Static task
static1
Behavioral task
behavioral1
Sample
NEAS.cf8a107b66a75effa2f3227622b88550.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.cf8a107b66a75effa2f3227622b88550.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.cf8a107b66a75effa2f3227622b88550.exe
-
Size
2.5MB
-
MD5
cf8a107b66a75effa2f3227622b88550
-
SHA1
0cb231c3570838d8c290f4099e4cc20c254adb99
-
SHA256
53f787f51b5b17757840c7936c9a9077e66096a100f25faf9907379bd607d47c
-
SHA512
1bb2fcd16e18d19146345f9bf4c7b404bf06422bd1b8996580f8e187a57c786fde10b3f2a831c375757f4fa4a1422e3fa272ba5729845fddd3b8f7abc4f4082b
-
SSDEEP
49152:sfwpT3hs8dLEiijzuhJxFezljA+4dZiUr6QgoYMZ/2wHJlT0tTWFJcT:sf299ijzuhJxAzRA+4dZiG6QgG5vHJaI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.cf8a107b66a75effa2f3227622b88550.exe
Files
-
NEAS.cf8a107b66a75effa2f3227622b88550.exe.exe windows:5 windows x86
d22dfe3621bbf4537df0ce0206a0d05c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
imm32
ImmReleaseContext
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetOpenStatus
ImmGetContext
wininet
InternetGetCookieA
HttpQueryInfoA
InternetConnectA
HttpOpenRequestA
InternetCloseHandle
InternetOpenA
HttpAddRequestHeadersA
HttpSendRequestA
InternetReadFile
InternetSetOptionA
wintrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust
iphlpapi
GetAdaptersInfo
gdiplus
GdipSetCompositingQuality
GdipDrawImageI
GdipCreateFromHWND
GdipCreateFromHDC
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipSetSmoothingMode
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipCreateBitmapFromResource
GdipDeleteGraphics
GdipSetPenDashStyle
GdipFillRectangleI
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromFile
GdipDrawLineI
GdipDeletePen
GdipCreatePen1
GdipDrawImageRectI
GdipDrawImageRectRectI
GdipGetDpiX
GdipDeleteBrush
GdipCreateSolidFill
GdipFree
GdipAlloc
GdipCloneBrush
GdipSetSolidFillColor
GdipFillRectangle
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteFont
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatLineAlign
GdipDrawString
GdipDrawImageRect
GdipDrawImagePointRectI
GdipSetStringFormatAlign
GdipMeasureString
GdipGetImageHeight
GdipGetImageWidth
GdiplusShutdown
GdiplusStartup
GdipGetImagePixelFormat
GdipGraphicsClear
bytoui
BUISetWnd
ord2
ord1
kernel32
GetVolumeInformationA
GetModuleHandleW
LocalAlloc
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetFileAttributesA
GetFileSizeEx
GetFileTime
GetCPInfo
GetOEMCP
GetTempFileNameA
SetErrorMode
LoadLibraryW
GetSystemDirectoryW
SearchPathA
VirtualProtect
FindResourceExA
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetTimeFormatA
GetDateFormatA
GetCommandLineA
GetStartupInfoA
GetDriveTypeA
HeapReAlloc
VirtualAlloc
GetSystemInfo
VirtualQuery
UnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
ExitProcess
ExitThread
CreateThread
HeapSize
SetStdHandle
GetFileType
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
HeapCreate
VirtualFree
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetFileInformationByHandle
PeekNamedPipe
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
CompareStringW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
ReleaseSemaphore
CreateSemaphoreA
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
FindClose
GetThreadLocale
InterlockedIncrement
GetProfileIntA
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GlobalAddAtomA
CreateEventA
SuspendThread
SetEvent
SetThreadPriority
InterlockedDecrement
GetModuleFileNameW
WritePrivateProfileStringA
GetPrivateProfileIntA
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
CompareStringA
InterlockedExchange
lstrcmpA
GlobalSize
lstrlenW
ResumeThread
RaiseException
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrcpynA
FreeResource
GlobalReAlloc
GlobalAlloc
GlobalFree
GlobalUnlock
GlobalLock
GetVersion
LocalFree
FormatMessageA
MulDiv
lstrcpyA
TerminateProcess
GetExitCodeProcess
OpenProcess
Sleep
GetTickCount
CopyFileA
DeleteFileA
TerminateThread
SetLastError
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
WaitForSingleObject
CreateProcessA
lstrlenA
GetModuleHandleA
MultiByteToWideChar
LoadLibraryExA
GetVersionExA
GetCurrentDirectoryA
GetCommandLineW
FreeLibrary
WinExec
CreateDirectoryA
CreateMutexA
GetLastError
CreateFileMappingA
GetProcAddress
LoadLibraryA
GetModuleFileNameA
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
CloseHandle
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileA
GetTempPathA
SetUnhandledExceptionFilter
MoveFileA
GetFullPathNameA
CreateFileW
user32
TranslateAcceleratorA
InsertMenuItemA
ReuseDDElParam
UnpackDDElParam
DrawEdge
DrawFrameControl
DrawFocusRect
DrawIconEx
SetCursorPos
UnionRect
EnableScrollBar
UpdateLayeredWindow
SetMenuDefaultItem
GetMenuDefaultItem
IsCharLowerA
MapVirtualKeyExA
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
FrameRect
GetUpdateRect
CharUpperBuffA
CopyIcon
SubtractRect
GetIconInfo
GetDoubleClickTime
CreateMenu
GetWindowRgn
DestroyCursor
SetScrollPos
SetFocus
ShowOwnedPopups
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
SetWindowsHookExA
CallNextHookEx
TranslateMessage
GetKeyState
ValidateRect
GetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
EndDialog
UnhookWindowsHookEx
SetWindowContextHelpId
WaitMessage
WinHelpA
MessageBeep
IsZoomed
PostQuitMessage
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
GetMenuState
GetMenuStringA
InsertMenuA
RemoveMenu
AppendMenuA
GetSubMenu
ModifyMenuA
GetMenuItemID
GetMenuItemCount
WindowFromPoint
DeferWindowPos
OpenClipboard
BeginDeferWindowPos
DestroyIcon
LoadIconA
GetFocus
GetWindow
AdjustWindowRectEx
EndPaint
BeginPaint
IsRectEmpty
SetRect
RegisterClipboardFormatA
SetCapture
GetMessagePos
ClientToScreen
ReleaseCapture
OffsetRect
FillRect
LoadImageA
InflateRect
GetSysColor
MapDialogRect
DispatchMessageA
GetMessageA
PeekMessageA
GetDlgCtrlID
SetWindowTextA
PostThreadMessageA
GrayStringA
DrawTextA
TabbedTextOutA
SetRectEmpty
SetActiveWindow
GetDlgItem
MoveWindow
IsWindowVisible
LoadStringA
GetSystemMetrics
SetWindowPos
GetCursorPos
SetCursor
ScreenToClient
ReleaseDC
GetDC
LoadCursorA
PtInRect
LockWindowUpdate
UpdateWindow
CreatePopupMenu
RedrawWindow
GetWindowRect
GetParent
InvalidateRect
CopyRect
GetClientRect
SetTimer
KillTimer
SendMessageA
SetWindowRgn
LoadBitmapA
EnableWindow
GetDesktopWindow
PostMessageA
RegisterWindowMessageA
SystemParametersInfoA
SetForegroundWindow
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
ShowWindow
IsWindow
FindWindowA
MessageBoxA
DrawStateA
EnumChildWindows
IsMenu
GetSystemMenu
SetClassLongA
SetParent
NotifyWinEvent
CreateAcceleratorTableA
LoadAcceleratorsA
DestroyAcceleratorTable
GetAsyncKeyState
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
LoadMenuA
DeleteMenu
GetSysColorBrush
GetScrollPos
CopyAcceleratorTableA
DrawIcon
CharUpperA
IsClipboardFormatAvailable
MapVirtualKeyA
GetKeyNameTextA
InvalidateRgn
CharNextA
GetDCEx
DestroyMenu
GetMenuItemInfoA
GetWindowDC
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetTopWindow
GetMessageTime
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
ShowScrollBar
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
EqualRect
GetScrollInfo
SetScrollInfo
SetWindowPlacement
DefWindowProcA
CallWindowProcA
GetMenu
IntersectRect
UnregisterClassA
GetNextDlgGroupItem
EmptyClipboard
CloseClipboard
SetClipboardData
DrawTextExA
CopyImage
IsIconic
GetWindowPlacement
SetWindowLongA
IsDialogMessageA
SendDlgItemMessageA
CheckDlgButton
GetWindowTextLengthA
EndDeferWindowPos
GetWindowTextA
gdi32
DeleteObject
CreateRoundRectRgn
CombineRgn
SetPixelV
GetTextFaceA
EnumFontFamiliesExA
GetSystemPaletteEntries
GetNearestPaletteIndex
SetPaletteEntries
ExtFloodFill
GetViewportOrgEx
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetWindowOrgEx
GetPaletteEntries
CreatePalette
CreatePolygonRgn
Polyline
Polygon
GetObjectA
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateSolidBrush
StretchBlt
GetTextMetricsA
LPtoDP
GetMapMode
DPtoLP
GetBkColor
CreateFontIndirectA
GetDeviceCaps
DeleteDC
GetTextExtentPoint32A
SelectObject
CreateDIBSection
ExtCreateRegion
GetTextExtentPointA
CreateFontW
GetCurrentObject
CreateRectRgn
CreatePen
Rectangle
CopyMetaFileA
CreateBitmap
GetDCOrgEx
GetClipBox
SetTextColor
SetBkColor
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
SelectPalette
GetObjectType
CreateHatchBrush
PatBlt
GetTextColor
CreateRectRgnIndirect
SetRectRgn
CreateEllipticRgn
Ellipse
GetRgnBox
OffsetRgn
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
SetDIBColorTable
GetDIBits
RealizePalette
SetPixel
RoundRect
msimg32
TransparentBlt
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
advapi32
RegDeleteKeyA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegEnumKeyExA
RegEnumKeyA
shell32
ShellExecuteA
CommandLineToArgvW
DragAcceptFiles
DragQueryFileA
DragFinish
Shell_NotifyIconA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderPathA
SHGetFileInfoA
SHBrowseForFolderA
SHAppBarMessage
comctl32
InitCommonControlsEx
_TrackMouseEvent
ImageList_GetIconSize
shlwapi
PathFindFileNameA
PathRemoveFileSpecW
PathStripToRootA
PathIsUNCA
PathFindExtensionA
oledlg
ord8
ole32
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoRegisterMessageFilter
CoRevokeClassObject
OleLockRunning
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
OleGetClipboard
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CreateStreamOnHGlobal
CoInitializeEx
CoUninitialize
CLSIDFromString
CLSIDFromProgID
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
CoCreateInstance
CoInitialize
oleaut32
SysFreeString
SysAllocStringLen
SysStringLen
VarBstrCat
VariantInit
VariantCopy
VariantClear
SysStringByteLen
SysAllocString
VariantChangeType
OleCreateFontIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SysAllocStringByteLen
ws2_32
recv
inet_addr
htons
gethostbyname
WSAGetLastError
closesocket
connect
setsockopt
shutdown
ioctlsocket
select
__WSAFDIsSet
send
gethostname
WSAStartup
WSACleanup
WSASetLastError
socket
ktpsock
ord2
KPTSetAuthKey
ord5
ord1
ord8
ord7
ord9
ord3
crypt32
CryptVerifyCertificateSignatureEx
CertGetNameStringA
winmm
PlaySoundA
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 419KB - Virtual size: 419KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 203KB - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ