Static task
static1
Behavioral task
behavioral1
Sample
NEAS.03ff7a6407d0b8371ba3177ab4ce20b0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.03ff7a6407d0b8371ba3177ab4ce20b0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.03ff7a6407d0b8371ba3177ab4ce20b0.exe
-
Size
2.6MB
-
MD5
03ff7a6407d0b8371ba3177ab4ce20b0
-
SHA1
3382452adf013284b3ee6dd33a93ca8908b42059
-
SHA256
a106201a4db77c8c5fc1206887154e945a5e3b866c932872e93a2dcbd77f511b
-
SHA512
e825e56015e35242067486c833138cf92cb7f91e300cf49934b885594e700debab63fa80a7209cfface07dfec7816aebaa66f5e28f76f04dfb5ff180b3a54b5e
-
SSDEEP
49152:j324lCMKvh3W/cQD4hRhrXKtRNAWsUBm1LsCxZ7mDfsSMvSMpgtXhbV+buGdlb:azVvkEMNg1LpZ6bsEM2tXhMbf/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.03ff7a6407d0b8371ba3177ab4ce20b0.exe
Files
-
NEAS.03ff7a6407d0b8371ba3177ab4ce20b0.exe.exe windows:4 windows x86
013e6da200a883fc9ca226ed9c033a10
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CopyFileA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
ReadFile
WaitForSingleObject
MoveFileExA
SetPriorityClass
GetCurrentProcess
GetCommandLineA
CreateProcessA
CreateThread
CreateSemaphoreA
DeleteFileA
GetTempPathA
GetDiskFreeSpaceExA
FindClose
FindFirstFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetCurrentProcessId
TerminateProcess
ReleaseSemaphore
CreateFileW
GetVersion
GetLocalTime
GetWindowsDirectoryA
GetVersionExA
GetShortPathNameA
SetFileAttributesA
lstrcpyA
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetOEMCP
LocalAlloc
LocalFree
IsBadReadPtr
GetSystemInfo
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
OpenProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualAlloc
VirtualFree
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
GetACP
GetCPInfo
SetFilePointer
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsBadCodePtr
SetUnhandledExceptionFilter
lstrcatA
CreateFileA
Sleep
GetFileSize
WriteFile
lstrlenA
lstrcmpA
Module32First
VirtualProtectEx
ReadProcessMemory
Module32Next
DeviceIoControl
IsBadWritePtr
GetLastError
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetStartupInfoA
RtlUnwind
RemoveDirectoryA
CreateDirectoryA
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
CloseHandle
user32
MessageBoxA
wsprintfA
GetWindowThreadProcessId
GetParent
GetSystemMetrics
WaitForInputIdle
advapi32
RegCloseKey
ControlService
DeleteService
CreateServiceA
StartServiceA
RegSetValueExA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExA
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
shell32
ShellExecuteExA
SHChangeNotify
FindExecutableA
setupapi
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
hid
HidD_GetAttributes
HidD_FreePreparsedData
HidP_GetCaps
HidD_GetFeature
HidD_SetFeature
HidD_GetHidGuid
HidD_GetPreparsedData
psapi
EnumProcessModules
GetModuleFileNameExA
GetModuleInformation
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ