�ީ�t��xɗ�t�e�@�h(�-�lXt�����L��p�~=�G��o2���#��#hѶ�c�E�F��<�Uפ��/�8BK*�I���L$u.��j��O��Y�]�{>�\��R�(��`�#6�<ԉސ��C;�$�Kd��u �+�h���x=�<MR)N�,��q_>t���G��46 QXEJ�`�l-��t��Dq���L^�"GJ�/�R�b�F��<+z��0ZDt��0m�x�20{W��&�u���_��� S�kJ�+H�Ǿi�֭m�(�Yg"�c):��]4&�;���hO��"����'%���kJ�e��~X2���<��l0HއR~3j�p:�w�F�Q&��ҕ(�>�X+ ���`�*W�.��h-Qd+��+]7��$[�5��4���'��y�x�D�#�ҭ-��42d���������@�za<C�=�s�P���@�p�M��d̟��% �p�j#���ʹ���2\��`������ɮ+w�,�={RTh��#h�lB�!����f*������q@L��F��r������xn&B&����Ff�g����^�m��E�/ ����$e���t;�P�t�-gmA9�4��;��� �B��T�dhrF_g�e�t����k�o8~"�m�L�f�h97F�#Fk��!'�s��ǰb��Q�T�#��DL����H�p� j#����7�:X��؆��5C���5W�?��w��\I� T."�\;;�>=S�y�hh��H�0��)�͜�8�F�S}��MQSSfs�MЈB�v�Z8�֏hM��b�}��;�[�r@F�Qp-�1�`�sg(N���=_:|?R(e ��v �(��ҕ[sO��|5��A"����u|H��5YN�|\�I@VPUKsң¯)�'p����m��ι|�c������C����8bl|o@*t�FKwJ�c�n1�`H;��L������c�f���vͨv��.NU�Xb�dݘ��#_;{A�Y�t��['V�_-K\�^�T��-$��L�1=�{&�E"� ���{^�cb�� ��Da�pb��R$Q�I$G:��ё����t��e�6:�wD��Oɒ��谡:��0��s��aWr>�|�q"lC�+�$P�J �mD�^�]QG��2g� - +2hBDX�)v��#ls"^Tt1C6���k��@�`���"0�3,9qH.��X���Ӆ <Hg���ڦ�����SB�>Yp���! �b�?�m)�_��p���7ɷ��������I���]���6%6��� s�f���/I�\8F4`ɡ�F)��d/̒�1���*B{N[�9b��+̚Ͻ?�%u�e��"P肬ٛ(i||��0z��tn�\ �l`ȋ�P��]քY4�{q��{��!2�aO^M$��D�pv&Rf��������������똈�Ȉ�(熨m]�W5΄��ּ�z!��2Ư��8��=e;a+����U{H �G��}��G���2:��S���=���E��Ǐ���bF�YZ�V��:�"�o��D�[�3�)$Mth}��1�L@Y���-k�V������UB.����cR����&,���ȯs>n�zf}e�(�9�����=O�y᠗�(��K��&��-�[�C��h��A6.�.���}�B>��,�����~��\�a2u�ȕ�XQQf��iq�u��;M�G~� <�|��um������D6��I������'��I3t�ˋ*�58�ZG�1�r��0h��D*����6�/��=;F�hoT9!�x@���A��Ud���� #����D0��G��:�q��"Z!�.\�Npt����@���[��)e2�d�>|i/��P�w��j��&E@�������$���!J<�n�4;�r@� >���k�#���9ߕY����x�4�j�|�&�!�킛U����Y�'����c40���pgs�2�[G��q2�ۮ�% {/�EX9� 7.����t,��T�����XT5SZ�&2��y@��99_n���Ї�V�U��(A���1���!����pU��عJ�O���@���m@t�$v�ش�)�ܶ�N`�wS��n�~\7�t��>��u����#�j�� �����$�A�������tpQ �Kmh������]� �"���L���I����%��4�d�q��y8,`��t?<v��q��Gz��|�[���HЇ AD��< ���-nw6fO��U&�����ZMuE���ދƌ��Q,h[N��'}�g��7 ^C=��?u��F|]p�����Pi�HXSy������]��~���`���TwX�0VW ˿v�W�3�Wh*�1�4v�C�,Թt 7����c���E7�e���/���oXș�$�c0E��`�vM�n��b�m�B��hV+ͫ�NS[V������&V�8{�ц�Nr�X�E�@IA� �~��˺��H�U�;9P,��^��U��_�D��#u9;�$���+��3��R���D؆��@{���X��W):��8���k���Z���\R� Vb���8A�+,�i�Oo����1't. ���IWa4��DѵeVy4�\� �C�XΈ+��k`giR��,.;~4�#"�V*4T0k��e/�ţ�7BT����g���q�I9�Ը��{�e^m����ז$?J����&/�;�x����6,#3�&��0dd�jV��R����p�O�@>�ax r�dHD��ɨ�Ѩ�'C�a�z ��]�9Bm}?8��Hz(h�~&?��q5O�t�����8�d��Z����Z��Ԩ���Ae���nCIC����Մ��ç���@��Xt�ŵ�EB�w�6�z���aE��ƀ!�no��i�X�fcb��U(�V�|�Y, �(L�̝��* ��d�F/�� 7g�s��Z����p���L�"�P��{���� �&�B�yٜ��;>u��珊�����h�Uz�ě=j$\#[�0<�Z����aE�>������wژ~g��[���Iڔm���,�"�i�L��z��Cy�=�����C�.?���̧�8�G��[�X�K^5sw��.�'lv!���x���U���TX
Behavioral task
behavioral1
Sample
NEAS.206780dcddc47bb8daa92c09c417bab0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.206780dcddc47bb8daa92c09c417bab0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.206780dcddc47bb8daa92c09c417bab0.exe
-
Size
820KB
-
MD5
206780dcddc47bb8daa92c09c417bab0
-
SHA1
645091a738a5fcfdabdc9214e2d3dce322f0f5b0
-
SHA256
b7a160db787cb8d5c8a25185b542d909d83177152b186fdf62052d5b83d9d1d6
-
SHA512
91c6597b538e4db3b593faced561f8157178244f4da24cab93fd457b944ed563eb938e0f3f90d16d3b222be9f9af1f793576f75fd0d500374b54817bad57632f
-
SSDEEP
12288:Gx4tD0qjn7yW1ME1EBr27qp8UN4g/lHSP8xPcrvhCt/3Bs0foHcZnpJ3p:NZZ7yW1MeupZ/I8xKwt/3BrfM4npJ3p
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.206780dcddc47bb8daa92c09c417bab0.exe
Files
-
NEAS.206780dcddc47bb8daa92c09c417bab0.exe.exe windows:4 windows x86
b8e2ac324f5329ce16f62557bf8c93a2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42u
ord561
msvcrt
memmove
kernel32
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetCursorPos
gdi32
DeleteObject
advapi32
RegQueryValueExA
shlwapi
PathFindFileNameW
ole32
CreateStreamOnHGlobal
olepro32
ord251
Exports
Exports
Sections
.text Size: 288KB - Virtual size: 285KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX0 Size: 292KB - Virtual size: 290KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 120KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ