Static task
static1
Behavioral task
behavioral1
Sample
NEAS.496d045887e737fdf51021231a26f0a0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.496d045887e737fdf51021231a26f0a0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.496d045887e737fdf51021231a26f0a0.exe
-
Size
292KB
-
MD5
496d045887e737fdf51021231a26f0a0
-
SHA1
333f3982baaef496e9ace1ac89560aa6b61c821c
-
SHA256
05b75bb09c3ce9c1e7bdde1ba719461b654e87a414beeff17a57e88fea35bfd3
-
SHA512
9568d61ce27a7ab8c689201048e4dbd9b9180115db0793cb41cffbfe16c9a47209703cfdaba1c4e0af2dd52274904151d0ee0226d117a24fef010d80cdf5bb82
-
SSDEEP
6144:ATuN2z3rO9Jy0Z7Z64LAjpnru2z3rO9Jg9G:ATuoz8wLFBz8g9G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.496d045887e737fdf51021231a26f0a0.exe
Files
-
NEAS.496d045887e737fdf51021231a26f0a0.exe.exe windows:4 windows x86
b2007e50941a260ea22e54bde387f806
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
MethCallEngine
ord662
ord595
ord598
ord632
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord607
ord608
ord716
ProcCallEngine
ord535
ord573
ord100
ord617
ord619
ord546
ord581
Sections
.text Size: 184KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ