Static task
static1
Behavioral task
behavioral1
Sample
NEAS.a0ed3aa64590d0b3da97af6edf4bab40.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.a0ed3aa64590d0b3da97af6edf4bab40.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.a0ed3aa64590d0b3da97af6edf4bab40.exe
-
Size
133KB
-
MD5
a0ed3aa64590d0b3da97af6edf4bab40
-
SHA1
95d074505233a03c769bf3b2fd0b512fb04ca4d7
-
SHA256
8d29cc2bcd4a4ef024ae1c8f2a0f4c61fc6da8d410caace9dd9c5da0688b1933
-
SHA512
2eda9380e1dfa1044079ca044c3de3a01d3a6131f67bd10dfb494fb33f8a047a006c5f6dd633c931323c362d299eada23314b901367e4a7cab5aa2d22b664534
-
SSDEEP
3072:7YdJ1yQgT8RpGIIQ/IfaUYM3RPn84nGOXB9y4lAIqhm+jJLu15c:k3A8JnIyUYgRPn84nG3e7L+jJLus
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.a0ed3aa64590d0b3da97af6edf4bab40.exe
Files
-
NEAS.a0ed3aa64590d0b3da97af6edf4bab40.exe.exe windows:1 windows x86
bb672c8748bf30a5ee2fd933f225d6ae
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CryptStringToBinaryA
shlwapi
PathAddExtensionW
PathFileExistsW
user32
FindWindowW
GetDC
GetParent
LoadCursorW
LoadIconW
RegisterClassW
ReleaseDC
kernel32
CloseHandle
CreateMutexA
CreateMutexW
DeleteFileW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileTime
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
LoadLibraryA
LoadLibraryW
OpenProcess
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
lstrcatW
lstrcmpiW
lstrcpyW
lstrlenW
CreateFileW
advapi32
DuplicateTokenEx
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
Sections
AUTO Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DGROUP Size: 117KB - Virtual size: 355KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ