SetMasterDatabase
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.671b31ff812172576efc5f7a4501d690.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.671b31ff812172576efc5f7a4501d690.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.671b31ff812172576efc5f7a4501d690.exe
-
Size
1.9MB
-
MD5
671b31ff812172576efc5f7a4501d690
-
SHA1
5237b1f746895398fb84f2f89f9cb58d77fca0b8
-
SHA256
9406ac73863e70560590a8ba33d4a1542a86f0ded7c41fd6b280480f8259d622
-
SHA512
cc7511dc99d85b663caa59c0c4859e477e61a0136c20f0a5d1ff22b1fd9ea6697e6e27c809cf98c246be9c6ceb47d2224d8620d86f8efbaff7bd4bd9b6ab6319
-
SSDEEP
49152:HXl5XSAq67kG/P0vNGEWpFNW8dr8npxp+5Tix8RhlwvSzCnqvTr:HXl5iFkOp+5Tix8Rhjzf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.671b31ff812172576efc5f7a4501d690.exe
Files
-
NEAS.671b31ff812172576efc5f7a4501d690.exe.exe windows:4 windows x86
0dcb218113b26b0bd546f9bd1ec0d31e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
d3d9
Direct3DCreate9
dinput8
DirectInput8Create
winmm
timeEndPeriod
timeBeginPeriod
timeSetEvent
timeKillEvent
timeGetTime
kernel32
GetDriveTypeW
GetVolumeInformationW
GetLogicalDriveStringsW
DebugBreak
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
MulDiv
WaitForMultipleObjects
LockResource
SizeofResource
LoadResource
FindResourceA
GetSystemInfo
GlobalMemoryStatus
FreeLibrary
GetCurrentProcess
GetThreadContext
GetCurrentThread
GetModuleFileNameW
GetModuleHandleA
Sleep
CreateMutexA
CreateEventA
CreateThread
GetLastError
ResetEvent
SetEvent
WaitForSingleObject
GetThreadLocale
GetLocaleInfoA
GetACP
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetThreadPriority
SetThreadPriority
VirtualAlloc
CreateSemaphoreA
VirtualFree
ReleaseSemaphore
lstrcmpiA
lstrlenA
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
GetTickCount
lstrcpyA
GetCurrentDirectoryA
GetModuleFileNameA
SetCurrentDirectoryA
FindFirstFileA
FindClose
LoadLibraryA
GetProcAddress
WriteFile
OutputDebugStringA
CreateFileA
GetFileSizeEx
SetFilePointerEx
InitializeCriticalSection
CloseHandle
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetUnhandledExceptionFilter
GetPrivateProfileIntA
GetPrivateProfileStringW
QueryPerformanceFrequency
QueryPerformanceCounter
ReadFile
RemoveDirectoryA
CreateDirectoryA
DeleteFileA
SetErrorMode
GetCurrentThreadId
MoveFileExA
GetPrivateProfileStringA
GetFileAttributesExA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetComputerNameA
SetFileAttributesA
GetTempPathA
GetTempFileNameA
GetFileAttributesA
VirtualQueryEx
GetCurrentProcessId
user32
SetWindowTextA
SendDlgItemMessageA
GetMessageA
IsDialogMessageA
DispatchMessageA
wsprintfA
GetCursorInfo
PostMessageA
SetDlgItemTextA
MessageBeep
SetWindowPos
SetWindowLongA
GetWindowLongA
GetDlgItem
DestroyIcon
RegisterHotKey
LoadImageA
EnableWindow
GetSysColorBrush
GetDlgCtrlID
CreateDialogParamA
GetDlgItemTextA
GetSysColor
CreateWindowExA
GetWindowRect
GetDesktopWindow
RegisterClassW
LoadCursorA
LoadIconA
ShowWindow
MessageBoxA
DefWindowProcW
IsIconic
EndPaint
BeginPaint
DestroyWindow
SetCursorPos
UpdateWindow
SendMessageA
MessageBoxW
SetForegroundWindow
OffsetRect
AdjustWindowRect
SetWindowsHookExA
RegisterWindowMessageA
MsgWaitForMultipleObjects
GetQueueStatus
PostThreadMessageA
GetClientRect
GetKeyboardState
ToAscii
GetAsyncKeyState
SetFocus
SetCursor
ShowCursor
DestroyCursor
SystemParametersInfoA
IsWindow
UnhookWindowsHookEx
CallNextHookEx
PostQuitMessage
PeekMessageA
PeekMessageW
DispatchMessageW
TranslateMessage
SendMessageTimeoutA
ClientToScreen
gdi32
SetBkMode
GetTextMetricsA
SetMapMode
DeleteObject
DeleteDC
CreateDIBSection
AddFontResourceA
SetBkColor
GetStockObject
SelectObject
CreateCompatibleDC
GetCharWidth32W
GetGlyphOutlineW
GdiFlush
TextOutW
RemoveFontResourceA
SetTextColor
CreateFontIndirectA
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CoUninitialize
CoInitialize
CoFreeUnusedLibraries
oleaut32
VariantClear
VariantInit
msvcp80
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?length@?$char_traits@D@std@@SAIPBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?swap@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXAAV12@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
msvcr80
memmove_s
memset
_purecall
??_V@YAXPAX@Z
isspace
_vsnwprintf
rand
sscanf
isdigit
strncat
isalpha
fclose
fprintf
fopen
atof
fgets
atoi
memcpy
fflush
_splitpath
sprintf
floor
wcsncpy
strncmp
_CIacos
_finite
_stat64i32
clock
srand
atol
qsort
toupper
iswspace
_setjmp3
fgetws
_wfopen
__argc
__argv
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
longjmp
strchr
wcsstr
_CIpow
_ftol
memmove
_aligned_malloc
_aligned_free
fread
fseek
ftell
fwrite
printf
vsprintf
strstr
strrchr
_snprintf
_getcwd
_strtime
_strdate
strtok
_findfirst64i32
_findnext64i32
_findclose
_CIfmod
_mbsstr
_mbslwr
_stricmp
_strnicmp
tolower
_time64
malloc
free
realloc
ferror
_errno
fputc
_fdopen
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_time32
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_vsnprintf
strncpy
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_invalid_parameter_noinfo
_wcsicmp
_wcsupr
swscanf
imagehlp
SymSetOptions
SymGetOptions
SymGetSymFromAddr
SymGetModuleInfo
SymLoadModule
SymInitialize
SymFunctionTableAccess
SymGetLineFromAddr
StackWalk
version
GetFileVersionInfoA
VerQueryValueA
wsock32
htons
WSAGetLastError
recv
send
connect
__WSAFDIsSet
inet_addr
closesocket
inet_ntoa
WSASetLastError
WSACleanup
WSAStartup
select
sendto
recvfrom
ntohs
gethostname
socket
setsockopt
bind
getsockname
ioctlsocket
ntohl
gethostbyname
htonl
dbghelp
MiniDumpWriteDump
shlwapi
PathCanonicalizeA
PathRemoveFileSpecW
PathFindFileNameA
comctl32
ord17
d3dx9_35
D3DXSaveTextureToFileA
D3DXCreateEffect
D3DXPlaneTransform
D3DXCreateEffectPool
D3DXLoadSurfaceFromMemory
D3DXSaveSurfaceToFileA
advapi32
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
GetUserNameA
shell32
ShellExecuteA
SHGetFolderPathA
ExtractAssociatedIconA
SHFileOperationA
Exports
Exports
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 212KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.SHARED Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ