Static task
static1
Behavioral task
behavioral1
Sample
NEAS.72d2fc516530b11761d6d19027a18520_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.72d2fc516530b11761d6d19027a18520_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.72d2fc516530b11761d6d19027a18520_JC.exe
-
Size
710KB
-
MD5
72d2fc516530b11761d6d19027a18520
-
SHA1
c5a7b2741d643d6aa5c974c2d0ea25b670522472
-
SHA256
07ebccb52e15b7c6358d35b171434171f75b9ccc40218fc5a878f7d31c304c9f
-
SHA512
61f98c40b7f7f208ac003e82c99cd04fe1defd16ca4fa009e68d03abfd69232e92214dd3584e84356697a73577cbedd335ba0697ab49eb0b1aeca3cccb1a21ee
-
SSDEEP
12288:Pbc+hw5Uq6twXpUVIY3I7XHgZRKhJgeaX4JzRWtAd6I45IujO13ObT2Ipo:PbNm5GtSmVIY4LHgZoJ84J0udGID3k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.72d2fc516530b11761d6d19027a18520_JC.exe
Files
-
NEAS.72d2fc516530b11761d6d19027a18520_JC.exe.exe windows:6 windows x86
9b3314c33767d8502e19ab7585a1abef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
advapi32
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
EventWrite
RegEnumKeyW
RegOpenKeyExA
RegQueryValueExA
RegGetValueW
EventRegister
EventUnregister
RegEnumValueW
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegQueryInfoKeyW
SetSecurityDescriptorDacl
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorDacl
GetLengthSid
EqualSid
CreateWellKnownSid
CopySid
AddAccessDeniedAce
AddAccessAllowedAce
GetTokenInformation
OpenProcessToken
kernel32
ReleaseMutex
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount64
RaiseFailFastException
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileSize
ReadFile
GlobalMemoryStatusEx
GetSystemDirectoryW
GetVersionExW
GetNativeSystemInfo
GetProductInfo
GetModuleHandleW
GetProcAddress
GetTimeZoneInformation
GetUserGeoID
GetUserDefaultUILanguage
GetSystemDefaultLCID
GetUserDefaultLCID
CreateDirectoryW
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
CreateProcessW
GetTickCount
GlobalFree
LCIDToLocaleName
CreateMutexA
OpenMutexA
GlobalAlloc
GetACP
IsValidLocale
RaiseException
LeaveCriticalSection
HeapAlloc
HeapFree
GetProcessHeap
GetCommandLineW
HeapSetInformation
HeapReAlloc
HeapSize
EncodePointer
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsWow64Process
SetLastError
InterlockedDecrement
GetCurrentThread
HeapCreate
QueryPerformanceCounter
IsProcessorFeaturePresent
Sleep
GetCPInfo
GetOEMCP
IsValidCodePage
FreeLibrary
InterlockedExchange
LoadLibraryW
GetStringTypeW
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringW
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
GetFileAttributesW
GetLongPathNameW
GetShortPathNameW
GetSystemWindowsDirectoryW
lstrcmpiW
CompareStringW
CompareStringEx
GetSystemDefaultLocaleName
GetUserDefaultLocaleName
LocaleNameToLCID
EnterCriticalSection
GetLastError
CloseHandle
WriteFile
SetFileAttributesW
DeleteFileW
DeleteCriticalSection
InitializeCriticalSectionEx
lstrlenW
GetModuleFileNameW
CreateEventW
WaitForSingleObject
SetEvent
RtlCaptureStackBackTrace
InterlockedIncrement
LocalAlloc
LocalFree
LoadLibraryA
GetTempPathW
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
GetModuleFileNameA
GetShortPathNameA
ole32
CoCreateGuid
CoRevokeClassObject
StringFromCLSID
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
StringFromIID
CoRegisterClassObject
oleaut32
SysAllocString
SysFreeString
LoadRegTypeLi
LoadTypeLi
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 211KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 267KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ