Static task
static1
Behavioral task
behavioral1
Sample
NEAS.88d761ad99798c5c8ce96087ee127e70.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.88d761ad99798c5c8ce96087ee127e70.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.88d761ad99798c5c8ce96087ee127e70.exe
-
Size
646KB
-
MD5
88d761ad99798c5c8ce96087ee127e70
-
SHA1
21bb56e234981c18e7b64e45c572f70af95abce0
-
SHA256
bd6220ae683e764f9f30a9eaea32823961685d997e6147459acc7efb0bace860
-
SHA512
bd3ff8898693133679edb50c31f05a44473f646167a25916a7a944c6d1f6b210856ad397e1b360a1ab6500a7201200f29aa2083592e491718d7828a3fdeb8f63
-
SSDEEP
12288:cjUxfLPRLSeqtp0WlYRFOOdUY4S3djfV+lm6CqX2sGkPwX7hC:0cRSeqtpc3OaUYfjd+lm6CqXJw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.88d761ad99798c5c8ce96087ee127e70.exe
Files
-
NEAS.88d761ad99798c5c8ce96087ee127e70.exe.exe windows:5 windows x86
2f8f5c6b0e9026643d23cc0c4364965e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winscard
g_rgSCardT0Pci
SCardTransmit
SCardControl
SCardGetStatusChangeW
SCardReleaseContext
SCardEstablishContext
SCardCancel
SCardFreeMemory
SCardListReadersW
g_rgSCardT1Pci
g_rgSCardRawPci
SCardEndTransaction
SCardBeginTransaction
SCardStatusW
SCardConnectW
SCardDisconnect
kernel32
CreateFileW
SetEndOfFile
InterlockedCompareExchange
GetLocalTime
FormatMessageW
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
GetTimeZoneInformation
GetConsoleOutputCP
WriteConsoleA
SetLastError
FlushInstructionCache
GetCurrentProcess
Sleep
GetCurrentThreadId
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
EnterCriticalSection
LeaveCriticalSection
CreateEventW
LocalFree
CloseHandle
SetEvent
WaitForSingleObject
TerminateThread
ResumeThread
LocalReAlloc
LocalAlloc
GetLastError
GetProcAddress
GetModuleHandleW
GetThreadLocale
WideCharToMultiByte
SetStdHandle
LCMapStringA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
GetStringTypeA
GetDateFormatA
GetTimeFormatA
GetLocaleInfoA
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
InterlockedExchange
FreeLibrary
VirtualQuery
InitializeCriticalSectionAndSpinCount
LCMapStringW
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
HeapCreate
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
LoadLibraryW
SetConsoleCtrlHandler
ExitProcess
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetCurrentProcessId
RaiseException
OpenEventA
OutputDebugStringA
OutputDebugStringW
MultiByteToWideChar
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
VirtualAlloc
LoadLibraryA
IsProcessorFeaturePresent
ReadFile
UnmapViewOfFile
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GetCurrentThread
OpenFileMappingA
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
RtlUnwind
GetStartupInfoW
HeapValidate
IsBadReadPtr
CreateThread
ExitThread
GetModuleFileNameA
FatalAppExitA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DebugBreak
GetStdHandle
WriteFile
WriteConsoleW
GetFileType
user32
RegisterClassExW
LoadCursorW
GetClassInfoExW
CreateWindowExW
CallWindowProcW
DestroyWindow
DefWindowProcW
PostMessageW
GetWindowThreadProcessId
SetWindowLongW
DialogBoxParamW
GetActiveWindow
MessageBoxW
GetParent
GetWindow
GetWindowRect
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
GetDlgItem
SetDlgItemTextW
SendDlgItemMessageW
GetWindowTextLengthW
GetWindowTextW
SetFocus
SendMessageW
IsWindow
EndDialog
UpdateWindow
MsgWaitForMultipleObjects
PeekMessageA
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
UnregisterClassA
oleaut32
SysFreeString
advapi32
RevertToSelf
OpenThreadToken
SetThreadToken
ole32
CoRevokeClassObject
CoRegisterClassObject
CoMarshalInterface
CoReleaseMarshalData
CoUnmarshalInterface
CreateStreamOnHGlobal
Sections
.textbss Size: - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ