KhhfyRlpie
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f79c688291f86255ddba7d3b1484c570.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.f79c688291f86255ddba7d3b1484c570.dll
Resource
win10v2004-20231020-en
General
-
Target
NEAS.f79c688291f86255ddba7d3b1484c570.exe
-
Size
2.2MB
-
MD5
f79c688291f86255ddba7d3b1484c570
-
SHA1
6f6fd5fde9aacc7c32c665190561cdc8c91b8f7e
-
SHA256
5b8846c37c25a5b6ecc1f171bca02f166eeb1e2396595da13940f35cb6f45bac
-
SHA512
2883813aa63e172b82fa7d2a7d9efd877fdfb4ab809af0d6437af9004520974cc6abf2710bd10d258b95037c23196fc42b145970b7e0174cedb67490043706fa
-
SSDEEP
49152:VXUR3z8noViCLnwR3UA7u6s8IioXEhEYMUq3LKu5asi+frpl2:8nkRkh6s8CXAkBKuDpA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.f79c688291f86255ddba7d3b1484c570.exe
Files
-
NEAS.f79c688291f86255ddba7d3b1484c570.exe.dll windows:5 windows x86
23ad3c17cd1cb3290ee7229ce64650fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetBinaryTypeW
GetModuleFileNameW
EncodePointer
SetEvent
WaitForSingleObject
LoadLibraryExW
GetModuleFileNameA
WaitForSingleObjectEx
advapi32
RegOpenCurrentUser
msvcrt
memset
rpcrt4
RpcStringBindingParseW
gdi32
RoundRect
CreateBrushIndirect
ExtCreatePen
winmm
PlaySoundA
ole32
CoGetInterfaceAndReleaseStream
powrprof
ReadGlobalPwrPolicy
mprapi
MprAdminInterfaceTransportAdd
shell32
SHAddToRecentDocs
DragQueryFileW
ShellExecuteA
urlmon
CoInternetParseUrl
user32
GetCursorPos
SendMessageTimeoutW
RegisterClassA
ChildWindowFromPointEx
PostQuitMessage
Exports
Exports
Sections
.text Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 324KB - Virtual size: 327KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Ofe8sv Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ