Static task
static1
Behavioral task
behavioral1
Sample
NEAS.fffbc360da9af9b7df4e52d4129ec900.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.fffbc360da9af9b7df4e52d4129ec900.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.fffbc360da9af9b7df4e52d4129ec900.exe
-
Size
1.2MB
-
MD5
fffbc360da9af9b7df4e52d4129ec900
-
SHA1
0b2ab9143529f46d993b1db25de0a59d8c2530bd
-
SHA256
3495b0a6508f1af0f95906efeba36148296dccd2ab8ffb4e569254b683584fea
-
SHA512
70a1766b1ab64e52585ce9b64cc84eb0a21e34cb65fc37d379e62cb81c8539bc9c8b5f326c3f322bb588214afb899d811307f1e8278a2d2aa6b7d586ba8358e7
-
SSDEEP
24576:9THU31fkuXZs7ueyxvt37h7jNxYmQgNk/udyg8J:NU31VXmtyr+gNkwygc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.fffbc360da9af9b7df4e52d4129ec900.exe
Files
-
NEAS.fffbc360da9af9b7df4e52d4129ec900.exe.exe windows:6 windows x64
d708f4bf2491e03e6f0d949210195047
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LeaveCriticalSection
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetTempFileNameA
ExpandEnvironmentStringsA
SetCurrentDirectoryA
CopyFileA
GetCurrentProcess
GetModuleHandleA
ReadConsoleW
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
EnterCriticalSection
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetProcAddress
AreFileApisANSI
FindNextFileA
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
TerminateProcess
GetStdHandle
GetFileType
GetModuleFileNameA
GetModuleFileNameW
WriteConsoleW
ExitProcess
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
FindClose
FindFirstFileExA
advapi32
RegQueryInfoKeyA
RegCloseKey
RegQueryValueExA
CredEnumerateA
CredFree
RegOpenKeyExA
RegEnumKeyExA
shell32
SHGetFolderPathA
crypt32
CryptUnprotectData
Sections
.text Size: 889KB - Virtual size: 888KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.textbss Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 193KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 39KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ