�/@Yu1����H��������Pb��!��(d� ��Tkv{"U �g������#�+Ë==��fUo/��G� ?"������R�Q0W����(�4�����]6�oA�B���X�������Hj_��Ά}�tT����ߛm��tX��ÏM۸�I<U�͖.��s��qNo^�ǘi���S�y��q��[�� �Y��~��� �Ȧx,"��F.��Į���CT�'?ko{������\*��C���AQ�(��'~q ��CA`r�yv�3Я�\���B�%������3��*�Tڅ�s�#�Y<I�X>�Q��rĮ�_�=�C�>Z�N�ui?1���;�V+1 T#|�kD���I�M/���'�d��DMQ�zË�5�>(��;g�6nf�7c���T�ͻG%�#N�P�3�ɡR*������ڞ>�iЪ�n�N�lM?�v: ��������Wh&�'�<�?�D���Gݐ�$���t���T��CZ��q~6u��-ͦ�����f9\��vi�"������Q0s�^�Q]=J��:��CҘ�H��˨;Σ�x�P�88������t���m�j�/8�f�����;������%9�SN��'��1D�ØKx4 w�v=q�Ƶߧk��;��F�>ۣ_�g��Q����$U��n�q�B�p x�v���5�r��ڦ���b~%�$���K{Y��<=v���jY��^�j�9���������w��x��럱X5.�P����J%9�����j�m�=����2�Ԁ�����uo��0��M��U]��j(6 ��� X�L/��G>�5�L� �]E�����Kq�~4���+����!�]�j��h�5z�K�U�j��py��e"���OO���^����8�0���oa!��OI#?��x��pz�ڲ�`=d��5]��V�%S�^[�7J[h�zp�}�a��hG�K��;��3 <�V�{`�nk�������i����.#�~����DfvP{ܶ��@�?-�$R�n��ۃz��\�bJ16+g}g�6L�t���`yu�Z'��ެ���9��?�9�+\�{5���2ơ�����/�V�pl����J�D"VDyȇX�1� �tOќ;.���*ّ��q"z����DŵM��p�^Ǹ�_@e܂��Ƨ�N4�OZ������̚j��P�SwN���ҵ���x�9�摋�p!ޠ~u���N>"���6BC�<f��-p8�0å��T��͐0J�鉛���U�xw�f�� �^Y�W���iߎ@xw���!�?Z����Z�ժ�f+�Sh�z �AM����gֱ����y�&d���C�{@�Q)�뢗��CR�h6��=@�u���d�ZDkU� o��~��YI,�rz /U!f�7��?����:b�w���v`/�u��b�ůcS~��=ǰK��l��3�#����f�!H��\� ��3j���W�c܋��sg����������.�!=���<ˠN0�v@�'��=���s�;��喰��4��3�$D���ø(Z�ے=e�L���(X�K}�"��L��r�L��a�Enk��rP'�E%��淯��]�mq#J�`�x�������,A�I�Ap4��]�iۖ&��v͚&4��D� 3�9<�:ԕ<F�����<@����c�4�L���,�N�7�4�^�u&d����?#�/��5��Ϸ +~Riw2�)P�� ������������آkK����o�e�/G̡�,��$n�@��cj�ݛ�V.Lɾ)@\���e�kGI< �/�TK��23��XU�6�[)Ʈ'��&s�+p]X��]�TS��兔��!������ڦ�%cuѬ��)+;#�E���ל��7��ˀ��x�-�1�%x�d�L�����+�5몺Ns��w��5����>0���˭w��%��$� �7/l[�F�1��W@:�.8�`�I��۽�'`AY��MD��{�P�Y GpW>]��&����̢���uR�z�kI >��d���z�:��.��1������ʂ� ��=Eu�gk�DǼ��9����uh�SPԡ�}��?ݫ� ���5B�#,U������k���,`R����n�7��s�e>����r*��MR��)7:�KD��@��NUB&��|f29_JX�I@/I�pu�&��ǎ��$�ў۶�eo}�8 �D����j#V�3�����K5��K�纵��� � z���2���I�,0~p�Ӻۄb�l��߀�Y$�B����h. ��;�GB�9<w��Ć���pDH��S~�O�Z����D�_p�|�7�j2��)���G��4���~ H�L x���?���rP(��sSΠ����<4$�[�I��J�CSD��/�E�n��l-貮wB��(�X���;���4��LH"��/�?�k�{�ُش�) `�O�-���ŷ��dXE�5"����:����BH���V�aH�+/��>�����K]�'��۽��UN��E�# ���@��({$��i�k Z�b`��lg��z�ŨhT��~?[&������C<\mN�?A2g��D2�_����p�"� o��&��Y̔[F��q�n:Eèz�q,�� ��,�j��jT1+�V̻2�\C�����zГQ�A�Q����V����[�D�~�il�$n��Y4F �� @�VR��*�N�(hrEPa@��H�@�k pk�}����(P`��)�M��A�����F��l���A�+�*W��Иa7�5����s��g.7��E��>�|�W_�� �h���V�#�3�$�q������҇�����3��6��Q|�Tx�]��.�{��"�`��X�FJN��np#Gʱ�X�6:Wh\���>l^8�u��(xޕC� ��y�T�y��%F\�$-V��������R/����4��Ԙ�G1q#L�S�A�����i�����&���j h�����X����*f>�1��n��b�D���*ĩ�3�-�����N�KNbC��|C��ҵ2�S���e�{��47�
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c47b9b9b4f11f1f28d18950535b1e730.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.c47b9b9b4f11f1f28d18950535b1e730.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.c47b9b9b4f11f1f28d18950535b1e730.exe
-
Size
2.9MB
-
MD5
c47b9b9b4f11f1f28d18950535b1e730
-
SHA1
ca181d2a0c100608e62449b5e232a4a28aceb67e
-
SHA256
90ee8fb63a866f1569041c7cf3c25172e344ba93f2e1076624e7a8f4b2daa9ce
-
SHA512
59ae00e40e0afd33fa27040540ff7e12e18b7f2fd55dc3069372efcbc2c83bcba4e60a204e7bdc53616bde0ad1f40360feb55322905ab6d9d248f78c36745b93
-
SSDEEP
49152:FV0CpQeqzz/OxgjAUubtxN0NoQ9xRCP7qHBmROfasJf8EwnBcTJzSDJ8XaeNtu:FV0CSZzz/OxgkxpH0Nlw75mJf8LnCNWH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.c47b9b9b4f11f1f28d18950535b1e730.exe
Files
-
NEAS.c47b9b9b4f11f1f28d18950535b1e730.exe.exe windows:4 windows x86
4cdc74a14357f88b66071834f521cc14
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
lstrcpy
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
comctl32
InitCommonControls
user32
MessageBoxA
Exports
Exports
Sections
Size: - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
WinLicen Size: - Virtual size: 1004KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ