Static task
static1
Behavioral task
behavioral1
Sample
NEAS.8a1571eac6095586d469b97e12e3f2b0.exe
Resource
win7-20231020-en
General
-
Target
NEAS.8a1571eac6095586d469b97e12e3f2b0.exe
-
Size
23KB
-
MD5
8a1571eac6095586d469b97e12e3f2b0
-
SHA1
3ad306946532ec8790ddcf6d8e04b1f7846e2ff1
-
SHA256
fe12e1607de1dc8cf8031837117e1d9947024c3d287a601b54bf5d9a8994b613
-
SHA512
76c3546188f5e94966cb1a3370f9b32c6e71947694d1e12f2dac5af8ba0a0cb127293a297062e9f24ec60782ed4685635d3494960ad125c299ba315832cb669b
-
SSDEEP
384:rOFn1gVkQM0qBX1IIGY1wMvhHa4cvFCFmSf0jYhjW47dmzmTOuZO:aHgCOqZ1IIGkw8Ha4FfjXZO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.8a1571eac6095586d469b97e12e3f2b0.exe
Files
-
NEAS.8a1571eac6095586d469b97e12e3f2b0.exe.exe windows:4 windows x86
7a02d10764879840106bfe2f24b1661c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
strstr
strncmp
strncpy
strlen
strcpy
strcat
memcmp
_stricmp
sprintf
memcpy
kernel32
GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
GetDriveTypeA
HeapAlloc
HeapFree
CloseHandle
CreateFileA
SetFilePointer
SetEndOfFile
WriteFile
GetFileSize
ReadFile
MultiByteToWideChar
FindClose
FindFirstFileA
GetLastError
FindNextFileA
GetFileAttributesA
HeapReAlloc
user32
CharLowerA
CharUpperA
advapi32
RegOpenKeyA
RegConnectRegistryA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
Sections
.code Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 700B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ