geerMain
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.85989e6d0902f1653b8ac1aa4cfc4370.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.85989e6d0902f1653b8ac1aa4cfc4370.dll
Resource
win10v2004-20231020-en
General
-
Target
NEAS.85989e6d0902f1653b8ac1aa4cfc4370.exe
-
Size
55KB
-
MD5
85989e6d0902f1653b8ac1aa4cfc4370
-
SHA1
c5e26582bb039e6dd5d2d5fa26cfe9ad8d74eee1
-
SHA256
d43b5a84299601a7ac40fa09c98f548aa88e831a4652b187b83dd1a89d77e4a3
-
SHA512
24096802c83f8388dacdbda877627062906c16736b40bdaac9573cf506b2a67245adc64fe701f58c4caa77c5a4d48e99d23b49165e1a422f36b6fcf83227a74f
-
SSDEEP
1536:h7Lhq+5qzhTUfEfORQUw2RQBb4QdQxMT2LxCCdOJd:hvhq7zhTUfEfORQckbWMGoWO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.85989e6d0902f1653b8ac1aa4cfc4370.exe
Files
-
NEAS.85989e6d0902f1653b8ac1aa4cfc4370.exe.dll windows:4 windows x86
029ef2556852cca33ef6abcd8d7e7e52
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcpyA
CompareFileTime
GetFileTime
CloseHandle
CreateFileA
GlobalFree
GetPrivateProfileIntA
GlobalAlloc
GetModuleFileNameA
ReadFile
GetFileSize
lstrcatA
InterlockedDecrement
LocalAlloc
lstrlenA
FormatMessageA
FreeLibrary
GetProcAddress
LoadLibraryA
GetLocalTime
InterlockedIncrement
GetCurrentThread
ResumeThread
VirtualProtect
GetCurrentThreadId
LocalFree
WideCharToMultiByte
MultiByteToWideChar
SetLastError
VirtualAlloc
SuspendThread
GetLastError
SetThreadContext
GetThreadContext
GetCurrentProcess
InterlockedCompareExchange
VirtualQuery
FlushInstructionCache
user32
RegisterClassExA
GetWindowLongA
CreateWindowExA
SetWindowLongA
MessageBoxA
wsprintfA
DefWindowProcA
ole32
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
OleRun
oleaut32
VariantClear
SysFreeString
GetErrorInfo
VariantChangeType
VariantInit
SysAllocString
shlwapi
SHCreateStreamOnFileA
PathRemoveFileSpecA
PathAppendA
StrTrimA
msvcrt
_vsnprintf
_adjust_fdiv
malloc
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
free
__CxxFrameHandler
atoi
strtok
??0exception@@QAE@ABV0@@Z
??2@YAPAXI@Z
_CxxThrowException
??0exception@@QAE@XZ
??1exception@@UAE@XZ
swprintf
strncpy
wcslen
_except_handler3
memset
memcpy
detoured
Detoured
Exports
Exports
Sections
.text Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ