InstallHooks
UninstallHooks
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.edf031c543de2734c0b931d9370f0c90.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.edf031c543de2734c0b931d9370f0c90.dll
Resource
win10v2004-20231023-en
Target
NEAS.edf031c543de2734c0b931d9370f0c90.exe
Size
44KB
MD5
edf031c543de2734c0b931d9370f0c90
SHA1
ab16d2da3c1ba07eee6474a0d628435db4393955
SHA256
4039bcca077a2ef8bb05fad7e991ceed8a0987b9a18fa0171844fdb163c63372
SHA512
43f8110f51c57a98a9ddc02fa3a936f966fc39eff29c119a3eef0af7f4470f1996754043b4e6240d9cc428f4d264b7dab7d335e12b7d1cecfb56e717374ec726
SSDEEP
768:DUDyke4BKBW41+Em6U37wPXNhEAn2tEDjsZl/keX:DUDygBKg4HO7wrZQXf
Checks for missing Authenticode signature.
resource |
---|
NEAS.edf031c543de2734c0b931d9370f0c90.exe |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapReAlloc
GetModuleFileNameW
WriteFile
HeapSize
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
LoadLibraryW
RtlUnwind
GetLastError
SetLastError
Sleep
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetProcAddress
HeapFree
HeapAlloc
RaiseException
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringW
MultiByteToWideChar
IsProcessorFeaturePresent
SetWindowsHookExW
EnumWindows
UnhookWindowsHookEx
CallNextHookEx
GetPropW
SetPropW
GetClientRect
ClientToScreen
OffsetRect
GetUpdateRgn
GetCursor
GetClassNameW
IsWindowVisible
GetWindowRect
PostMessageW
RegisterWindowMessageW
RemovePropW
CreateRectRgn
GetRegionData
DeleteObject
GdiFlush
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
InstallHooks
UninstallHooks
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ