���l��SAc�_�b��������*(�״��=���w���9�bM��B/l���͆�,<��i��ED0�̷������l��_m:����c����stU���k���7W%c{�����/e�a��>���h���U��*�H��:,u\4�fK��x����{�g���P�K�| �G]�Rfn�ok//U�L���[�˕���k�_9����˾1�������^���3��N�� 1����N0��E8'ڙ�����.�`hoA�}�I� ���۹2��ߤ*`A��]�E3����@/y��foڬ$���>��*5F7c�{�aPjO{��~a����z�F�����r-����>�5�w�&�r���7/o"��$�ejR �g���`��Θ�g&��Q��V),��?ؒX��.b��x�����B�ՐO�ڢ��rY*yɫv4�t�*��~�a�^����Ie��(�p` �,�SyJ�:`b��(�'�FE��&v��x��&�-�Sw���n_��p�N}xGf�NyGʖ< n[*L��"8�V������ЎØ'ƌӵ�`�a]^`5pX&4+��2��#�'� m��"�R��Uf�m�<K�=����G�|6�`<]�� S#/a�{o���N{�u�B�t� ����@<�g� z��]D��.���3���e� (�(l]3�1�c���@�l7�&���j��Ѩ},?k�t\zq]h� ���J`++ji~O�܊�Im�y[�\����9؏�ϘS ����X@i�V:G�Y<A`�g�$XLW��1������ Չy�f���{�b�ƫ��W���&�Q�����Y�sk{�$<ܖM]��E��p���ן�#��E`�� �N $H=Ni �=��3�9�wћ���2�Xw��y{���ԇ�t�ڱ�1��R�F~&w�ҪF��h���L�GH���`��;�tg�4W���O�~�˔���E���ɬ�y��%�o$�����c)垆��|{aD�F�2Y����d#!�↺��N�띥I#=�y`���^��_j�����}[.e͐�*C��f�U.��tx��EIE�m�^%@������r.+;0$���Wi�:8���������I%*��ꨰ���������|��'ō!�6f��<����@W<B#��W�o2�zVP<�<qP��d��8DV��ܶ�vl%*���>��4��`�l���9jcnp|xx<� �|��nӾ6*;��{�sF��}+n}�[��Ҟd������$y���/��� zXمt��D�xbv������=Cc��~'�T�j����c8E1{1�rׂ���Im��_�Q�,��{*��iM5E���b�Wf���nV7�� @7#�#��<T�7���M�צ���:�]r�����'�t�/��}�5\~@��#��=�gf�Gy(�r�"�a�^�����1���=�3(����S.8�G����d��a9.��Hԗ$^4�+���~f�a ���xʑl(�)�����Ȩ{��!�J��j,1���'�_{4���qG2�������M�4��o���m�3�h�G!��|�Jz1�et� �q��NNex��Z�'4�qnT��~�}���p�2�K�Ψ5t����ÏpX�tZ����Hhh��P_hв&��(ϐ�c˜���l4���t-�B߫4ԴV;�Ly��4�l�8��ϔQ�\H�����r��H�#G� �˿d,�8���w�IC�x������:�0Ym����0��@wX. �OdA������@l,��9H���.W���Q���k�A��ޒj�_�s�O���}���*��t�{`M�H��־h��&1�̭Rq���x���L�k��Qi.�0 k؝�����R1�ޝ�<�JJE�)��������p�7�H�3�%6EI^�3���h�04���b������G1��x���s3߂R.�?h���g��ۂ�qS�M&c�:���(k��c%|���hd]�X(�|�T����n���m���\��4��3¯��%��o^�1�����'�{�Z��Һ@ij�2�qHs�G�nIk��p���� m�e��Sz��(��-�1��1�`���k9���`B����A��6��*m�(t��ҩ%[a�M��@�CSbIZu��� ����6w��J����p !`#�?�g0�](���Z���3� 6 �'1�3���@_����:4�|���hM�r��b�?Tmiħa[K~�L��OT/4K�Z ��wέ��Fw��Y��G�_�!���Q�W���!-K����:� QR��0l�[@i�R�����y-)�E�K �+I�4�ݘP͋������lR4��O�fM��������4�#s܆@ :U��M�@xS=K�%��Yڔ�Kj���5J�/���xH�5��P�y��~��;�� f!R"�������,t���;������������V쫰fI`innͼ��W]�OF[��\���M|�W�i�o�?Z"D�g��)�?v����>�@�����˹��FleV��s�uRuY�)L(��~̮�'_&}*��%.�kC�K6���pi/��;���$��etUR��?���������N䬿?�D�/56�uj��<�� �TWE����g/�D���R�I�\��P9�\a^����Cb�MiA�K�#O6�W|��)�>#��*,ߘtl%R��D����R�&�ZQPP8���pY�1�W�P�s��F)�=���(���Gk�b�����3~ �-n<A��:%6��r�����_�Z�.��*�Zʹ8F8K/�@��w�]��LEVP��ȕ��d[d��[�_���ҏ���l�h�(i����;�B��>%/cP�#D��24��9�j�=�˵��#[-$6f�TW��m���A9zW���#�j�.����p"12�Z��fҫ��v�u�Uf�#�,M�?��R��˟t��!?߽}�N �%��<��arŨ��V�K(��?\h����`I��AӰ~��o1�{�'�Et����nG���K)Jh��)Y�����z^Tבz����� �ΤPjh�ly��� *���n\d��i=]�P%�?��m�dCČs����ySo=��U���
Behavioral task
behavioral1
Sample
NEAS.53e450473db6504b77736aa1b10c3fb0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.53e450473db6504b77736aa1b10c3fb0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.53e450473db6504b77736aa1b10c3fb0.exe
-
Size
776KB
-
MD5
53e450473db6504b77736aa1b10c3fb0
-
SHA1
85b17bbada249e541a7f48902632aa9ea31fd71f
-
SHA256
428cbedfc948f2cc264722849ca4825c893af79d900eb8ecb42830445b4ace39
-
SHA512
69257694c3b337d906eff82672ac9919ae078569600c386cdeec04cda5f33f6011c517eab3ce42f1a13bd7b494e04235cc785d48a21280260bb9552a88980c77
-
SSDEEP
12288:83lRnV4Q2Nurxg5MrKhy7y1J+EpsMPRgcXgYhGWQ14KaxxsIAKWrIj4HuXAMPwR:8VRG0riIgnJ5HgGNQDa3AKWM00wYA49
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.53e450473db6504b77736aa1b10c3fb0.exe
Files
-
NEAS.53e450473db6504b77736aa1b10c3fb0.exe.exe windows:4 windows x86
7d3e4bfad4e057e82137d17d11fb7cd7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamInfoA
kernel32
GetFileAttributesA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
SetClipboardData
MessageBoxA
gdi32
GetWindowOrgEx
winmm
midiStreamClose
winspool.drv
DocumentPropertiesA
comdlg32
ChooseColorA
advapi32
RegCloseKey
shell32
Shell_NotifyIconA
ole32
OleUninitialize
oleaut32
SafeArrayAccessData
comctl32
_TrackMouseEvent
ws2_32
ioctlsocket
Exports
Exports
Sections
.text Size: - Virtual size: 498KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 381KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 756KB - Virtual size: 753KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ