��Qa�6��������~�E"�S'L�N63�ڐd�⻡ >j5%m���3�?)�H(]z��D��3�R� �7���\�����l�m���J��T��q��6W�t��.~�M�����sg������ԅ��<��>g��n�-k�}2���'�����×]m�h���(\y����{5��8LBA%MU� "�E�M��7-�F���*`1�!�����9��G�$ܙ�u����žs����Ws�"�M�eXJ�JY��(�E�(#/H�jtr!��Y��=�wd��}+����W��|~v�4Gt���3���F!��V�n3jQ�$d�~�2��`E0<VRQ�s��J/4�:�7C9%""\�Ұn�%�m2 bSٳ17~�^�[�y�53�4����a�qLʰQ���7S�m�2lF}��i�^��1KjQ��`����(/n*�p|&.�<&}���ן�c�赃v�$�I�[M*ERkm��$ �H[W|��hT���HEe�A R.\�)����T����d[6��5�3E�7�Oإ������!䡗a���d��(���?���<Tz��0xV�j��8�@B1��Q0�!gy+Ъ�g��������:�n�H�\�un��N������8���G�fOD����<{�[_����M��x5T�:�6=�+��=FY�B5���C��p�,Į��[�0�m��#<�o�@1�������KN.B�%U�~�uZl,ȏAT,��@}AQ�7Տ����%vcu�"����2���d�u���ܷw�X����4���Zg�y:/�vR'k��qq����W&��$�I<<(ER�W��ǜ^܈u�S8��\�P�����n����v�p͢���C_��ꚹ����j��7�Im;eyq xa}oR+]c3���Q]�L 2f����:(��;��ڙz���E,&�FyԼ ���[�#ؙ���� ��_[UF.�1�ɘW(<~���4* ����k��;���\�j��}W�q?��_��R�N��KW�e'2`'�C���8�}H�a�K���c�z ���Q3~xx?3zT��728�:��KP���:,��W����dyY�M��D��#M��U�W�і��U*�-������q.��.�|����Jt��h�O��_�RY̗��:� ��]�9PVN�k������h6�e C<��X�6��>}X��Es���--T�����E��_"7�#J��f�0ѧ|F��IO?J:���cu�鈞$H�[��=���4��������t���G�Jv��_����}���*����.����Eub�T�I?����Z�7ddx�;cj�e����2�ZV�`��x��=�&�~M���f@L0� ���}nbsN/�ZNJ��G�_hZ4�oʗ=�@aZ�!�1����/�0� O��0[���}��:�w�w��)8�I�����aL�z^{3.�����ɦm�oK$��Sz�A����`r׀14}�l�,���P��t�(�Н�k<A��-�F�P_A�7�u�p�+���!m|Q��n�H�/64�D�FȮ�u���dOf�jB׀��@ ~d*�?V}���՟{n��ܑ�@4t#� �O�[����2%�]+�zqwU2)yU(�qH%V��a�)y��uh.��)o��;��\FNL���L��us�Z5�sO3�E�&;@l��3�Z�\DT��d`/L2� 3���i"o6���ẳ��n�`Zy�chs��M��;r���R���@�a��J��J���U���E�Xh!�[��5��i�-\��30AG�1b�ʅ�i�W�a?��҄�Խ��JwO��d�Σ=F9��f����㇂;���ǧ�N����z��N�Gr���0K�?M��C���>�٘4��v�K����}���2��a�!�G|Ġ}�K+��L�ĔՀ���#yZ��x>�6.�fexI�?���Sm�|67ѻ�R�p������Ohp�m���L����"Tt���+�y� ȹ��o�{OX���.>5�X�=2ѫ���\a�@���]ؾ",5KZ�S�R�iX;>�1ULa��Q 2��EdO�xΘ� �!� W^�͕j����~��K����>�(�O�3�����%�0���B�������Ve�{9��1��H�pʂ�n���cQ� �lA���v��j�i���\���i%���W,�v ���!3Ƨ������"j�4��&zBp��'�[�TFY� ���)��YNb ͬ�)�Ov����C�1�4�[��A>+� wH'4c�f���v���Wn(I�����D-L�_u��M��d�x}&>����P�ֵ?x>��� ��w�m���������Do=�E��R�y� ���g$�QȠ����3�~z拉��IZT�5dy�ӫ�����|�ܷ̈́J�����cl��<i*=�+q� �F1M���;�]/-���|�����J2��96j.:I����]��Ec��L��$N�Q�<��J�[)Փ'�s����!#���ic>_2e�9:NLUz �����?���s>]oׂ|`�Ae�����ԝ&p�@2��wN����۞�75LO��d��-����`O#a!>N�A�Q��M�K��ބ��p\�����o�EX��_��J`��t�!�@�cN_� ��6�X2�H������ь.��A���'�f�7)��R��#]�f�ɴ�X�A(�.`����^�"�F�fr\{����#XxAՆ��� �@Y����M�����H��G^l� 6$2��^c��BSZ�ls��q!�-0���8ݑ����Y5��wv�[lt�3B�D�=z@%��;�T�H Bo��3t��;��hʼg$W��Tٝ�H�";m �=���Z8�)]�G��w��i��n�fQ�M�҆s����-G��=:��]W0�d��Y|��!�Ց��Qyw��ɧb!{�V��!i_:��W���6�%�chHϤ���/��ڛ��c�wIy��W歹�#�.{�O��ʆ]py�̺:@� L ���L!*��+p+�9����1���0>4��O��9r�����1���<�Y+�ã�:ҝ��\�Fz �1���hn���3�^��)���Q\%�(��Z�$�>
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e6c1ec83ecf507876e0cb141617207b0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.e6c1ec83ecf507876e0cb141617207b0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.e6c1ec83ecf507876e0cb141617207b0.exe
-
Size
1.4MB
-
MD5
e6c1ec83ecf507876e0cb141617207b0
-
SHA1
8ad3e18e79ff87d70ed2c1fb77a7d991f5e7e12a
-
SHA256
5d629cd601f7b0bb3bd023c75559ecf5406704b258b0d9d3f06e0748dddb3c14
-
SHA512
fb0cc1fdd558267b46bf0af016aa2c531df8a6275a250f6d8ef01fb1b3a5153307c81b97e543b1ddb124683c6013a8d66fabff596b2a266e086d3216ae7c60c9
-
SSDEEP
24576:TP4KD2cOERCEtfQ5Jh1RqDz4JNi3NL3ia0q++E+4ddUsPJG+rTgb2D5:TPydEzt45JEDzfNzZh4ddUsPJGAq2D5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.e6c1ec83ecf507876e0cb141617207b0.exe
Files
-
NEAS.e6c1ec83ecf507876e0cb141617207b0.exe.exe windows:4 windows x86
641da43a93f33ebfcde97ab12e748b0e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
midiStreamRestart
ws2_32
recv
kernel32
GetPrivateProfileStringA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DrawEdge
MessageBoxA
gdi32
ScaleViewportExtEx
winspool.drv
ClosePrinter
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ImageList_Destroy
comdlg32
GetFileTitleA
Exports
Exports
Sections
.text Size: - Virtual size: 1004KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CODE Size: - Virtual size: 330KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: 52KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: - Virtual size: 409KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ