Static task
static1
Behavioral task
behavioral1
Sample
NEAS.3e1008c6776421cbdd36c05a078f6960.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.3e1008c6776421cbdd36c05a078f6960.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.3e1008c6776421cbdd36c05a078f6960.exe
-
Size
1.0MB
-
MD5
3e1008c6776421cbdd36c05a078f6960
-
SHA1
8e7746b96afb74ccf3cd4a033cde57720a10d715
-
SHA256
a0ad4a5db0238516dcfc2fc6be52b304ee18194b46e3492d2309aaffd48df272
-
SHA512
14651053a7f9e1c7c0ea0ca37fd92f2a9064fadf6d753d83f770ec6a7b94bfbf5332612e8780fe0f171c469cf8d0f3cfa2c95fff9949e61cd696b75859e6e0d8
-
SSDEEP
24576:cYyBpvSkbJzHV6mBw9KY2oqd+iMA4UI5:bkVzHV6mBw9KY2o7jp5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.3e1008c6776421cbdd36c05a078f6960.exe
Files
-
NEAS.3e1008c6776421cbdd36c05a078f6960.exe.exe windows:6 windows x86
36bcbb933bdc5d79c85f3a2a239d5423
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
listen
bind
accept
WSAGetLastError
socket
shutdown
setsockopt
send
recv
inet_ntoa
getpeername
connect
inet_addr
htons
closesocket
WSAStartup
kernel32
GetCurrentThreadId
HeapSize
GetLocalTime
CreateFileW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
GetTimeZoneInformation
GetProcessHeap
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForMultipleObjects
CloseHandle
CreateEventA
SetThreadPriority
ResetEvent
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
SetEndOfFile
InitializeSListHead
RaiseException
RtlUnwind
GetLastError
FreeLibrary
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
GetStdHandle
GetFileType
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ReadFile
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetCurrentThread
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
OutputDebugStringA
OutputDebugStringW
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
MoveFileExW
Sections
.text Size: 815KB - Virtual size: 814KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 260B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ