Static task
static1
Behavioral task
behavioral1
Sample
NEAS.cb8935bd64d415d7296ce210710b8430.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.cb8935bd64d415d7296ce210710b8430.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.cb8935bd64d415d7296ce210710b8430.exe
-
Size
2.6MB
-
MD5
cb8935bd64d415d7296ce210710b8430
-
SHA1
47affd3198014e18a065cdefb326d92bd79cd329
-
SHA256
a9ad00fc750a6103e1f42f2e84673df0f8bda82f215c032c73b9f88e8f3dcd1e
-
SHA512
1bd67978a93ea0ae64f7c06bc2411115dbbe3e5c61f0be66b58f1564b4294125eb3538d044fd133519e0f5e9da427ff6e9541797835df28635cbef9ed5562df7
-
SSDEEP
49152:7G0OpnAuAqo0D7I8cBthxWknSBGPsSF0iRl3k/0FhowKzOvoLZ+KBZgcBVt4A34w:7IAxSBj27L2oQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.cb8935bd64d415d7296ce210710b8430.exe
Files
-
NEAS.cb8935bd64d415d7296ce210710b8430.exe.exe windows:4 windows x86
39e9ab8f077562924c169cc32db1d7d3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleFileNameExW
EnumProcessModules
GetProcessMemoryInfo
wsock32
setsockopt
inet_ntoa
send
recv
getprotobyname
htons
socket
connect
select
__WSAFDIsSet
WSAStartup
WSAGetLastError
WSACleanup
ioctlsocket
inet_addr
gethostbyaddr
gethostbyname
gethostname
htonl
ntohl
getsockopt
closesocket
ntohs
netapi32
Netbios
comctl32
ord17
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryExW
LoadLibraryW
TerminateProcess
InterlockedCompareExchange
OpenSemaphoreA
CreateSemaphoreA
InterlockedExchange
GetStartupInfoA
OpenProcess
GetCurrentProcessId
GlobalMemoryStatusEx
EnterCriticalSection
WaitForSingleObject
SetEvent
InitializeCriticalSection
DeleteCriticalSection
ReleaseMutex
CloseHandle
CreateMutexW
LeaveCriticalSection
ReleaseSemaphore
QueryPerformanceCounter
WideCharToMultiByte
GlobalAlloc
GetCommandLineW
GetModuleFileNameW
GetExitCodeProcess
CreateProcessW
GetVersionExA
GetVersion
Sleep
FreeLibrary
ResetEvent
CreateEventA
GetProcAddress
LoadLibraryA
GetTickCount
GetWindowsDirectoryA
GetModuleHandleA
SetErrorMode
SetHandleInformation
GetLastError
CreateMutexA
MultiByteToWideChar
GetEnvironmentVariableA
GetEnvironmentVariableW
GetVolumeInformationA
GetDriveTypeA
GetCurrentProcess
VirtualAlloc
VirtualFree
FindFirstFileW
FindFirstFileA
FindNextFileW
FindNextFileA
FindClose
SetLastError
GetProcessTimes
GetPrivateProfileStringA
GetPrivateProfileIntA
CreateFileA
ReadFile
WriteFile
DeviceIoControl
GetModuleFileNameA
GetSystemTime
SystemTimeToFileTime
GetLocalTime
LocalAlloc
LocalFree
GetFileSize
SearchPathA
user32
GetSystemMetrics
GetClientRect
ScreenToClient
MoveWindow
ShowWindow
SetWindowTextA
SetFocus
GetFocus
GetParent
wsprintfA
GetDlgItemTextA
GetDlgItemTextW
SetDlgItemTextA
MessageBeep
GetWindowLongA
SendMessageA
GetDlgItem
GetWindowRect
EnableWindow
GetActiveWindow
MessageBoxA
MessageBoxW
CreateDialogIndirectParamA
DialogBoxIndirectParamA
EndDialog
comdlg32
GetOpenFileNameA
advapi32
RegEnumKeyExA
GetUserNameW
GetUserNameA
RegSetValueExW
RegSetValueExA
RegEnumValueA
RegCreateKeyExA
RegDeleteValueA
RegDeleteValueW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
shell32
SHGetFolderPathW
CommandLineToArgvW
msvcr80
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memmove_s
calloc
_set_error_mode
printf
_msize
_localtime64
_time64
getenv
signal
wcsncpy
_set_invalid_parameter_handler
_setjmp3
strcpy
strlen
strcmp
fprintf
_iob
_sys_errlist
_sys_nerr
fflush
strcat
_exit
longjmp
abs
__p__environ
strstr
vsprintf
_putenv
_endthread
_beginthread
atol
clearerr
fseek
ungetc
fgets
fgetc
strtol
qsort
_pctype
_isctype
__mb_cur_max
rand
srand
_findclose
memcmp
fopen
freopen
_wopen
rename
remove
perror
_popen
getchar
fread
ftell
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_XcptFilter
_ismbblead
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_time32
_mktime32
_localtime32
_stat32
_findnext32
_findfirst32
_wstat32
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_invoke_watson
_controlfp_s
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_wmkdir
_errno
_write
_lseek
_close
_read
strtok
_wstat64i32
_waccess
_wfopen
_wunlink
_wfreopen
fclose
_wremove
isdigit
realloc
?_wopen@@YAHPB_WHH@Z
exit
abort
malloc
atoi
tolower
atof
strncmp
isspace
toupper
memmove
strncpy
strchr
strrchr
memset
free
??_V@YAXPAX@Z
memcpy
??_U@YAPAXI@Z
??2@YAPAXI@Z
__CxxFrameHandler3
_purecall
??3@YAXPAX@Z
sscanf
sprintf
_strdup
_stricmp
_getcwd
_getpid
_open
_access
_unlink
fwrite
fputc
feof
__RTDynamicCast
_vswprintf_c_l
_wrename
msvcp80
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??_7ios_base@std@@6B@
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?allocate@?$allocator@D@std@@QAEPADI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
qtcore4
?event@QObject@@UAE_NPAVQEvent@@@Z
?metaObject@QTranslator@@UBEPBUQMetaObject@@XZ
?translate@QTranslator@@UBE?AVQString@@PBD00@Z
?disconnectNotify@QObject@@MAEXPBD@Z
?load@QTranslator@@QAE_NABVQString@@000@Z
??1QString@@QAE@XZ
?connectNotify@QObject@@MAEXPBD@Z
??0QString@@QAE@PBVQChar@@H@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
??0QString@@QAE@XZ
?isEmpty@QTranslator@@UBE_NXZ
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
??1QTranslator@@UAE@XZ
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
??0QTranslator@@QAE@PAVQObject@@@Z
?qt_metacall@QTranslator@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?qt_metacast@QTranslator@@UAEPAXPBD@Z
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
Sections
.text Size: 876KB - Virtual size: 873KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.textidx Size: 532KB - Virtual size: 531KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CONST Size: 4KB - Virtual size: 80B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 112KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.1MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ