Static task
static1
Behavioral task
behavioral1
Sample
NEAS.79eba7a9ea1a9be2b4e84754f4fd9120.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.79eba7a9ea1a9be2b4e84754f4fd9120.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.79eba7a9ea1a9be2b4e84754f4fd9120.exe
-
Size
639KB
-
MD5
79eba7a9ea1a9be2b4e84754f4fd9120
-
SHA1
af3957f54c6652ac9dc5a96ec93522db2a6f3e79
-
SHA256
0ef2bb69998a40b7343c182a76b87bf63a5e09cf67775383c1555ffcabc3983e
-
SHA512
7df9f1a67c4b1e25f7fb8760d8f9d5d2c47823ae32109188dcb7937fb104a16134f69e8cf759da8997cba52c92a79b09867ecbbbb41e8b2480113f0c1da75116
-
SSDEEP
12288:HRPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HR7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.79eba7a9ea1a9be2b4e84754f4fd9120.exe
Files
-
NEAS.79eba7a9ea1a9be2b4e84754f4fd9120.exe.exe windows:5 windows x86
210ce6bcda151ed97ecc918821a22f5c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
DeleteFileW
LocalFree
MoveFileExW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetFileSize
FormatMessageW
FlushFileBuffers
GetLocalTime
MapViewOfFile
UnmapViewOfFile
Sleep
FindNextFileW
OpenFileMappingW
GetVolumeInformationW
lstrcmpiW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
RemoveDirectoryW
LocalAlloc
FindClose
GetProcAddress
GetLastError
RaiseException
GetTempPathW
lstrlenW
MultiByteToWideChar
lstrcmpW
CreateFileW
GetModuleFileNameW
ReadFile
GetFileAttributesW
SizeofResource
CopyFileW
InitializeCriticalSection
WriteFile
GetTickCount
GetModuleHandleW
CreateDirectoryW
InterlockedDecrement
InterlockedIncrement
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
SetFilePointer
FindFirstFileW
CreateFileMappingW
lstrcmpA
user32
GetMessageW
PostThreadMessageW
CharNextW
LoadStringW
DispatchMessageW
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegisterEventSourceW
CloseServiceHandle
DeleteService
OpenSCManagerW
StartServiceCtrlDispatcherW
OpenServiceW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
ControlService
ReportEventW
RegisterServiceCtrlHandlerW
RegOpenKeyExW
CreateServiceW
SetServiceStatus
RegDeleteValueW
RegDeleteKeyW
DeregisterEventSource
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
shell32
SHGetFolderPathW
ShellExecuteExW
SHCreateDirectoryExW
ole32
CoCreateInstance
CoUninitialize
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoRegisterClassObject
CoInitialize
CoRevokeClassObject
oleaut32
SysStringLen
LoadTypeLi
SysFreeString
RegisterTypeLi
VarUI4FromStr
UnRegisterTypeLi
SysAllocString
crypt32
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CryptDecodeObject
CertCloseStore
CryptMsgGetParam
CryptMsgClose
wintrust
WinVerifyTrust
msvcr90
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_except_handler4_common
_crt_debugger_hook
_CxxThrowException
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
__CxxFrameHandler3
__set_app_type
_initterm
_wcmdln
??3@YAXPAX@Z
wcsncpy_s
??_U@YAPAXI@Z
memcmp
free
malloc
vswprintf_s
wcslen
wcsstr
_recalloc
memset
??_V@YAXPAX@Z
rand
_itow_s
srand
rand_s
memcpy_s
_putws
wcscat_s
abs
wcscpy_s
_time64
_wtoi
swprintf_s
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 568KB - Virtual size: 572KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE