Static task
static1
Behavioral task
behavioral1
Sample
NEAS.91d69dd984064eeda71e466c27aff420.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.91d69dd984064eeda71e466c27aff420.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.91d69dd984064eeda71e466c27aff420.exe
-
Size
1.6MB
-
MD5
91d69dd984064eeda71e466c27aff420
-
SHA1
814f713701a0fabfbb0a2355d9bd7dedca602263
-
SHA256
abe35638ef8587d571964e02f4f697462d7ad2beceddf3703042bc20fe984d0c
-
SHA512
5e9383c70b862270e12d22b1ecd23b62594e1294f1e52a86ffc1c354e989830095704aeadf5556423ec4d01cee14ce62cc350534bbf1abf0549b6d48f0fb94f0
-
SSDEEP
24576:mqLJw41yEbiJRbeEmHg6SMs5Ufx0JlPa:SfvZmA9vU4lPa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.91d69dd984064eeda71e466c27aff420.exe
Files
-
NEAS.91d69dd984064eeda71e466c27aff420.exe.exe windows:6 windows x86
b9b5e52d496f4b25118b48cbe1e1c2aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
dllsafecheck
HackCheck
cmmlib
??Y?$CStringT@_W@Cmm@@QAEAAV01@PB_W@Z
??Y?$CStringT@_W@Cmm@@QAEAAV01@ABV01@@Z
?Assign@?$CStringT@_W@Cmm@@QAEXPB_WI@Z
?Format@?$CStringT@_W@Cmm@@QAAXPB_WZZ
?Compare@?$CStringT@_W@Cmm@@QBEHPB_W@Z
?Compare@?$CStringT@_W@Cmm@@QBEHABV12@@Z
?CompareNoCase@?$CStringT@_W@Cmm@@QBEHPB_W@Z
?IsEmpty@?$CStringT@_W@Cmm@@QBEHXZ
?Find@?$CStringT@_W@Cmm@@QBEPA_WPB_WH@Z
?Mid@?$CStringT@_W@Cmm@@QBE?AV?$CRangeT@PB_W@2@II@Z
?IsExists@CFileName@Cmm@@QBEHXZ
??1CFileName@Cmm@@UAE@XZ
??_7CFileName@Cmm@@6B@
?cmm_str_convert@@YAIHPA_WIPBDI@Z
?cmm_str_convert@@YAIHPADIPB_WI@Z
??0?$CStringT@D@Cmm@@QAE@XZ
??0?$CStringT@D@Cmm@@QAE@PBD@Z
??0?$CStringT@D@Cmm@@QAE@ABV?$CStringT@_W@1@@Z
??1?$CStringT@D@Cmm@@UAE@XZ
??B?$CStringT@D@Cmm@@QBEPBDXZ
?c_str@?$CStringT@D@Cmm@@QBEPBDXZ
?GetBuffer@?$CStringT@D@Cmm@@QAEPADI@Z
?SetLength@?$CStringT@D@Cmm@@QAEXI@Z
??0?$CStringT@_W@Cmm@@QAE@PBD@Z
?GetBuffer@?$CStringT@_W@Cmm@@QAEPA_WI@Z
?SetLength@?$CStringT@_W@Cmm@@QAEXI@Z
?InSeconds@TimeDelta@Cmm@@QBE_JXZ
?Now@Time@Cmm@@SA?AV12@XZ
??0CCmmArchiveObjHelper@Cmm@@QAE@PBD@Z
??1CCmmArchiveObjHelper@Cmm@@QAE@XZ
?FlatternToMsg@CCmmMessageHelper@Cmm@@YAPAVCmmMQ_Msg@2@PAVCCmmArchiveObjHelper@2@H@Z
??0CCritical@Cmm@@QAE@XZ
??1CCritical@Cmm@@QAE@XZ
?Lock@CCritical@Cmm@@QAEXXZ
?Unlock@CCritical@Cmm@@QAEXXZ
?GetImp@CCmmArchiveServiceImp@Archive@Cmm@@SAAAV123@XZ
?AddPackageDefine0@CCmmArchiveServiceImp@Archive@Cmm@@QAEHPBD@Z
?ParseMsg@?$CmmMessageTemplate_1@V?$CStringT@D@Cmm@@@Archive@Cmm@@UAEHPBVCmmMQ_Msg@3@@Z
?SetItem1@?$CmmMessageTemplate_1@V?$CStringT@D@Cmm@@@Archive@Cmm@@QAEXABV?$CStringT@D@3@@Z
?GetItem1@?$CmmMessageTemplate_1@V?$CStringT@D@Cmm@@@Archive@Cmm@@QAEAAV?$CStringT@D@3@XZ
??4?$CStringT@_W@Cmm@@QAEAAV01@ABV01@@Z
?GetItem2@?$CmmMessageTemplate_2@V?$CStringT@D@Cmm@@V12@@Archive@Cmm@@QAEAAV?$CStringT@D@3@XZ
?GetItem2@?$CmmMessageTemplate_2@V?$CStringT@D@Cmm@@H@Archive@Cmm@@QAEAAHXZ
?GetItem3@?$CmmMessageTemplate_3@V?$CStringT@D@Cmm@@HV12@@Archive@Cmm@@QAEAAV?$CStringT@D@3@XZ
?GetItem4@?$CmmMessageTemplate_4@V?$CStringT@D@Cmm@@HV12@V12@@Archive@Cmm@@QAEAAV?$CStringT@D@3@XZ
??0CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Request@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Request@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Response@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_GetContactInfo_Response@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_StartVideo_Request@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_StartVideo_Request@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_StartChat_Request@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_StartChat_Request@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_StartAudio_Request@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_StartAudio_Request@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_SelfEmail_Response@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_SelfEmail_Response@@UAE@XZ
??0CSBMBMessage_Outlook_IMIntegration_PhotoChanged_Notification@@QAE@XZ
??1CSBMBMessage_Outlook_IMIntegration_PhotoChanged_Notification@@UAE@XZ
??1Listener@Channel@ssb_ipc@@UAE@XZ
??0Listener@Channel@ssb_ipc@@QAE@XZ
??0CIPCChannelThread@ssb_ipc@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4ChannelMode@1@PAVListener@Channel@1@H@Z
??1CIPCChannelThread@ssb_ipc@@UAE@XZ
?IsServerGood@CIPCChannelThread@ssb_ipc@@QAEHXZ
?Start@CIPCChannelThread@ssb_ipc@@QAEHXZ
?Stop@CIPCChannelThread@ssb_ipc@@QAEHXZ
?SendMessageW@CIPCChannelThread@ssb_ipc@@QAEHPAVCmmMQ_Msg@Cmm@@@Z
?GenChannelName@CIPCChannelThread@ssb_ipc@@SAXABV?$CStringT@_W@Cmm@@IAAV34@@Z
?ThreadProc@CIPCChannelThread@ssb_ipc@@UAEIXZ
?ReleaseBuffer@?$CStringT@_W@Cmm@@QAEXXZ
?Empty@?$CStringT@_W@Cmm@@QAEXXZ
?GetLength@?$CStringT@_W@Cmm@@QBEIXZ
?Replace@?$CStringT@_W@Cmm@@QAEXPB_W0@Z
??0CmmCryptoUtil@@QAE@XZ
??1CmmCryptoUtil@@UAE@XZ
??4?$CStringT@_W@Cmm@@QAEAAV01@PB_W@Z
??H?$CStringT@_W@Cmm@@QBE?AV01@PB_W@Z
??B?$CStringT@_W@Cmm@@QBEPB_WXZ
??0?$CStringT@_W@Cmm@@QAE@ABV01@@Z
??0?$CStringT@_W@Cmm@@QAE@XZ
?find@?$CStringT@_W@Cmm@@QBEIPB_WI@Z
?c_str@?$CStringT@_W@Cmm@@QBEPB_WXZ
??1?$CStringT@_W@Cmm@@UAE@XZ
??0?$CStringT@_W@Cmm@@QAE@PB_W@Z
?SetItem2@?$CmmMessageTemplate_2@V?$CStringT@D@Cmm@@V12@@Archive@Cmm@@QAEXABV?$CStringT@D@3@@Z
zcrashreport
ord7
kernel32
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
MultiByteToWideChar
FindFirstFileW
WaitForSingleObject
GetCurrentProcess
GetExitCodeProcess
GetProcessId
GetSystemDirectoryW
GetBinaryTypeW
GetCurrentProcessId
DecodePointer
ExitProcess
GetFileSize
ReadFile
SetLastError
CreateFileW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
GetCommandLineW
SetEvent
CreateMutexW
CreateEventW
Sleep
CreateThread
InterlockedPopEntrySList
EncodePointer
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode
GetTempFileNameW
LoadLibraryExA
DeleteFileW
CreateDirectoryW
VerSetConditionMask
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
VerifyVersionInfoW
GetCurrentThreadId
GetPrivateProfileStringW
user32
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
PeekMessageW
SetWindowLongW
CreateWindowExW
GetClassInfoW
IsWindow
DefWindowProcW
UnregisterClassW
CharNextW
GetWindowLongW
KillTimer
SetTimer
DestroyWindow
LoadCursorW
CharUpperW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
RegisterClassW
advapi32
RegDeleteKeyW
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
shell32
ShellExecuteExW
SHGetSpecialFolderPathW
ole32
CoInitialize
StringFromGUID2
CoCreateInstance
CoReleaseServerProcess
CoAddRefServerProcess
CoResumeClassObjects
CoRevokeClassObject
CoRegisterClassObject
CreateStreamOnHGlobal
CoTaskMemAlloc
CLSIDFromProgID
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
oleaut32
SysFreeString
SysStringLen
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
SafeArrayCopy
SafeArrayGetVartype
UnRegisterTypeLi
RegisterTypeLi
VariantCopyInd
VariantInit
SafeArrayRedim
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
VariantCopy
VariantClear
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocString
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust
WTHelperGetProvSignerFromChain
crypt32
CertGetNameStringW
msvcp140
?id@?$collate@_W@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?is@?$ctype@_W@std@@QBE_NF_W@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
??Bid@locale@std@@QAEIXZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
_Wcsxfrm
_Wcscoll
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
shlwapi
PathFileExistsW
PathRemoveFileSpecW
PathCombineW
vcruntime140
_purecall
__current_exception_context
__current_exception
wcsstr
memmove
memset
__std_terminate
strchr
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
_except_handler4_common
api-ms-win-crt-string-l1-1-0
wcsncpy_s
_wcsicmp
wcscat_s
wcscpy_s
api-ms-win-crt-filesystem-l1-1-0
_wstat64i32
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
terminate
_initialize_onexit_table
_register_onexit_function
_resetstkoflw
_controlfp_s
_cexit
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_crt_atexit
_c_exit
_register_thread_local_exe_atexit_callback
_errno
api-ms-win-crt-heap-l1-1-0
calloc
free
realloc
_set_new_mode
_callnewh
_recalloc
malloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__p__commode
_set_fmode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 135KB - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE