Static task
static1
Behavioral task
behavioral1
Sample
NEAS.05d2c013e1bf1a7ed0ab880446a1af90.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.05d2c013e1bf1a7ed0ab880446a1af90.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.05d2c013e1bf1a7ed0ab880446a1af90.exe
-
Size
45KB
-
MD5
05d2c013e1bf1a7ed0ab880446a1af90
-
SHA1
10d47b16313bb0bfde159c676834000ee770da38
-
SHA256
06de622bcb3e4fbcd489d77cb3d550a582fc8d96e113d34fef76a87a16b1b4fa
-
SHA512
7663b1668ad26e16a595af75c64caffd5dc2fbe2d28b7ded4ee0601fbd34dbbb3c1000ac461ce37e5651d4064d3b12bbaedfb9713e291482a6d5088201670541
-
SSDEEP
384:UUKEKeCnNJ/6yK6VaC0zmFmCZYI/uuisYp4XXALCABD2l71+C:bKEINF1aC0yFsWYpK8CABDO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.05d2c013e1bf1a7ed0ab880446a1af90.exe
Files
-
NEAS.05d2c013e1bf1a7ed0ab880446a1af90.exe.exe windows:6 windows x86
039a7e6738fd74dd3adba5d586e00f03
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetModuleHandleW
HeapFree
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
VirtualQuery
HeapAlloc
GetProcessHeap
FreeLibrary
ExitProcess
Sleep
WriteFile
GetStartupInfoW
CreateFileA
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
MultiByteToWideChar
RaiseException
IsDebuggerPresent
GetCurrentThreadId
GetProcAddress
user32
GetDC
GetWindowDC
MessageBoxW
SetCursorPos
GetCursorPos
GetDesktopWindow
LoadIconW
GetSystemMetrics
DrawIcon
gdi32
BitBlt
advapi32
CryptAcquireContextW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
CryptGenRandom
vcruntime140d
memset
_except_handler4_common
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
__std_type_info_destroy_list
ucrtbased
strcat_s
__stdio_common_vsprintf_s
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
__p__commode
terminate
_wmakepath_s
_wsplitpath_s
wcscpy_s
_set_fmode
_seh_filter_exe
_CrtDbgReportW
_CrtDbgReport
system
strcpy_s
_set_new_mode
_configthreadlocale
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argc
_set_app_type
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_controlfp_s
__setusermatherr
__p___argv
Sections
.textbss Size: - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ