Static task
static1
Behavioral task
behavioral1
Sample
NEAS.78324b6303b38368aac71ab1d0f10160.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.78324b6303b38368aac71ab1d0f10160.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.78324b6303b38368aac71ab1d0f10160.exe
-
Size
124KB
-
MD5
78324b6303b38368aac71ab1d0f10160
-
SHA1
72ea7d2a5a6735ddf0d31f31d8d7c78598fd9558
-
SHA256
338694d308b5fcbd3566377c6a918b7eb8db6244ac2feb6c5b463d9ecac56759
-
SHA512
454b9551d1d8cb94d9434e40c8b1a8ac47fd874af3525d5c7006619c6b21d87b676399e00f34abbb4be77725a9348e94394a8768454c0d9eb0d3e2c00624b240
-
SSDEEP
1536:3jIun90+gUVcT87Wz3RfM/CoJqoCyGqzq5TxD7H3WLQ5fTl1LncxukkYxE7kYAem:zh2+63RfM/BJ1N4xfH3WLOcxupUE2J3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.78324b6303b38368aac71ab1d0f10160.exe
Files
-
NEAS.78324b6303b38368aac71ab1d0f10160.exe.exe windows:6 windows x86
0591d80f4d61152bdc6c4399369b05c9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateProcessA
GetCommandLineW
GetCommandLineA
GetTempFileNameA
GetTempPathA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
RtlUnwind
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
msvcrt
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
strrchr
fopen
fread
fseek
ftell
fwrite
fclose
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
shell32
CommandLineToArgvW
Sections
.text Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ext1 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ext2 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ext3 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ext4 Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE