Static task
static1
Behavioral task
behavioral1
Sample
NEAS.205c2e95cab94563175a15673e02e600.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.205c2e95cab94563175a15673e02e600.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.205c2e95cab94563175a15673e02e600.exe
-
Size
2.1MB
-
MD5
205c2e95cab94563175a15673e02e600
-
SHA1
7b8f024d776519717b166feb872d761a0376e964
-
SHA256
89c10db4455efc5d431dd4014c59fbac3cfaa4db0e85330e88bfccda02812dbf
-
SHA512
3cbbfed7eb09a9c089094cace4f3fe2c93cba7cb03fbd6d137b3300e7ff1c9ea86399349262e83a07b22fe2c4f15840a362f04972c9ba5651fa5c03b9919118b
-
SSDEEP
49152:q4QVHrmQ4gKc2KqOOudpihQRVUgkkPLYJLKqE2cyzsZ8hYcB:6B4xc2Blh2flLYPE2tB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.205c2e95cab94563175a15673e02e600.exe
Files
-
NEAS.205c2e95cab94563175a15673e02e600.exe.exe windows:6 windows x64
418f1785ae6002f14708ef314d3b09d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
qt5widgets
??1QApplication@@UEAA@XZ
??0QApplication@@QEAA@AEAHPEAPEADH@Z
?show@QWidget@@QEAAXXZ
?sizeHint@QWidget@@UEBA?AVQSize@@XZ
?exec@QApplication@@SAHXZ
?staticMetaObject@QToolButton@@2UQMetaObject@@B
?staticMetaObject@QWidget@@2UQMetaObject@@B
?qt_metacall@QWidget@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
?qt_metacast@QWidget@@UEAAPEAXPEBD@Z
?minimumSizeHint@QWidget@@UEBA?AVQSize@@XZ
??0QWidget@@QEAA@PEAV0@V?$QFlags@W4WindowType@Qt@@@@@Z
??1QWidget@@UEAA@XZ
?setFont@QWidget@@QEAAXAEBVQFont@@@Z
?qt_metacast@QToolButton@@UEAAPEAXPEBD@Z
?setLayout@QWidget@@QEAAXPEAVQLayout@@@Z
?event@QWidget@@MEAA_NPEAVQEvent@@@Z
?mousePressEvent@QWidget@@MEAAXPEAVQMouseEvent@@@Z
?mouseReleaseEvent@QWidget@@MEAAXPEAVQMouseEvent@@@Z
?mouseMoveEvent@QWidget@@MEAAXPEAVQMouseEvent@@@Z
?keyPressEvent@QWidget@@MEAAXPEAVQKeyEvent@@@Z
?keyReleaseEvent@QWidget@@MEAAXPEAVQKeyEvent@@@Z
?focusInEvent@QWidget@@MEAAXPEAVQFocusEvent@@@Z
?focusOutEvent@QWidget@@MEAAXPEAVQFocusEvent@@@Z
?enterEvent@QWidget@@MEAAXPEAVQEvent@@@Z
?leaveEvent@QWidget@@MEAAXPEAVQEvent@@@Z
?paintEvent@QWidget@@MEAAXPEAVQPaintEvent@@@Z
?actionEvent@QWidget@@MEAAXPEAVQActionEvent@@@Z
?changeEvent@QWidget@@MEAAXPEAVQEvent@@@Z
?text@QAbstractButton@@QEBA?AVQString@@XZ
?setSizeConstraint@QLayout@@QEAAXW4SizeConstraint@1@@Z
?geometry@QLayout@@UEBA?AVQRect@@XZ
?indexOf@QLayout@@UEBAHPEAVQWidget@@@Z
?isEmpty@QLayout@@UEBA_NXZ
?controlTypes@QLayout@@UEBA?AV?$QFlags@W4ControlType@QSizePolicy@@@@XZ
?layout@QLayout@@UEAAPEAV1@XZ
?childEvent@QLayout@@MEAAXPEAVQChildEvent@@@Z
?widget@QLayoutItem@@UEAAPEAVQWidget@@XZ
?spacerItem@QLayoutItem@@UEAAPEAVQSpacerItem@@XZ
?metaObject@QGridLayout@@UEBAPEBUQMetaObject@@XZ
?qt_metacast@QGridLayout@@UEAAPEAXPEBD@Z
?qt_metacall@QGridLayout@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
??0QGridLayout@@QEAA@XZ
??1QGridLayout@@UEAA@XZ
?sizeHint@QGridLayout@@UEBA?AVQSize@@XZ
?minimumSize@QGridLayout@@UEBA?AVQSize@@XZ
?maximumSize@QGridLayout@@UEBA?AVQSize@@XZ
?hasHeightForWidth@QGridLayout@@UEBA_NXZ
?heightForWidth@QGridLayout@@UEBAHH@Z
?minimumHeightForWidth@QGridLayout@@UEBAHH@Z
?expandingDirections@QGridLayout@@UEBA?AV?$QFlags@W4Orientation@Qt@@@@XZ
?invalidate@QGridLayout@@UEAAXXZ
?addWidget@QGridLayout@@QEAAXPEAVQWidget@@HHHHV?$QFlags@W4AlignmentFlag@Qt@@@@@Z
?addWidget@QGridLayout@@QEAAXPEAVQWidget@@HHV?$QFlags@W4AlignmentFlag@Qt@@@@@Z
?itemAt@QGridLayout@@UEBAPEAVQLayoutItem@@H@Z
?takeAt@QGridLayout@@UEAAPEAVQLayoutItem@@H@Z
?count@QGridLayout@@UEBAHXZ
?setGeometry@QGridLayout@@UEAAXAEBVQRect@@@Z
?addItem@QGridLayout@@MEAAXPEAVQLayoutItem@@@Z
?metaObject@QLineEdit@@UEBAPEBUQMetaObject@@XZ
?qt_metacast@QLineEdit@@UEAAPEAXPEBD@Z
?qt_metacall@QLineEdit@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
??0QLineEdit@@QEAA@AEBVQString@@PEAVQWidget@@@Z
??1QLineEdit@@UEAA@XZ
?text@QLineEdit@@QEBA?AVQString@@XZ
?setMaxLength@QLineEdit@@QEAAXH@Z
?setReadOnly@QLineEdit@@QEAAX_N@Z
?sizeHint@QLineEdit@@UEBA?AVQSize@@XZ
?minimumSizeHint@QLineEdit@@UEBA?AVQSize@@XZ
?setAlignment@QLineEdit@@QEAAXV?$QFlags@W4AlignmentFlag@Qt@@@@@Z
?setText@QLineEdit@@QEAAXAEBVQString@@@Z
?clear@QLineEdit@@QEAAXXZ
?mousePressEvent@QLineEdit@@MEAAXPEAVQMouseEvent@@@Z
?mouseMoveEvent@QLineEdit@@MEAAXPEAVQMouseEvent@@@Z
?mouseReleaseEvent@QLineEdit@@MEAAXPEAVQMouseEvent@@@Z
?mouseDoubleClickEvent@QLineEdit@@MEAAXPEAVQMouseEvent@@@Z
?keyPressEvent@QLineEdit@@MEAAXPEAVQKeyEvent@@@Z
?focusInEvent@QLineEdit@@MEAAXPEAVQFocusEvent@@@Z
?focusOutEvent@QLineEdit@@MEAAXPEAVQFocusEvent@@@Z
?paintEvent@QLineEdit@@MEAAXPEAVQPaintEvent@@@Z
?dragEnterEvent@QLineEdit@@MEAAXPEAVQDragEnterEvent@@@Z
?dragMoveEvent@QLineEdit@@MEAAXPEAVQDragMoveEvent@@@Z
?dragLeaveEvent@QLineEdit@@MEAAXPEAVQDragLeaveEvent@@@Z
?dropEvent@QLineEdit@@MEAAXPEAVQDropEvent@@@Z
?changeEvent@QLineEdit@@MEAAXPEAVQEvent@@@Z
?contextMenuEvent@QLineEdit@@MEAAXPEAVQContextMenuEvent@@@Z
?inputMethodEvent@QLineEdit@@MEAAXPEAVQInputMethodEvent@@@Z
?inputMethodQuery@QLineEdit@@UEBA?AVQVariant@@W4InputMethodQuery@Qt@@@Z
?event@QLineEdit@@UEAA_NPEAVQEvent@@@Z
?setSizePolicy@QWidget@@QEAAXW4Policy@QSizePolicy@@0@Z
?devType@QWidget@@UEBAHXZ
?setVisible@QWidget@@UEAAX_N@Z
?heightForWidth@QWidget@@UEBAHH@Z
?hasHeightForWidth@QWidget@@UEBA_NXZ
?paintEngine@QWidget@@UEBAPEAVQPaintEngine@@XZ
?mouseDoubleClickEvent@QWidget@@MEAAXPEAVQMouseEvent@@@Z
?wheelEvent@QWidget@@MEAAXPEAVQWheelEvent@@@Z
?moveEvent@QWidget@@MEAAXPEAVQMoveEvent@@@Z
?resizeEvent@QWidget@@MEAAXPEAVQResizeEvent@@@Z
?closeEvent@QWidget@@MEAAXPEAVQCloseEvent@@@Z
?contextMenuEvent@QWidget@@MEAAXPEAVQContextMenuEvent@@@Z
?tabletEvent@QWidget@@MEAAXPEAVQTabletEvent@@@Z
?dragEnterEvent@QWidget@@MEAAXPEAVQDragEnterEvent@@@Z
?dragMoveEvent@QWidget@@MEAAXPEAVQDragMoveEvent@@@Z
?dragLeaveEvent@QWidget@@MEAAXPEAVQDragLeaveEvent@@@Z
?dropEvent@QWidget@@MEAAXPEAVQDropEvent@@@Z
?showEvent@QWidget@@MEAAXPEAVQShowEvent@@@Z
?hideEvent@QWidget@@MEAAXPEAVQHideEvent@@@Z
?nativeEvent@QWidget@@MEAA_NAEBVQByteArray@@PEAXPEAJ@Z
?metric@QWidget@@MEBAHW4PaintDeviceMetric@QPaintDevice@@@Z
?initPainter@QWidget@@MEBAXPEAVQPainter@@@Z
?redirected@QWidget@@MEBAPEAVQPaintDevice@@PEAVQPoint@@@Z
?sharedPainter@QWidget@@MEBAPEAVQPainter@@XZ
?inputMethodEvent@QWidget@@MEAAXPEAVQInputMethodEvent@@@Z
?setWindowTitle@QWidget@@QEAAXAEBVQString@@@Z
?inputMethodQuery@QWidget@@UEBA?AVQVariant@@W4InputMethodQuery@Qt@@@Z
?focusNextPrevChild@QWidget@@MEAA_N_N@Z
?setText@QAbstractButton@@QEAAXAEBVQString@@@Z
?checkStateSet@QAbstractButton@@MEAAXXZ
?keyPressEvent@QAbstractButton@@MEAAXPEAVQKeyEvent@@@Z
?keyReleaseEvent@QAbstractButton@@MEAAXPEAVQKeyEvent@@@Z
?mouseMoveEvent@QAbstractButton@@MEAAXPEAVQMouseEvent@@@Z
?focusInEvent@QAbstractButton@@MEAAXPEAVQFocusEvent@@@Z
?focusOutEvent@QAbstractButton@@MEAAXPEAVQFocusEvent@@@Z
??0QToolButton@@QEAA@PEAVQWidget@@@Z
??1QToolButton@@UEAA@XZ
?sizeHint@QToolButton@@UEBA?AVQSize@@XZ
?minimumSizeHint@QToolButton@@UEBA?AVQSize@@XZ
?event@QToolButton@@MEAA_NPEAVQEvent@@@Z
?mousePressEvent@QToolButton@@MEAAXPEAVQMouseEvent@@@Z
?mouseReleaseEvent@QToolButton@@MEAAXPEAVQMouseEvent@@@Z
?paintEvent@QToolButton@@MEAAXPEAVQPaintEvent@@@Z
?actionEvent@QToolButton@@MEAAXPEAVQActionEvent@@@Z
?enterEvent@QToolButton@@MEAAXPEAVQEvent@@@Z
?leaveEvent@QToolButton@@MEAAXPEAVQEvent@@@Z
?timerEvent@QToolButton@@MEAAXPEAVQTimerEvent@@@Z
?changeEvent@QToolButton@@MEAAXPEAVQEvent@@@Z
?hitButton@QToolButton@@MEBA_NAEBVQPoint@@@Z
?nextCheckState@QToolButton@@MEAAXXZ
?qt_metacall@QToolButton@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
qt5gui
??1QFont@@QEAA@XZ
?pointSize@QFont@@QEBAHXZ
?setPointSize@QFont@@QEAAXH@Z
??0QFont@@QEAA@AEBV0@@Z
qt5core
?qt_metacast@QObject@@UEAAPEAXPEBD@Z
?qt_metacall@QObject@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z
??0QString@@QEAA@AEBVQByteArray@@@Z
??4QString@@QEAAAEAV0@AEBVQByteArray@@@Z
?isDigit@QCharRef@@QEBA_NXZ
?front@QString@@QEAA?AVQCharRef@@XZ
??0QCryptographicHash@@QEAA@W4Algorithm@0@@Z
??1QCryptographicHash@@QEAA@XZ
?addData@QCryptographicHash@@QEAA_NPEAVQIODevice@@@Z
?result@QCryptographicHash@@QEBA?AVQByteArray@@XZ
?read@QIODevice@@QEAA?AVQByteArray@@_J@Z
?write@QIODevice@@QEAA_JPEBD@Z
?right@QString@@QEBA?AV1@H@Z
?number@QString@@SA?AV1@_JH@Z
?machineUniqueId@QSysInfo@@SA?AVQByteArray@@XZ
??0QFile@@QEAA@AEBVQString@@@Z
?toHex@QByteArray@@QEBA?AV1@XZ
??0QObject@@QEAA@PEAV0@@Z
??1QObject@@UEAA@XZ
?hash@QMessageAuthenticationCode@@SA?AVQByteArray@@AEBV2@0W4Algorithm@QCryptographicHash@@@Z
??1QByteArray@@QEAA@XZ
?size@QByteArray@@QEBAHXZ
?data@QByteArray@@QEAAPEADXZ
?constData@QByteArray@@QEBAPEBDXZ
??0QByteArray@@QEAA@AEBV0@@Z
??YQByteArray@@QEAAAEAV0@AEBV0@@Z
??4QString@@QEAAAEAV0@$$QEAV0@@Z
?prepend@QString@@QEAAAEAV1@AEBV1@@Z
??YQString@@QEAAAEAV0@VQChar@@@Z
??YQString@@QEAAAEAV0@AEBV0@@Z
?toLocal8Bit@QString@@QEGBA?AVQByteArray@@XZ
?toLocal8Bit@QString@@QEHAA?AVQByteArray@@XZ
?staticMetaObject@QObject@@2UQMetaObject@@B
??0QString@@QEAA@PEBD@Z
??4QString@@QEAAAEAV0@PEBD@Z
?clear@QString@@QEAAXXZ
??0QString@@QEAA@AEBV0@@Z
??0QString@@QEAA@XZ
??1QString@@QEAA@XZ
?contains@QString@@QEBA_NVQChar@@W4CaseSensitivity@Qt@@@Z
??8QString@@QEBA_NPEBD@Z
?dispose@QListData@@QEAAXXZ
?write@QIODevice@@QEAA_JAEBVQByteArray@@@Z
?instance@QCoreApplication@@SAPEAV1@XZ
?detach@QListData@@QEAAPEAUData@1@H@Z
?realloc@QListData@@QEAAXH@Z
?dispose@QListData@@SAXPEAUData@1@@Z
?arguments@QCoreApplication@@SA?AVQStringList@@XZ
?applicationDirPath@QCoreApplication@@SA?AVQString@@XZ
?hash@QCryptographicHash@@SA?AVQByteArray@@AEBV2@W4Algorithm@1@@Z
??8@YA_NAEBVQString@@0@Z
?cast@QMetaObject@@QEBAPEAVQObject@@PEAV2@@Z
?tr@QMetaObject@@QEBA?AVQString@@PEBD0H@Z
??1Connection@QMetaObject@@QEAA@XZ
?toNativeSeparators@QDir@@SA?AVQString@@AEBV2@@Z
?separator@QDir@@SA?AVQChar@@XZ
?tempPath@QDir@@SA?AVQString@@XZ
?readAll@QIODevice@@QEAA?AVQByteArray@@XZ
?close@QFileDevice@@UEAAXXZ
??4QString@@QEAAAEAV0@AEBV0@@Z
?chop@QString@@QEAAXH@Z
?remove@QString@@QEAAAEAV1@HH@Z
?utf16@QString@@QEBAPEBGXZ
?toInt@QString@@QEBAHPEA_NH@Z
?toDouble@QString@@QEBANPEA_N@Z
?number@QString@@SA?AV1@NDH@Z
?number@QString@@SA?AV1@HH@Z
?shared_null@QListData@@2UData@1@B
??0QFile@@QEAA@XZ
??1QFile@@UEAA@XZ
?setFileName@QFile@@QEAAXAEBVQString@@@Z
?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?mid@QContainerImplHelper@QtPrivate@@SA?AW4CutResult@12@HPEAH0@Z
?dynamicMetaObject@QObjectData@@QEBAPEAUQMetaObject@@XZ
?clear@QByteArray@@QEAAXXZ
?mid@QByteArray@@QEBA?AV1@HH@Z
?number@QByteArray@@SA?AV1@_JH@Z
?event@QObject@@UEAA_NPEAVQEvent@@@Z
?connect@QObject@@SA?AVConnection@QMetaObject@@PEBV1@PEBD01W4ConnectionType@Qt@@@Z
?sender@QObject@@IEBAPEAV1@XZ
?timerEvent@QObject@@MEAAXPEAVQTimerEvent@@@Z
?eventFilter@QObject@@UEAA_NPEAV1@PEAVQEvent@@@Z
?childEvent@QObject@@MEAAXPEAVQChildEvent@@@Z
?customEvent@QObject@@MEAAXPEAVQEvent@@@Z
?connectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?disconnectNotify@QObject@@MEAAXAEBVQMetaMethod@@@Z
?fromUtf8@QString@@SA?AV1@PEBDH@Z
?writableLocation@QStandardPaths@@SA?AVQString@@W4StandardLocation@1@@Z
kernel32
WideCharToMultiByte
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
RtlCaptureContext
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCommandLineW
LocalFree
GetCurrentThreadId
UnhandledExceptionFilter
RtlVirtualUnwind
CreateProcessW
GetProcAddress
CloseHandle
LoadLibraryA
Sleep
WaitForSingleObject
WriteFile
GetCurrentProcess
RtlLookupFunctionEntry
advapi32
OpenProcessToken
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
memset
__current_exception
__C_specific_handler
__std_exception_copy
__std_exception_destroy
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
terminate
_configure_narrow_argv
_register_onexit_function
_get_narrow_winmain_command_line
_seh_filter_exe
_crt_atexit
_initterm
_initterm_e
_exit
exit
_set_app_type
_initialize_onexit_table
_cexit
_register_thread_local_exe_atexit_callback
_c_exit
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
pow
sqrt
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
shell32
CommandLineToArgvW
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 146KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ