Static task
static1
Behavioral task
behavioral1
Sample
NEAS.00dd871805d673eeaa04953138071a10.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.00dd871805d673eeaa04953138071a10.dll
Resource
win10v2004-20231020-en
General
-
Target
NEAS.00dd871805d673eeaa04953138071a10.exe
-
Size
885KB
-
MD5
00dd871805d673eeaa04953138071a10
-
SHA1
e614a5b4b722a28661a08ddd259c65b33b45754e
-
SHA256
612855baa9e6bfb2d0e4354acc2ed483816ac2fef3ea6e8c8fca872c9347279a
-
SHA512
426109e9e5453aa5e6decc64870c5465a9848eee3ca37f25a06f6915fedeb2d6c960e9ba9bdd94f007f6d8b27c0afb76dc5de719a3311da25233a795a9b21d9d
-
SSDEEP
12288:qiFPlMN831uzPUqspwIRyEm1/whIExqwyyT/SZ38ob/RKh+I0:vFb3MzBspWNoqwRrSLJKF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.00dd871805d673eeaa04953138071a10.exe
Files
-
NEAS.00dd871805d673eeaa04953138071a10.exe.dll windows:5 windows x86
3e92350040ada464c4bc6e19cf4363c2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameW
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetCurrentProcessId
OpenFileMappingA
SetEvent
CreateEventA
WaitForSingleObject
CreateThread
OpenEventA
CreateWaitableTimerA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
InterlockedCompareExchange
InterlockedExchange
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RtlUnwind
GetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetProcAddress
GetModuleHandleW
ExitProcess
WriteConsoleW
GetFileType
GetStdHandle
HeapValidate
IsBadReadPtr
GetCPInfo
GetCurrentThreadId
GetCommandLineA
LCMapStringW
InitializeCriticalSectionAndSpinCount
FatalAppExitA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
lstrlenA
LoadLibraryW
WriteFile
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsProcessorFeaturePresent
OutputDebugStringA
OutputDebugStringW
SetConsoleCtrlHandler
FreeLibrary
SetHandleCount
GetStartupInfoW
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointer
FlushFileBuffers
HeapAlloc
GetModuleFileNameA
HeapReAlloc
HeapSize
HeapQueryInformation
HeapFree
HeapCreate
HeapDestroy
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetProcessHeap
VirtualQuery
SetStdHandle
CreateFileA
CreateFileW
SetEndOfFile
ResumeThread
GetSystemInfo
SystemTimeToFileTime
ResetEvent
WaitForMultipleObjects
SetWaitableTimer
ExitThread
user32
MessageBoxA
GetActiveWindow
Sections
.textbss Size: - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 709KB - Virtual size: 708KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1024B - Virtual size: 514B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ