemoveDirectoryA
FindClose
SetFileAttributesA
FindNextFileA
FindFirstFileA
DeleteFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
CopyFileA
GetSystemTime
GetDiskFreeSpaceExA
GetCurrentProcessId
OpenProcess
HeapFree
GetProcessHeap
MoveFileA
InterlockedDecrement
CreateEventA
WaitForSingleObject
InterlockedIncrement
InterlockedExchange
PulseEvent
CreateFileA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileInformationByHandle
SetEndOfFile
SetFilePointer
DuplicateHandle
GetCurrentProcess
ReadFile
user32
SendMessageA
GetDlgItem
SetDlgItemTextA
EndPaint
DrawTextA
BeginPaint
GetWindowRect
CallWindowProcA
GetWindowLongA
GetWindowTextA
LockWindowUpdate
ScreenToClient
SetWindowRgn
UpdateWindow
InvalidateRect
ShowWindow
GetComboBoxInfo
FillRect
TrackMouseEvent
GetCapture
PostMessageA
IsWindowVisible
ReleaseDC
GetDC
SetParent
SetTimer
MessageBoxA
MapDialogRect
GetParent
GetScrollInfo
GetWindow
SendDlgItemMessageA
SetFocus
SetDlgItemInt
GetDlgItemInt
LoadImageA
IsWindowEnabled
GetCursorPos
PtInRect
GetDlgItemTextA
SetWindowLongA
EnableWindow
KillTimer
GetSystemMetrics
SetWindowPos
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
IsWindow
DestroyWindow
UnregisterClassA
DialogBoxParamA
EndDialog
PostThreadMessageA
CreateDialogParamA
SetWindowTextA
SetForegroundWindow
LoadIconA
CreateWindowExA
ReleaseCapture
MoveWindow
SetCapture
gdi32
SetTextColor
SelectObject
CreateFontA
SetBkMode
GetStockObject
DeleteDC
BitBlt
GetObjectA
CreateCompatibleDC
StretchBlt
DeleteObject
GetTextExtentPoint32A
CreateDIBSection
CreatePolygonRgn
GetROP2
SetROP2
Rectangle
CreateSolidBrush
advapi32
RegSetValueExA
RegQueryValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
shell32
SHFileOperationA
ShellExecuteA
Shell_NotifyIconA
ole32
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
oleaut32
VariantClear
libcurl
curl_multi_init
curl_multi_perform
curl_multi_fdset
curl_multi_info_read
curl_multi_remove_handle
curl_global_cleanup
curl_global_init
curl_easy_cleanup
curl_easy_getinfo
curl_easy_setopt
curl_easy_init
curl_multi_add_handle
curl_multi_cleanup
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
msvcr80
_strtime
strtok
atof
_findfirst64i32
_findclose
_time64
strstr
exit
isdigit
fflush
ferror
fgetc
ungetc
strchr
tolower
feof
isspace
realloc
malloc
strncmp
strncpy
strcpy
__iob_func
printf
strrchr
isalpha
toupper
fprintf
_fileno
rand
fputc
_snprintf
strerror
vfprintf
_ctime64
isprint
_getcwd
getenv
strncat
_getpid
qsort
_localtime64
strftime
memmove
strtoul
_close
_open
getc
atol
_mbscmp
_mbsrchr
_ftime64
_filelength
fread
fseek
ftell
strcat
srand
fgets
memcpy_s
rename
sprintf_s
_unlock
__dllonexit
free
sscanf
_tempnam
remove
fwrite
fclose
_encode_pointer
_lock
fopen
strcmp
sprintf
memmove_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_invalid_parameter_noinfo
memset
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
??_V@YAXPAX@Z
strlen
atoi
memcpy
_stricmp
_itoa
_access
_mkdir
_unlink
_errno
_rmdir
_vsnprintf
psapi
GetModuleFileNameExA
Sections
.text Size: 788KB - Virtual size: 786KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 112KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE