Static task
static1
Behavioral task
behavioral1
Sample
NEAS.319e58126a264dd5d2f94bf83959d550.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.319e58126a264dd5d2f94bf83959d550.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.319e58126a264dd5d2f94bf83959d550.exe
-
Size
1.6MB
-
MD5
319e58126a264dd5d2f94bf83959d550
-
SHA1
cba77c710adcd1a5abdb9d413f8ee969f497ff0d
-
SHA256
74287741955d304e19975448ee27d4464169a0bc13a9fbbc2ccc5ada305bfecc
-
SHA512
e1654ec2988fc0420614ee21e314216f686a197cbd606888966c2a5705b76a89a7a343447394d76c6f01d6a463c5a757a354881d4d49ad8aa3dbe41c401f154e
-
SSDEEP
24576:vdiQ08DHJQVvIlp6SH5tqSPBo8olvuBuD/DZVch/Qxe87/24OPlNrqEW1RtgtOiE:lQv3SPeTv/ohYxeOZOPlNrqrlgtOiE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.319e58126a264dd5d2f94bf83959d550.exe
Files
-
NEAS.319e58126a264dd5d2f94bf83959d550.exe.exe windows:6 windows x86
449ca98ad8a17d4aaadf010e68c0197b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
sendto
recvfrom
ntohl
getsockopt
ioctlsocket
WSASetLastError
send
recv
WSACancelBlockingCall
WSACleanup
WSAStartup
getservbyname
gethostbyname
gethostbyaddr
socket
setsockopt
ntohs
listen
htons
htonl
connect
bind
accept
WSAGetLastError
getsockname
shutdown
select
closesocket
__WSAFDIsSet
gdi32
GetObjectA
GetDIBits
GetDeviceCaps
DeleteObject
CreateCompatibleBitmap
advapi32
CryptCreateHash
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
DeregisterEventSource
CryptDecrypt
CryptExportKey
CryptGetUserKey
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
user32
ReleaseDC
GetDC
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
kernel32
GetEnvironmentStringsW
FreeEnvironmentStringsW
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFileAttributesW
GetTimeZoneInformation
GetStringTypeW
CompareStringW
LCMapStringW
SetEnvironmentVariableA
HeapSize
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
QueryPerformanceCounter
GetProcessHeap
RaiseException
FlushFileBuffers
CreateFileW
GetFileAttributesExW
LoadLibraryExW
CloseHandle
GetLastError
Sleep
ExitProcess
CreateThread
GetStdHandle
DeleteFileA
FindClose
FindFirstFileA
ReadFile
WriteFile
GetProcessTimes
GetCurrentProcessId
OpenProcess
GetSystemTime
MoveFileA
SystemTimeToFileTime
SetLastError
MultiByteToWideChar
FlushConsoleInputBuffer
GetFileType
GetCurrentThreadId
GetModuleHandleA
GetProcAddress
GetTickCount
FreeLibrary
GlobalMemoryStatus
LoadLibraryA
FindNextFileA
WideCharToMultiByte
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
EncodePointer
DecodePointer
AreFileApisANSI
GetSystemTimeAsFileTime
GetConsoleMode
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleMode
SetConsoleCtrlHandler
HeapFree
HeapAlloc
HeapReAlloc
GetCommandLineA
FindFirstFileExA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
DeleteCriticalSection
GetStartupInfoW
SetStdHandle
GetConsoleCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwind
OutputDebugStringW
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 358KB - Virtual size: 358KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 51KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 940B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ