Buzeduntezomuzunate
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b92bfaf8380be3a3394476e099836250.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.b92bfaf8380be3a3394476e099836250.dll
Resource
win10v2004-20231020-en
General
-
Target
NEAS.b92bfaf8380be3a3394476e099836250.exe
-
Size
71KB
-
MD5
b92bfaf8380be3a3394476e099836250
-
SHA1
d1b18ed55d1081a709fe71d59dc249807968ad6a
-
SHA256
a4a83224d3b3daeaba9c04047ab5b605a95f68972b90e8af111aa8119c159f50
-
SHA512
9f7b988d262cc9091016b4219fe47304e6cabfea94f35a9c6a7dc07924d45ccbf84f8a2fe1592bf351f516394cf19d024fc59a4c3ed32904bde873e53b852b1d
-
SSDEEP
1536:478RgckJe4h8ihRuFKfMdbN1vQkPRQ+OZBEG6Jrr:4GgdJe4WihRmKMNvdy+OFWr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.b92bfaf8380be3a3394476e099836250.exe
Files
-
NEAS.b92bfaf8380be3a3394476e099836250.exe.dll windows:5 windows x86
3cf256ad679306f3bb00e0eb9016d1c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
LoadLibraryA
Sleep
OpenEventW
HeapReAlloc
VirtualFree
GetVersionExW
GetTickCount
GetCurrentProcessId
GetCurrentThreadId
HeapFree
GetCurrentProcess
HeapAlloc
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleHandleW
ExitProcess
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
OutputDebugStringA
InterlockedExchange
InterlockedCompareExchange
GetSystemTimeAsFileTime
user32
DispatchMessageW
msvcrt
_stricmp
free
realloc
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
rand
srand
_time64
wcstoul
malloc
??0exception@@QAE@XZ
wcsncmp
_beginthreadex
_CxxThrowException
_callnewh
memset
memcpy
?terminate@@YAXXZ
_XcptFilter
_initterm
_amsg_exit
_unlock
__dllonexit
_lock
_onexit
_errno
__CxxFrameHandler
??1type_info@@UAE@XZ
_wcslwr
Exports
Exports
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ