Static task
static1
Behavioral task
behavioral1
Sample
NEAS.7a72a7b80abf3a7120c61e286df8d050.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.7a72a7b80abf3a7120c61e286df8d050.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.7a72a7b80abf3a7120c61e286df8d050.exe
-
Size
408KB
-
MD5
7a72a7b80abf3a7120c61e286df8d050
-
SHA1
801f8cc8c89da0c8712c71b024d63fa56e1d1080
-
SHA256
6700802565deeed3b6f9e79ac257d56e6052b381d5cbea645ecbf97f43f01513
-
SHA512
f72169f68fee2def984ef5f36df5c7ea556609410f0909b87d6fb7dff369b264597369ee8b200629bccb451a926095781a646eba578ded9b7e8fa94f1f96d169
-
SSDEEP
6144:g/sa4+hYvC9QiduM1O5I7B20oSTwmTYbzHrVFSr6SdL:Za1hYvC9QsuM1O5I7oSNTYjvSrbx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.7a72a7b80abf3a7120c61e286df8d050.exe
Files
-
NEAS.7a72a7b80abf3a7120c61e286df8d050.exe.exe windows:4 windows x86
75e80bb0ee7b9af33e275abf7f2c5cd6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
imm32
ImmDisableIME
kernel32
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
CreateMutexW
GetCurrentThreadId
ReleaseMutex
OpenMutexW
WaitForSingleObject
FindClose
LocalFree
FindFirstFileW
InterlockedIncrement
InterlockedCompareExchange
GetFileSize
SetFilePointer
WriteFile
ReadFile
FlushFileBuffers
SetLastError
LCMapStringW
GetTickCount
QueryPerformanceFrequency
CreateThread
Sleep
InterlockedExchange
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetSystemTimeAsFileTime
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
RtlUnwind
RaiseException
GetTimeZoneInformation
GetCPInfo
LCMapStringA
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
CreateFileW
GetStartupInfoA
GetFullPathNameW
GetCurrentDirectoryA
GetConsoleCP
GetConsoleMode
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LoadLibraryA
CreateFileA
GetLocaleInfoW
SetEndOfFile
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
CloseHandle
OpenFileMappingW
CreateFileMappingW
GetVersionExW
GetCommandLineW
GetModuleFileNameW
CopyFileW
MultiByteToWideChar
GetLastError
DeleteFileW
CreateDirectoryW
GetFileType
user32
MessageBoxW
advapi32
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
BuildExplicitAccessWithNameW
GetSecurityDescriptorSacl
SetEntriesInAclW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetNamedSecurityInfoW
GetSecurityInfo
SetNamedSecurityInfoW
RegOpenKeyExW
RegQueryValueW
shell32
SHGetSpecialFolderPathW
Sections
.text Size: 220KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ