Static task
static1
Behavioral task
behavioral1
Sample
NEAS.10a0ddba2ba3b62b90a7bf6d08d8c9b0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.10a0ddba2ba3b62b90a7bf6d08d8c9b0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.10a0ddba2ba3b62b90a7bf6d08d8c9b0.exe
-
Size
42KB
-
MD5
10a0ddba2ba3b62b90a7bf6d08d8c9b0
-
SHA1
befa72476ebdf6e18a90dea6a01d656d56c5d35e
-
SHA256
301d8f314bf667981a4b0bb6eb8226a05d05b66f0a83e1424d9fdbc833f8d00d
-
SHA512
f0488b16025cd59a7a18f6433d5858060987f86730c461b96b1329eba0a0ad9a85c776caaf7629f24f3700aa29d3fa2a640f77f7e5fc11378a3fdddaea90908a
-
SSDEEP
768:gVipdJDMf7LXC0A6jEttxGVJmpCxnC6aZ6ji5uuCgVng9K3A9xS1/GOqUXSRca3v:OEdJDMf7LXC0A6jEfxbgxnC6aZ6ji5u5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.10a0ddba2ba3b62b90a7bf6d08d8c9b0.exe
Files
-
NEAS.10a0ddba2ba3b62b90a7bf6d08d8c9b0.exe.exe windows:4 windows x86
f1cca0c69f31f4f0381cfced240bd94a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
ExitProcess
GetLastError
CreateMutexA
GetModuleFileNameA
CopyFileA
GlobalMemoryStatus
GetModuleHandleA
GetTempPathA
MoveFileA
MoveFileExA
EnumResourceNamesA
FindResourceA
LoadResource
LockResource
CreateFileA
WriteFile
CloseHandle
CreateThread
GetSystemDefaultUILanguage
GetSystemInfo
GlobalMemoryStatusEx
TerminateProcess
CreateProcessA
lstrcpyA
GetCurrentProcess
SetProcessWorkingSetSize
HeapFree
ExitThread
OutputDebugStringA
GetTickCount
Sleep
LoadLibraryA
GetProcAddress
lstrcatA
GetProcessHeap
HeapAlloc
lstrlenA
user32
wsprintfA
advapi32
OpenServiceA
ChangeServiceConfig2A
UnlockServiceDatabase
StartServiceA
RegOpenKeyA
CloseServiceHandle
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
DeleteService
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
RegCloseKey
FreeSid
CreateServiceA
LockServiceDatabase
ws2_32
__WSAFDIsSet
recv
WSAIoctl
send
WSAStartup
WSASocketA
setsockopt
select
sendto
socket
htons
connect
closesocket
inet_addr
gethostbyname
htonl
msvcrt
memset
_onexit
__dllonexit
??1type_info@@UAE@XZ
free
strncmp
strrchr
exit
strstr
sprintf
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler
malloc
realloc
??2@YAPAXI@Z
memcpy
srand
_except_handler3
strcat
strncat
strchr
strcpy
_strnicmp
strlen
rand
iphlpapi
GetIfTable
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 16B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ