Static task
static1
General
-
Target
NEAS.71ebf047e8bf7f49774bb1b35dbe4a90.exe
-
Size
124KB
-
MD5
71ebf047e8bf7f49774bb1b35dbe4a90
-
SHA1
6eb450f8478d6628195a3b0f0b00ffa380f1e46d
-
SHA256
270b7a4c32e22242801c363298cac319b4624fb6f65cd8ce619573acb8bcbf0b
-
SHA512
2ee0dcf0739eb9ef2d5ef2eef83e5d812a4392080fb742ec2d94caf5a07bd8ca94433200250f60ceb9a644a85fffdfbd0fc065b7b0d51688040d325cb139f30b
-
SSDEEP
1536:QZdnJoMMjEng4eaYh+WiUdk6HJvbb8aqUQxcEQIQXGE35dkfSpytOhIxq2K:9PjEng4eZhdkO8axmJukE6Ohuq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.71ebf047e8bf7f49774bb1b35dbe4a90.exe
Files
-
NEAS.71ebf047e8bf7f49774bb1b35dbe4a90.exe.sys windows:10 windows x64
d4a6b87404e66c029233b124a38d0bdf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntoskrnl.exe
RtlUnicodeStringToAnsiString
KeExpandKernelStackAndCalloutEx
RtlCompareMemory
MmMapLockedPagesSpecifyCache
IoQueueWorkItem
IoFreeWorkItem
IoAllocateWorkItem
ZwOpenKey
KeQueryActiveProcessorCountEx
ZwClose
IoReleaseCancelSpinLock
IoCreateSymbolicLink
IofCompleteRequest
IoAcquireCancelSpinLock
ZwQueryValueKey
ExInitializeNPagedLookasideList
IoDeleteSymbolicLink
KeReleaseMutex
RtlCopyUnicodeString
IoDeleteDevice
ExDeleteNPagedLookasideList
MmLockPagableDataSection
KeInitializeMutex
RtlAppendUnicodeStringToString
KeDelayExecutionThread
ExAllocateFromNPagedLookasideList
ExFreeToNPagedLookasideList
KeWaitForSingleObject
KeInitializeEvent
ExFreePoolWithTag
KeReleaseSpinLockFromDpcLevel
KeAcquireSpinLockAtDpcLevel
KeLowerIrql
ExAllocatePool2
KeAcquireSpinLockRaiseToDpc
KeSetEvent
MmGetSystemRoutineAddress
ObOpenObjectByPointer
IoCreateDevice
IoDeviceObjectType
ZwSetSecurityObject
RtlSetDaclSecurityDescriptor
IoIsWdmVersionAvailable
RtlLengthSid
RtlAddAccessAllowedAce
RtlAbsoluteToSelfRelativeSD
wcschr
ExAllocatePoolWithTag
_wcsnicmp
RtlCreateSecurityDescriptor
SeExports
RtlLengthSecurityDescriptor
_snwprintf
SeCaptureSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlFreeUnicodeString
ZwCreateKey
ZwSetValueKey
KeReleaseSpinLock
KeInitializeSpinLock
ExQueueWorkItem
RtlInitUnicodeString
RtlUpcaseUnicodeString
KeGetCurrentIrql
netio.sys
NetioDereferenceNetBufferListChain
RtlCopyBufferToMdl
NetioAdvanceNetBufferList
NmrDeregisterClient
NetioAllocateAndReferenceCopyNetBufferListEx
NetioDereferenceNetBufferList
NetioAllocateMdl
NetioRetreatNetBufferList
NmrRegisterClient
NmrWaitForClientDeregisterComplete
NmrClientAttachProvider
NmrClientDetachProviderComplete
NetioAllocateAndReferenceCloneNetBufferList
NetioFreeMdl
NetioInitializeNetBufferListContext
NetioUnInitializeNetBufferListLibrary
NetioRegisterProcessorAddCallback
NetioUnRegisterProcessorAddCallback
NetioInitializeNetBufferListLibrary
NetioStackBlockProcessorAddHandler
NmrRegisterProvider
NetioFreeStackBlock
NetioAllocateAndInitializeStackBlock
NmrProviderDetachClientComplete
NmrWaitForProviderDeregisterComplete
NmrDeregisterProvider
NetioCompleteCopyNetBufferListChain
ndis.sys
NdisCloseAdapterEx
NdisIfAddIfStackEntry
NdisCompleteBindAdapterEx
NdisCompleteUnbindAdapterEx
NdisOpenAdapterEx
NdisIfRegisterInterface
NdisIfDeregisterInterface
NdisIfUpdateInterface
NdisAdjustNetBufferCurrentMdl
NdisReturnNetBufferLists
NdisSendNetBufferLists
NdisGetDataBuffer
NdisRetreatNetBufferDataStart
NdisFreeNetBufferListContext
NdisCancelSendNetBufferLists
NdisAdvanceNetBufferDataStart
NdisAllocateNetBufferListContext
NdisRegisterProtocolDriver
NdisIfDeregisterProvider
NdisIfRegisterProvider
NdisIfAllocateNetLuidIndex
NdisIfFreeNetLuidIndex
NdisDeregisterProtocolDriver
NdisSetEvent
NdisIfGetNetLuidFromInterfaceIndex
NdisOidRequest
fwpkclnt.sys
FwpiCalloutRegisterAndAddWithoutDevice0
FwpmEngineOpen0
FwpiCalloutUnregisterAndDeleteByKey0
FwpmFilterDeleteById0
FwpmFilterAdd0
FwpmEngineClose0
Sections
.text Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGEWArp Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
fothk Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
GFIDS Size: 4KB - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ