DllCanUnloadNow
DllGetClassObject
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.ae86e1865a1f596ebedbba92cd37edc0.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.ae86e1865a1f596ebedbba92cd37edc0.dll
Resource
win10v2004-20231023-en
Target
NEAS.ae86e1865a1f596ebedbba92cd37edc0.exe
Size
3.7MB
MD5
ae86e1865a1f596ebedbba92cd37edc0
SHA1
f4e3a78dd47549758b8017e6cb9edff5a3bf6662
SHA256
3d4edd242b4ff37d6ad96f680ccfb96bc3d92367e02e849b7ceb48bf786533d3
SHA512
fdd696b3ac8e3c533ea79ccdeb382af493d73b51c63f24febe3569f275257ec62e419bd58f4c5cf9bb094432d506c2edfd06d4b6d67300062c5fc1b5233649f8
SSDEEP
6144:zRXNv+ho8hrCF2vmBNoXjzuJG1mc/dp+CuIg8XEIO6xjhKyjODLU:NXNf2veoTzu0mc1nuWX1n7KIM
Checks for missing Authenticode signature.
resource |
---|
NEAS.ae86e1865a1f596ebedbba92cd37edc0.exe |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
ord219
SHStrDupW
CoTaskMemFree
CoTaskMemAlloc
LoadBitmapW
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
OutputDebugStringA
OutputDebugStringW
CloseHandle
GetSystemTimeAsFileTime
Sleep
lstrlenW
GetComputerNameW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
LocalAlloc
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
lstrlenA
LocalFree
InitializeSListHead
ShellExecuteW
?_Xlength_error@std@@YAXPEBD@Z
?_iceRead@Value@Ice@@UEAAXPEAVInputStream@2@@Z
?_iceWrite@Value@Ice@@UEBAXPEAVOutputStream@2@@Z
?ice_getSlicedData@Value@Ice@@UEBA?AV?$shared_ptr@VSlicedData@Ice@@@std@@XZ
?ice_postUnmarshal@Value@Ice@@UEAAXXZ
?ice_preMarshal@Value@Ice@@UEAAXXZ
?_usesClasses@UserException@Ice@@UEBA_NXZ
?_read@UserException@Ice@@UEAAXPEAVInputStream@2@@Z
?_readImpl@UserException@Ice@@MEAAXPEAVInputStream@2@@Z
??0UserException@Ice@@QEAA@XZ
?_write@UserException@Ice@@UEBAXPEAVOutputStream@2@@Z
?ice_getSlicedData@UserException@Ice@@UEBA?AV?$shared_ptr@VSlicedData@Ice@@@std@@XZ
??1UserException@Ice@@UEAA@XZ
??0Exception@IceUtil@@QEAA@AEBV01@@Z
??1Object@Ice@@UEAA@XZ
??0Object@Ice@@QEAA@XZ
?startSlice@OutputStream@Ice@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N@Z
?ice_dispatch@Object@Ice@@UEAA_NAEAVRequest@2@V?$function@$$A6A_NXZ@std@@V?$function@$$A6A_NVexception_ptr@std@@@Z@5@@Z
?ice_ping@Object@Ice@@UEBAXAEBUCurrent@2@@Z
?ice_staticId@Metrics@IceMX@@SAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1AdapterNotFoundException@Ice@@UEAA@XZ
??1FactoryTableInit@IceInternal@@QEAA@XZ
?ice_staticId@RemoteLoggerAlreadyAttachedException@Ice@@SAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?stringToIdentity@Ice@@YA?AUIdentity@1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?initialize@Ice@@YA?AV?$shared_ptr@VCommunicator@Ice@@@std@@AEBUInitializationData@1@H@Z
?ice_staticId@AdapterNotFoundException@Ice@@SAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1Value@Ice@@UEAA@XZ
??0Value@Ice@@QEAA@AEBV01@@Z
??0Value@Ice@@QEAA@XZ
?read@InputStream@Ice@@QEAAXAEA_J@Z
?endSlice@InputStream@Ice@@QEAAXXZ
?startSlice@InputStream@Ice@@QEAA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1UnknownMetricsView@IceMX@@UEAA@XZ
?write@OutputStream@Ice@@QEAAX_J@Z
??1RemoteLoggerAlreadyAttachedException@Ice@@UEAA@XZ
?what@Exception@IceUtil@@UEBAPEBDXZ
?ice_print@Exception@IceUtil@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?ice_print@OperationNotExistException@Ice@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?ice_print@RequestFailedException@Ice@@UEBAXAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
??0FactoryTableInit@IceInternal@@QEAA@XZ
?readEmptyParams@Incoming@IceInternal@@QEAAXXZ
?endReadParams@Incoming@IceInternal@@QEBAXXZ
??0UserException@Ice@@QEAA@AEBV01@@Z
??1Metrics@IceMX@@UEAA@XZ
?_writeImpl@UserException@Ice@@MEBAXPEAVOutputStream@2@@Z
?startReadParams@Incoming@IceInternal@@QEAAPEAVInputStream@Ice@@XZ
?writeEmptyParams@IncomingBase@IceInternal@@QEAAXXZ
?endWriteParams@IncomingBase@IceInternal@@QEAAXXZ
?startWriteParams@IncomingBase@IceInternal@@QEAAPEAVOutputStream@Ice@@XZ
??0ObjectPrx@Ice@@IEAA@XZ
?_checkTwowayOnly@ObjectPrx@Ice@@QEBAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1ObjectPrx@Ice@@UEAA@XZ
?invoke@OutgoingAsync@IceInternal@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4OperationMode@Ice@@W4FormatType@6@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@4@V?$function@$$A6AXPEAVOutputStream@Ice@@@Z@4@@Z
?ice_staticId@OperationNotExistException@Ice@@SAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1OperationNotExistException@Ice@@UEAA@XZ
?ice_staticId@RequestFailedException@Ice@@SAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1RequestFailedException@Ice@@UEAA@XZ
?read@InputStream@Ice@@QEAAXAEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?read@InputStream@Ice@@QEAAXAEAH@Z
?read@InputStream@Ice@@QEAAXAEA_N@Z
?write@OutputStream@Ice@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?write@OutputStream@Ice@@QEAAXH@Z
?push_back@Container@Buffer@IceInternal@@QEAAXE@Z
?_iceCheckMode@Object@Ice@@KAXW4OperationMode@2@0@Z
?_iceD_ice_id@Object@Ice@@QEAA_NAEAVIncoming@IceInternal@@AEBUCurrent@2@@Z
?_iceD_ice_ids@Object@Ice@@QEAA_NAEAVIncoming@IceInternal@@AEBUCurrent@2@@Z
?_iceD_ice_ping@Object@Ice@@QEAA_NAEAVIncoming@IceInternal@@AEBUCurrent@2@@Z
?_iceD_ice_isA@Object@Ice@@QEAA_NAEAVIncoming@IceInternal@@AEBUCurrent@2@@Z
??1LocalException@Ice@@UEAA@XZ
??0LocalException@Ice@@QEAA@AEBV01@@Z
??0LocalException@Ice@@QEAA@PEBDH@Z
?endSlice@OutputStream@Ice@@QEAAXXZ
?ice_staticId@UnknownMetricsView@IceMX@@SAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
memcpy
_purecall
__std_terminate
__std_type_info_destroy_list
__C_specific_handler
__std_exception_copy
__current_exception
memset
memmove
__current_exception_context
memcmp
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler4
_cexit
_initterm
_initterm_e
_wassert
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_crt_at_quick_exit
_crt_atexit
terminate
_invalid_parameter_noinfo_noreturn
mbstowcs
wcstombs
setlocale
__stdio_common_vswprintf
free
malloc
_callnewh
LsaDeregisterLogonProcess
LsaConnectUntrusted
LsaLookupAuthenticationPackage
CredIsProtectedW
CredProtectW
CredUnPackAuthenticationBufferW
CredPackAuthenticationBufferW
DllCanUnloadNow
DllGetClassObject
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ