Static task
static1
Behavioral task
behavioral1
Sample
NEAS.56792fc62fe5624ca99c8ba485ec8070.exe
Resource
win7-20231020-en
General
-
Target
NEAS.56792fc62fe5624ca99c8ba485ec8070.exe
-
Size
252KB
-
MD5
56792fc62fe5624ca99c8ba485ec8070
-
SHA1
837f3e23cf569b772b93deae3fd3a4cf0229cff1
-
SHA256
a023c66f2e368e07d3bea85f15a5bbe6ac262ff2b81f01c15d908b0a4b62bc8e
-
SHA512
0652ce647129678c52067914312cef08cead64d912949ed0197bc1ea7a65cb25dc9dc6074e7657d0572abda9cae50a96977f5b87d17e80c3263aefbdb8b0030d
-
SSDEEP
3072:kyshVX7DPPiyUKs/OIXMhx3zZYKOUrX/n+eOrD+fBRbMKabu4Mj2wX1LunepJU7o:Hshx7DGiuUj/+vrD7vFMV1Lvqd2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.56792fc62fe5624ca99c8ba485ec8070.exe
Files
-
NEAS.56792fc62fe5624ca99c8ba485ec8070.exe.exe windows:5 windows x86
4fdb1ae823ab4db0e22308333ee908ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EraseTape
GetProcessIoCounters
TlsGetValue
FindFirstFileExW
CreateJobSet
GetProcessTimes
MulDiv
ResetEvent
GetNamedPipeHandleStateA
LockResource
LocalShrink
UnlockFileEx
GetWriteWatch
SetSystemTimeAdjustment
QueryMemoryResourceNotification
AssignProcessToJobObject
GetProcessHeap
CreateFiberEx
ReplaceFileW
FlushInstructionCache
CreateMemoryResourceNotification
GetModuleFileNameA
ReleaseSemaphore
GetCommandLineW
GetNamedPipeInfo
IsWow64Process
GetThreadPriority
GetFileTime
SetFilePointerEx
GetFileInformationByHandle
ReplaceFileA
TlsSetValue
GetPriorityClass
DecodePointer
GetProcessAffinityMask
InitAtomTable
GetThreadContext
GetThreadSelectorEntry
SetLastError
FreeResource
GlobalCompact
LocalUnlock
GetVersion
SetSystemPowerState
SetHandleCount
CreateIoCompletionPort
SetProcessPriorityBoost
FlushViewOfFile
GlobalUnWire
ClearCommBreak
GetAtomNameW
GetExitCodeThread
CreateFiber
GetProcessId
GetFileSizeEx
PulseEvent
FindVolumeClose
GetHandleInformation
LockFile
FindNextChangeNotification
SetMessageWaitingIndicator
GetTapeParameters
SetProcessWorkingSetSize
SetMailslotInfo
DeleteAtom
GetFileType
CheckRemoteDebuggerPresent
GetCommModemStatus
WTSGetActiveConsoleSessionId
SetInformationJobObject
TransmitCommChar
DisconnectNamedPipe
GetCurrentProcess
GlobalDeleteAtom
ResetWriteWatch
SetProcessShutdownParameters
CreateFileMappingW
FindCloseChangeNotification
GetThreadTimes
OpenProcess
GetFileAttributesExW
GetCommTimeouts
DisableThreadLibraryCalls
ConvertThreadToFiber
GetNamedPipeHandleStateW
GetCurrentThreadId
SetStdHandle
ReleaseMutex
QueueUserAPC
SetTapeParameters
PrepareTape
RequestWakeupLatency
SetCommState
GetStdHandle
GetCurrentThread
PeekNamedPipe
GetProcessHandleCount
GetThreadPriorityBoost
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
GetStartupInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsAlloc
TlsFree
GetLastError
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
DeleteCriticalSection
Sleep
HeapFree
ExitProcess
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapReAlloc
VirtualAlloc
LoadLibraryA
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CloseHandle
CreateFileA
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.grdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE