kmp_GetTestModule
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.a125b37887340996d562976a773b3e40.dll
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.a125b37887340996d562976a773b3e40.dll
Resource
win10v2004-20231025-en
General
-
Target
NEAS.a125b37887340996d562976a773b3e40.exe
-
Size
78KB
-
MD5
a125b37887340996d562976a773b3e40
-
SHA1
5d998284ae9e3654039fa09f9b5acfde9dc6c9fd
-
SHA256
f3a90b22d6788012056c9c5168354ef32e9355c5950fec94b63f85aa83d3d718
-
SHA512
b5f3fd7fe7e7189191fbc4fe9eb82ba09e7f5a4bac92d891ede6b9f248846d41d1f5172162cc710cd208a1dcc951f34bfcdc1594e716f4db47ecbc2e3d2bf980
-
SSDEEP
1536:cwc5QCsWjcdH+8OOffe6wZUUqwBQb4sp/m90:c0tpdvkkHu9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.a125b37887340996d562976a773b3e40.exe
Files
-
NEAS.a125b37887340996d562976a773b3e40.exe.dll windows:5 windows x86
b679e2dbdf933cbb219e772825754e7d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
shlwapi
PathCanonicalizeA
PathFindFileNameA
kernel32
GetProcessHeap
SetFilePointerEx
SetStdHandle
CreateFileA
lstrcmpA
SetFilePointer
FreeLibrary
VirtualFree
ReadFile
CreateFileW
GetProcAddress
VirtualAlloc
LoadLibraryA
VirtualProtect
CloseHandle
GetFullPathNameA
GetFileSize
lstrlenA
lstrcatA
DisableThreadLibraryCalls
GetModuleFileNameA
lstrcpyA
WideCharToMultiByte
GetModuleFileNameW
MultiByteToWideChar
GetLastError
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
HeapReAlloc
LCMapStringW
GetStringTypeW
OutputDebugStringW
LoadLibraryExW
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
WriteConsoleW
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
Exports
Exports
Sections
.text Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ