Static task
static1
Behavioral task
behavioral1
Sample
NEAS.18b452a5e925e9cb8659186f2904f8e0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.18b452a5e925e9cb8659186f2904f8e0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.18b452a5e925e9cb8659186f2904f8e0.exe
-
Size
1.7MB
-
MD5
18b452a5e925e9cb8659186f2904f8e0
-
SHA1
457d4a379ffa2ea7d2deebd25430e4e63a2f79ed
-
SHA256
6c752a3d4f169d88f5faa64e7dedb7026033bea8596b0cb66545aa4318e226ac
-
SHA512
b137d48de4dcf1635caa2592172029767a950c63f53c48bc1f4da72dfc9a9d5b0e264ea757a3bd5347ce04deba30c0b37031ecea23098fedc2b6bc74dbec0598
-
SSDEEP
49152:R8JA/vneqLGqpEwXVJyQZC/PdTLsET2vJz0B://GqLGqpEwXVJyQk/5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.18b452a5e925e9cb8659186f2904f8e0.exe
Files
-
NEAS.18b452a5e925e9cb8659186f2904f8e0.exe.exe windows:5 windows x86
977aaa70bb5a71e86abaeb5296be2dcb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
GetFileTime
OutputDebugStringW
SetEnvironmentVariableA
WriteConsoleW
OpenMutexW
CloseHandle
SetFilePointer
WriteFile
GetModuleFileNameW
CreateFileW
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
GetEnvironmentVariableW
VirtualQuery
GetLogicalDriveStringsW
QueryDosDeviceW
GetUserDefaultLangID
CreateProcessW
WaitForSingleObject
GetModuleHandleW
GetExitCodeProcess
GetLastError
GetProcAddress
WaitForMultipleObjects
LocalFree
SearchPathW
GetDriveTypeW
FindFirstFileW
GetLongPathNameW
GetFileAttributesExW
GetShortPathNameW
GetCurrentProcess
OpenProcess
WideCharToMultiByte
GetACP
MultiByteToWideChar
CreateMutexW
Sleep
ReleaseMutex
TryEnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
ExpandEnvironmentStringsW
GetDiskFreeSpaceW
GetVolumeInformationW
HeapAlloc
HeapFree
GetProcessHeap
GlobalAlloc
GetVersionExW
GlobalFree
FreeLibrary
LoadLibraryW
FindResourceW
LoadResource
LockResource
GetSystemInfo
lstrcmpiW
FindClose
FindNextFileW
GetFullPathNameW
GetTempFileNameW
MoveFileExW
CreateDirectoryW
SetFileTime
GetSystemDirectoryW
CopyFileW
GetFileAttributesW
lstrlenW
GetTempPathW
GetCurrentDirectoryW
MoveFileW
SetCurrentDirectoryW
RemoveDirectoryW
GetWindowsDirectoryW
DeleteFileW
SetFileAttributesW
GetFileSize
SetEndOfFile
ReadFile
SetConsoleCtrlHandler
LoadLibraryExW
FileTimeToDosDateTime
DosDateTimeToFileTime
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTime
LocalFileTimeToFileTime
InterlockedExchangeAdd
SetEvent
GetTickCount
ResumeThread
ResetEvent
CreateEventW
OpenEventW
InterlockedExchange
SetLastError
GlobalMemoryStatusEx
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
LoadLibraryA
lstrcatW
lstrcpyW
GetFileSizeEx
DeviceIoControl
FormatMessageW
EncodePointer
GetStringTypeW
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
GetSystemTimeAsFileTime
CreateThread
ExitThread
RtlUnwind
FatalAppExitA
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CreateSemaphoreW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentThread
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetStdHandle
GetFileType
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
IsValidCodePage
GetOEMCP
GetTimeZoneInformation
FlushFileBuffers
SetStdHandle
user32
UnregisterClassW
shell32
SHGetFolderPathW
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 252KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ