Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f0c812ed73459eb68f92dbf1066adcc0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.f0c812ed73459eb68f92dbf1066adcc0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.f0c812ed73459eb68f92dbf1066adcc0.exe
-
Size
143KB
-
MD5
f0c812ed73459eb68f92dbf1066adcc0
-
SHA1
ea0274c9841a0b0970d46c407ee0d6c8e1dd698f
-
SHA256
6eebda85a2aacbc3123613b33e8514b8beece87092e67e74d0620dc95712917a
-
SHA512
ef7c5ac507f1d1eecbeb173edbbd3d4d9e6b1c16ab65f4cc6057d3ab0ac683ce00dee093b621196c21cac27c3e432b92a8a63f8c2da006e7751421fe23831980
-
SSDEEP
3072:2uDgUGgmcdOMaOIo0o+RV3fouUFq8TmQqLCeeF/5HqMo3OJQ:2uEUGgTdOCIo0oufouUji32/5josQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.f0c812ed73459eb68f92dbf1066adcc0.exe
Files
-
NEAS.f0c812ed73459eb68f92dbf1066adcc0.exe.exe windows:1 windows x86
e9e4fa7ae3d125bd49cd17f589e30257
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
kernel32
GetModuleHandleA
GetProcAddress
CloseHandle
GetTickCount
RtlUnwind
DeleteTimerQueueTimer
SetLastError
GetModuleHandleW
lstrcpyW
lstrcatW
WriteFile
Sleep
lstrcmpiW
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetLastError
GetCommandLineW
lstrlenW
CreateFileW
ReadFile
GetVersionExW
crtdll
__GetMainArgs
exit
raise
signal
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 296B - Virtual size: 296B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ