{�R�rD�����Q�c��;��ln��K��˝ų_�L*0����i���^3H�d�7�z��hj���զ�R������5�����7'��U2�Ou{��fg}��1�K� ��i;��@�h���� ��K ��N��_�a��G� [���Y�s��J:�?h�g~\��h�[��r ��3��7�g�U��k��2��<�Q���k�z�5MP+���2q� �"�Ѕ�5�=��}:�-�`sO�����&�E�>���ʞ���7���~S]�nX�Y�`4)�;��oJ� f�]5�� ��x`t�]ʍ1�����rj]������WOp���\dV��R�*�҉h䀆�HB��Ƭ��"e !�`m�Ĕ�_yP�_�xeM��Ln��h��Gp-(�����.���$W�s��O�wMHDٰ��(��J�}3}���'�U`�R��E���*4�$ ������k0�O�����`w�a��j3��s�B�%#�z��?�4�-�7�v���dCo�@{>��u����f#���~��5���o�8��R���Ng;��*&K��Q� ��1΄r�)�����G���BT����E��]��kH<��ܳV���V�g)��ͺ��d�JN�~Rs_.��"�T��/����F&6̩��P�Ev���@<�;��Hn� �bq(��|�L!�y3��[k�3 ��M�����,�</3!:��E�y��x��S~���n9DR���V�(�{�;���J�a���?����[�����z+qP��N�5��A"��ы5q���|{�8�`aрf�L�\��;{�bx���h\Z���\��u{ވ�1�=�]�j��E ����34�=��ɖ�t�y:,��J!��O�UJᵹ�f��jь���uy��X�e�]���?�"5��L�^�Z���j 3㺠�����y��%�J�e��QBɢ�0� -*!)E�ۓ;(�R� ���&���JM�oȉ���b��i�}�q�p�8����]�ЉQ����x#7�(�k�����Ủ��E��X���\{���,���G�h\d, ��)ܥ*�'�Y�q�(�[@�C�[JFz���Þ�C�������ڱ���ot��1�-W�=�Z/=E�������a֬�vH�̖Yl{���㰆��1m^+�a����y⟐>7-�؇#�´�$��R�Sa2����'�e�d������da,�WZ�����p(vn�l=�\�=R4������N �.���$i���}+"Dc�H����<�ߛF�w8W�;tQ�������CM�ӆ;�ꬄ2��bP���-�}C�C{���`n՛R�{Z5�:a)�o���{z����r�Ah�ɜ����{hX]!�vP��$�[��g$��F~ 8�R ���@�M �`��)����*����"@��.�������G[ʫ�V9���{��3�?z����vwr�+�"�v��g��;% ���M�ỏ|�0n�x��D:IC�p�����GЭ�����\��x�X��-�[�|uNW�ά���ɖ/��S�ӫRK��gI��Y�H.�MQ ���}ͼ�-����t������.y6�>PY�� ���m��«�3&���j5k �a{�.����}Ї��!Z���آ��8.�_�枀�Y��x�|R%=�����NR�6q��tz|=����O� Ft��KN��aT<H��LJ�Ɠ����/<���q2r��"E'��?L��7Z��bjꋣdQ��U-���2wu�8�p���k�������"ixQ�Ej�Yf���� �7��+�4�㧁K�R|���������|�fH*��[`��s��z��5%��n�y5Q9��J�ݺ�d�7���u�g/[-Z������� b�W���m/����!%�����C�����+ӞE%�F��4��ׂ��Qb,F�ic�zf>豤�뼃���k�JQ�!��9�.d��,�|�3�[{�9I6 U4f ����l�b�/��&�22jS�~��_9{��Q�,��R.W�m#�)�P��H,I������.��bF@���<��K�,�kIp �BC|+�6t�س�lDG���Td�{-�6� �nS都�ed����ߢ�|�� ��* ӧ�KZ�4���d�|RP��ԉ!��UF��:r��nu����X77s��y����)�*c쯺$�����&��ݼ���4�@j5�������,-�t_�3q.c�݇W�t�����E���+�~�~B�a Io�� hR��N�יPF�?�!�jS��h��u �J5��i��#x/��E\w 7Q�"+�*]-l�����܀^m֝T�s)���`Ry�g���]f��o�Sb��c�Dގ�[��8k d:�����{a�-��K�D<7�������:�����D��pk��ϝ�}C����)�b��.��Lѫ�(�$HM�~]�&) �KF@��&f�ҁL%l�2Xs��%_�ɍ����o��Y�xV'/���T�ԉ�"6��?�'T����n �Q��kS���7�S�T%��8A&�_�����(E( )��n� ���;L�������%Dj�?q��v�T�}�H� �h�1��[,��'�\�FD�8��ˆ��vj�7����Dž�d���m�MM�(z��ط��l�}�"��_�ROJ�+*��L���&&UV$�k�Y�r����ω�>i~�T�L�h�a``^�(�U:�j���1�ު�j{��֭g.��r����RtJ�XQ Z��E�i�Jf�m=�{�PdȰЀZ8�3a��(��o�����>l� Gnڦ�ɉ-:.h��-� ��Fx*��6-{ �{���~��A]�����߸c�0�f�f&���Zc��m(��|k>�]��}�g�qo�J�\v�Z&�v�O�d{����lu�����߃ ��j�jl W��6=��M�)nk�L�!�~'���Eӝ�@o�X��� ���(8粜XK-�J���YI���ƻex]x����W�Z=> �A��]�6��b�Y7pCO� rח�ȇ��Ȇ��T7�F����eڜ�{L/S�w����q
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.dd2f97756385994e743a06f37f12bfb0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.dd2f97756385994e743a06f37f12bfb0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.dd2f97756385994e743a06f37f12bfb0.exe
-
Size
1.4MB
-
MD5
dd2f97756385994e743a06f37f12bfb0
-
SHA1
1ffdc513f394f460cdb5a3d15e0db81df7da4915
-
SHA256
388dbf50a89aac7d753a0725097cd9a0ba9ec318a9807c358b13cae3ed7f989a
-
SHA512
a3028c544b92685d881484c7e4b8db35840dacf7be84865f34db3a0df0226fa5af7f3867bb6e97a25e6e4393f8434c8d40371b66cabd4800b88aa285655c459e
-
SSDEEP
24576:qJZNpTVY1Nbexul511DCjtJOvTLnxb+k6t0fDZbR8MWspK/cRgOnmq9g6Ugg30tp:qJZNZ+Je0/DCjDM/NUtIDZOsqcOU7m6J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.dd2f97756385994e743a06f37f12bfb0.exe
Files
-
NEAS.dd2f97756385994e743a06f37f12bfb0.exe.exe windows:5 windows x86
c8851abab27e27b62757d808865d7800
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
GetModuleHandleA
LoadLibraryA
RaiseException
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess
user32
ScrollDC
MessageBoxA
gdi32
InvertRgn
advapi32
SetThreadToken
shell32
ShellExecuteExA
ole32
CreateItemMoniker
comctl32
_TrackMouseEvent
shlwapi
PathRemoveExtensionA
oledlg
ord7
urlmon
URLDownloadToFileA
winmm
PlaySoundA
wininet
InternetSetOptionA
ws2_32
WSAGetLastError
oleacc
AccessibleObjectFromWindow
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
oleaut32
VariantChangeType
VariantChangeTypeEx
Exports
Exports
Sections
Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 499KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 79KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 20KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 442KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: 356KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ