Static task
static1
Behavioral task
behavioral1
Sample
NEAS.5dfc9e37da21c56e84f49ea4c1d43500.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.5dfc9e37da21c56e84f49ea4c1d43500.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.5dfc9e37da21c56e84f49ea4c1d43500.exe
-
Size
3.7MB
-
MD5
5dfc9e37da21c56e84f49ea4c1d43500
-
SHA1
aae6cc583b0c3323e39ea9be8aa58b2bb589026a
-
SHA256
a25284f723a32733c03b344aec2a81869e6d1bb5527cbb26bbb3f2ab23c16a9b
-
SHA512
1c92af785e417fb89b8b3b4261295d04e96ec87c40e151d9a7fd9df22fb8376d089f6d9548b262d7db6189845b67c3d55f0a6f4c31ce257b00cf738c978948e3
-
SSDEEP
49152:6/rblHgUT/n0QgYyI3osJ4JgCXzoXrM5PVBZ//54UETiOnmpBItabwhLk:6/rbKU7g6YsJ4JgC1B4U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.5dfc9e37da21c56e84f49ea4c1d43500.exe
Files
-
NEAS.5dfc9e37da21c56e84f49ea4c1d43500.exe.exe windows:6 windows x86
1f5e29e846d9e5c6e984ea9b774fb497
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertOpenSystemStoreA
CertGetCertificateContextProperty
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
ws2_32
getpeername
shutdown
getaddrinfo
WSAStartup
gethostname
inet_ntop
freeaddrinfo
bind
inet_ntoa
connect
accept
WSACleanup
htonl
ntohs
gethostbyaddr
gethostbyname
getservbyport
getservbyname
WSASetLastError
ioctlsocket
listen
__WSAFDIsSet
WSAIoctl
recv
send
getsockopt
recvfrom
sendto
WSAPoll
ntohl
select
socket
getsockname
closesocket
WSAGetLastError
setsockopt
htons
inet_addr
iphlpapi
GetAdaptersInfo
advapi32
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
OpenServiceW
OpenSCManagerA
DeleteService
CreateServiceW
CloseServiceHandle
ChangeServiceConfigA
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
CryptGenRandom
CryptAcquireContextA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
kernel32
ReadFile
GetTimeZoneInformation
GetEnvironmentVariableA
GetSystemInfo
FlushFileBuffers
CreateEventW
ReleaseMutex
CreateMutexW
WaitForMultipleObjects
TerminateProcess
ResetEvent
LocalFree
SetConsoleCtrlHandler
GetModuleFileNameW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WriteConsoleW
GetExitCodeThread
CreateThread
SetEvent
GetSystemDirectoryW
GetTempPathW
GetLongPathNameW
UnlockFileEx
GetLastError
CreateFileA
CloseHandle
LockFileEx
MultiByteToWideChar
GetSystemTime
FormatMessageA
GetCurrentProcess
GetCurrentThread
GetComputerNameA
LoadLibraryA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryA
FreeLibrary
SetHandleInformation
DuplicateHandle
InitializeCriticalSection
DeleteCriticalSection
ReleaseSemaphore
WaitForSingleObject
Sleep
GetCurrentThreadId
SetThreadPriority
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateSemaphoreA
SetLastError
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FormatMessageW
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
SystemTimeToFileTime
GetVersionExA
CreateFileW
DeleteFileW
GetFileAttributesW
GetFileAttributesExW
RemoveDirectoryW
SetFilePointer
MoveFileExW
GetCurrentDirectoryW
shell32
SHGetFolderPathA
user32
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?classic@locale@std@@SAABV12@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
?_Xlength_error@std@@YAXPBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ
?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ
?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AAE@XZ
_Cnd_unregister_at_thread_exit
?__ExceptionPtrCreate@@YAXPAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
_To_wide
_Make_dir
_Stat
_To_byte
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?_Winerror_message@std@@YAKKPADK@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_Syserror_map@std@@YAPBDH@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPAX@Z
_Mtx_init_in_situ
_Cnd_register_at_thread_exit
_Thrd_sleep
_Cnd_wait
_Xtime_get_ticks
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
bcrypt
BCryptGenRandom
vcruntime140
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
__std_type_info_compare
__std_type_info_name
__RTtypeid
__RTDynamicCast
strrchr
wcsstr
memset
memcpy
_set_se_translator
__CxxFrameHandler3
_CxxThrowException
__std_terminate
strstr
strchr
memchr
_purecall
__std_exception_copy
memmove
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
terminate
_invalid_parameter_noinfo_noreturn
_configure_narrow_argv
_initialize_narrow_environment
_getpid
abort
_controlfp_s
_initialize_onexit_table
_register_onexit_function
_errno
_crt_atexit
_invalid_parameter_noinfo
_cexit
_seh_filter_exe
_set_app_type
_beginthreadex
_endthreadex
_get_initial_narrow_environment
_initterm
_initterm_e
strerror_s
_register_thread_local_exe_atexit_callback
signal
strerror
__p___argc
__p___argv
_c_exit
raise
_exit
exit
api-ms-win-crt-environment-l1-1-0
_putenv_s
getenv_s
getenv
api-ms-win-crt-string-l1-1-0
_stricmp
_strnicmp
_strdup
strcmp
strspn
strncpy_s
strcat_s
isalnum
strcpy_s
strncat
tolower
isdigit
isspace
strncmp
strcspn
strncpy
api-ms-win-crt-time-l1-1-0
_mktime64
_gmtime64_s
strftime
_localtime64
_time64
_ftime64
api-ms-win-crt-stdio-l1-1-0
_setmode
ftell
fseek
_wfopen
_fileno
ferror
_set_fmode
feof
__stdio_common_vsprintf_s
__p__commode
fclose
fputs
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
fwrite
fgetc
fflush
fputc
fread
__stdio_common_vsprintf
fgets
__stdio_common_vswprintf
fopen
api-ms-win-crt-convert-l1-1-0
strtol
strtoul
atoi
atol
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_access
_lock_file
_unlock_file
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
malloc
realloc
free
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-math-l1-1-0
floor
__setusermatherr
ceil
_except1
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 859KB - Virtual size: 858KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 95KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 173KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ