<�!�w���]�=�xу�p�]�=䕢5�9ch!��{�Wu�� ѹ,�l�0`+q��ղ�Ue+��U����*�� )��PE�Z;pj���)t�R�'�O�1{�RǶ�{ae�wWqØ�����asRm��)�c3��P��)�A��T���0��^��V�vS"5�p��w�=&�0[W�6��� G�fH3T �y��%3��R��T�\ݱ��\�{�>rh��g��_Mͭ����}��W?p=�����GmH�I��ʷ����;����v,�M75'2���k�E�9���&)guf���O�*��z��F$ld�'Lw#3;���,l��|I4�b!k��v���M ���>�8���L3��tjs?� �Ud�&�����b�a�ؙF9������Įu`����l�x}���BB(��T[�!���V%>�J����LjF���W�S��9�1����N;��M�ѩH(C��Z���$��C��=ua���D$���ά^�7�/!E��%E�R�bŸ]^)R"�M�J��po��l�[b ��D���2Q��3-c{�3\��~!J�j^@����w�E��)*�1%�Μ�m���D��~*T"�����R�!!�)��;��;�:��ޙ�$o��z^{t��r���(Nh G�7�1��R�Q������V����|���(��\- ��j�P5���0���v�1i�o�l(�z��VNY$t���}��]5�X r|9�������сr�Rg��^���0*@)� ��H��B�[�<'�ڧ���c ��6���l���"�MLCv�� ��Å�Z5�hb��i@��e�J�Q2����_�(�o��1�N��^�_��U�C'!v&�R"�af|�3���R�l[�5o���C ��|�/�Ө���)�t6��L�Ǒ҂g0�ݢ�a I/fl���-��C_ˁ�,��-�5g��x%IO[N�M݊���ȟν�^5K�%���3=����Q�c|W*����y��3Ng�Z ��Iz�V�G���-c�Ǔ#�������K+���%��¹���&���鱔�T�-�7�������[���{/b��i��� ���� �l�Ek��/D�����>"��.x~lL�p����Q;��6�v�R��#�4Ń���2t\��a2Qu�FOi��@V���iS!�݆�b�u�f��-�l�˴���2d�q��J��X��@�9���ەZ�j-_�\�I�c%aՔ��ԛ5��c6Nbؒb�u�_L�1`�#���R����tr0(�ّ���~�&�>�]�",�/J����:��@X`� 8����E� }������hsb@6M�L�R.v�!�+�wa�Qƈ��������.��5Z�ʼn�[��*��KdTJEx��!n]�IKy�m@=u�L�<��&(���|5O�R�x���[\�N�������q��xhQ���1�E�[됵�r5��U`:K@������[�����Q�u��� L�S����\�OA�E�%�P��y$w����V��k7A���Ь�|.E� �o�t)���7N;���&+Hh� m�Cոc��D�`��pE��?����ym��wb�:Ë틠����:n��%*�Y��㵚��ЯpM��h.QE��G`J�i��Ƀ�,��5*��5<�Y���y����l�Apް��3�#�K��?:V腂)����v|���g�[�+��B3����md��4�u��7����3������̨�j��v��!E�1)��6c�Yf�������f�������reo� �ˈ�\���F3����d4ݛ�V�H���ٳjj���j'H}p�ݒ�v{�>�P��jmpԘ�e��'%Q��Gە���l�n,��� ��r�i�ף�l��1��#>]`�!��4��,�+`0���~<x��a�~o|ʩ<�+Ӛ#�,c�ي=APUH%��+�\��[MѲE������p{9鸦�� $PF@������%���2��v!��bÉ�f���L���^�f����]��4�%�P�ߵ��D��1"$�4�e�Wؐ{��Ԉ 2#���������*����M�W����� �p�#�1䛰xn a6*���i{�|�b�+����UQ!�v�W�o]Ķ���k�.G,�ZZ���S��&�����ig(#ۄ Φz�g��·Y�f/�Y�����X��B%1׆�U���2���N�_ݢl ��&��4��qۈ�k��K�&1�,�A�@����Y9P)}]��P �a�����͋�/NU:��$��5���@��������&��qȲN�� ��q�H[R���_6�H���?�t�.Gb�o_��2H�aP�(��,wL�mf���Ȯ֩���{yD�$ �̖)�Z:�s3.4���y�iY�����n���գ�v��8|�bd�����yg�.�\�s��[���?���H O�ଦ{ڝ"l�����L��X����Ri����l��C;umW������a�7�'9�K5#o3xY�ʭl{�緈3���[4�U���i��jd ��F������z�qR�c�C/$���{k���X����@�����DQ�19��2���I�qo:��U���u��5D�K����(�v\����j���l#%߭�P�M� .�S��g��K�`�����1!_���U�x����D�?��=����r���h5TTu%�rη��@V�C����b��Sj߫���H *�~�D��I�/�dL�<Ս�}��������h��g3*j��y�(��3 ��\`��F{�pK�h��ޥ�9�E'���*��{I>q$��s=�#�^a.��Hټ�c9<"ʓ�U�=�+�V���+���d�CS3v���s���IG�E�P�o�5佽3E&g؊�@/�9�7VP��kET�rW��R�����}���;�P/�XM)Jz wzv!��|s>ީ�R<�cFѢ#�=P< �+���8,���1{�[{l���j�{ ��d=����R`A��0��L�h��Iϱ���0 �����`=D`q��{���1��/�ꘄ����eURA@$��
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.566c4c29df02991a3f78ece4277bc610.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.566c4c29df02991a3f78ece4277bc610.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.566c4c29df02991a3f78ece4277bc610.exe
-
Size
9.7MB
-
MD5
566c4c29df02991a3f78ece4277bc610
-
SHA1
33c13dbaf523a38680bee48a9906e65e0d4d969f
-
SHA256
85e58acb44a670b355877a5f6c22210a7b40734c56ac587e5f658aba30256edc
-
SHA512
fd019322dd059dedd6b8027d9b1afe16245ef5822927c74448b53bea0360e511fc7ad05df649ca9869e78d22b9844786f0b3c6fffd2fcd6a7499fde664a8b8ad
-
SSDEEP
196608:zzbC8VnM5+iSylAnLK7GJQC/1mnRd3e6OeVao4lhU2KvXVVvMgyQ/FX/CV7E3sjN:zzBVnElALKZu1mRd3e6lQlhU3VvmiFvf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.566c4c29df02991a3f78ece4277bc610.exe
Files
-
NEAS.566c4c29df02991a3f78ece4277bc610.exe.exe windows:5 windows x86
7481bd391c4add970ef7bfefa6112344
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
CreateDialogIndirectParamA
MessageBoxA
gdi32
GetDCOrgEx
msimg32
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
advapi32
RegQueryValueExA
shell32
SHBrowseForFolderA
comctl32
ImageList_GetIconSize
shlwapi
PathIsDirectoryA
oledlg
ord8
ole32
CoRevokeClassObject
oleaut32
SafeArrayGetDim
urlmon
URLDownloadToFileA
gdiplus
GdipGetImagePalette
ws2_32
send
version
VerQueryValueA
wininet
InternetSetOptionExA
imm32
ImmGetOpenStatus
winmm
PlaySoundA
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 286KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 17.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CKWOW0 Size: - Virtual size: 195KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CKWOW1 Size: - Virtual size: 590KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CKWOW2 Size: 9.7MB - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ