p�F�F:�,lB��Ʀ2�價��詾\�@�����3�NO�9�!(g��?�9 LD7\��6ư���/?��S֝[S�银��w6s8����{'���-��cy��?t��ƼN��0�P�h��nI�,À���YĞU����"���]<���`ZM�5�[}"�IF) |��n��<�D���>��#Ok [@��@�2�ӻ�v\��{ߞ�������ww��[;zGuڹ�:����^%��X�旭)A�m� YxJ�M(����r|��4�)�0�w�5���݅�a.4 ��#j�j�ƻ����;NCaq'Cs1@+��f��4ЬT���r�b��*��B�L4e^"�C* 20�h.�x����=�{��YƋcx<ֶU�%��Q�x���]Yp5A����ud&������xp���������E�J��~q�qRz6;�6��7yQ~����Пu�AM�/R�1t�b̞x�2����?�q����X\w8i�7�U�)�F��lQ1�5���������(���Y6Y�P�s]��h8�����{�0`'�M[Hm2�\�l��N�� ����K&|��m��OF/���㡃.�ū�������Ȟ��^�2 ��r#��'[f�N��N�Κ��'�Q|_T�՟���� �h�E�s�X����r��M���)�V��{�/ӎZO'yji�J���8R�:Y��ĥ���� Ж�w9�@����Ҩ|�W4M#�X�S��"|@5̀�=��jZ��c�a,h6��]�Nx�d�iH|�ۣv��҃�a��> ��b��̛�'6��bDx� %�������A���i�ЛyV�Op�e����4�4�-�Ec%!�OX�%�0..��E��4���`�<J��� U�C�#}�4.��ZM���6 z�B�dU��DċX��qC��������x����?>��pvV��yks����[�^��\b(d��v1B�V����6�j~�b��$5c � ��,,jE�%�N�g�f�V��͈?��о�*>ď��D;��E��Vg���h�Qß䙾�$K^Du�� �71�8|WM`g�h;��y��c�+���=W/������ r]%%�5�+|��E�h=A�뻦?lb8o��zn�����&6|�����`�V� �6V����sb�G3��u1Ia��]ߜ���|a{aN�"�m�aG����/.��hI<c���F��$����ۙ��'`r����i�u�d�=�G'��L�+^���Ds�oc_�e�q�ۀz���Vn��y,��LusD���`F������Tp"����ߚ^7�u��^4����E2�^�����!��se� ��#�?�"�E2��HnE���D�N����?��b������$���p��"�E�%���٪�:r���%�qe2}�+���@���v���i�{�!�R��U�#�Pb��r7 &NȄJ/��\�Y��d��UTϩ����v"�?� �kg �q����gq5 3�}(�a�+�n�>)ԎB���������.*��h���4����b1�#J�.vL=An��֞,*R����H0�A�}����!i6\O$H5!r[a{:N�B�g:�lp��%+~�=*�*�����Tr�`J%~|��r�q&�fa�����!7y���܈]��)��0����(3K�R�s=���=_���tYB|:�!3�6�{`�u����R������3v����X�4�=����=���2���d'n��+x0�Ɲ��3ė� �{n����Xߘ�'QOmBr�*Y�o-���S��/<z� ���������ⓘ� /��K��\�t������^�Z�Y=L��Gf�{���,�kXi���:�d�]G��i�!���*��ri)(�%�TNd�����IA���7{{��v��A)��r��e�b0�nY�n���6R��p���?�T���P/w�[x�wlA�~��ԋ�4�2m�7X�ȔRx��\Y�2m����T�Z�n�oTm-�M� ��>�y��rO)n{����Aϳ�6{��ݰ[��v��k��ڟ��&v�3�Լn���p=ǣ�a�� r� ��3���0qj�X�06�bl�fS���>x+�t��`��/��5#q���������8_0���q�D�f�:n{q�w3O7�^y�`�Aʉ�m�X��CF����ّ40R}f��9����Jn=���N�n���*��x~��ܣ����E�x�~��Ť������)��vis4%�Sb�����]"q�9��l�U�}qɳ���=��S�f�E���t��Q?2s�[�=�ZU���\�:3`�Q�%���s9� LL�#^�<��'���IVg�o����yjex�E��(�˵u�é١� �����E��d�S ��,J��,���8�g�ɍ��LR����NV��W�&�����#Ґʾ!�L� �a��j��x~g�*�mȕ�sxV#�������k�(7�e�X�����������D�Wח�iq��Ѳ��r4���6/��S�b�W�����W��/��O�^�#���� `�9��?pCE��l ���Q��i�7w���9�$p�� �m���2��0�$SLB�>�R�2��f�K�*�q8��9���g_���A@�%�(������ޚ�b� atn%����/������k�@IO������H�=�b�J\x/Y����a&��|+�n~���^�+ǻ��ƥ����]�W�HM���C�'�}����S��*k(Op/��Ώڽ�K�>12��u�p�Sv 6JMb/�$��ov8.�籼��xS�p��9�o��C�_�[8�X��4ucz��H�L�[&a M����#5!VN� ���Ȯ��#8٭?�x����2n�U<��MV��Ś]SN��n����σ� ��5��!7s�C5��i���A/������=��|���h�"��Q��0��F��� 3q$��xZt��Ho�|�o��ec�ՑPM���S7�����S�g��D"J��%���{��~S� ۙ��#֢�U��İDI&�s;)E!}���x;���91�H#��K�
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1728c30d05ef1944d3b8db0547ca7990.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.1728c30d05ef1944d3b8db0547ca7990.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.1728c30d05ef1944d3b8db0547ca7990.exe
-
Size
1.2MB
-
MD5
1728c30d05ef1944d3b8db0547ca7990
-
SHA1
296635ad7655fb653402f6eb7251cfdd3ec56cd3
-
SHA256
59241642c9aa02cc7027556d7f71f3d38569b653a87321a6757c5be29bad2655
-
SHA512
a065ee9b87d04a5affd83ea19162664761ce8d1bed8ddadba9cadadcbfc19615bd77643582ada2e94faeb1f9cc366a668cc08bbeca8bc23c7a9f43cb93de713f
-
SSDEEP
24576:H4iyCETQa4vsWKtaE29xdNMIHk/2qu0539zAfLkDK7Nm/OC4oeNXrhLY4HdD6Od:HKTQbsJ/mxdRI39yKKk6F/Zd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.1728c30d05ef1944d3b8db0547ca7990.exe
Files
-
NEAS.1728c30d05ef1944d3b8db0547ca7990.exe.exe windows:4 windows x86
e7cf9dcb0cd116edd2853bfe4dd31180
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLsetFixstr
user32
MessageBoxA
kernel32
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: 88KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: - Virtual size: 920KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ