Behavioral task
behavioral1
Sample
NEAS.0a50d4f50a40c0be44f8f8e09f410a40.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.0a50d4f50a40c0be44f8f8e09f410a40.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.0a50d4f50a40c0be44f8f8e09f410a40.exe
-
Size
200KB
-
MD5
0a50d4f50a40c0be44f8f8e09f410a40
-
SHA1
bc1bf6cb5f12f4130347f2ac471c3dcd9f50a14d
-
SHA256
29eda753ff59a15bd8be736d77e6957a48014c839c22611b828c0b005c68bb44
-
SHA512
3c284efd3f32ed9d65892680c16a2cf05014342fd2b2b16da30e14df69599c48ba50de63ce05f4ce0028011df12d4f6ad5b87f6f48e086b30f67edb18b87e02c
-
SSDEEP
3072:IT/puKO8vCwpifA2y5i9Sc2L9hYcdm124GK:mxuWvCFfFyP5L9hYcdS24GK
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.0a50d4f50a40c0be44f8f8e09f410a40.exe
Files
-
NEAS.0a50d4f50a40c0be44f8f8e09f410a40.exe.exe windows:9 windows x86
8303f5479803ca26dba6c094732dcd3d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FormatMessageW
GetCurrentProcess
GetCurrentThreadId
SetEvent
QueryPerformanceCounter
GetModuleFileNameA
SetUnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
VirtualFree
MultiByteToWideChar
GetCurrentProcess
GetModuleHandleW
GetCurrentThreadId
VirtualAlloc
GetModuleHandleA
GetCurrentProcessId
GetModuleHandleA
GetCurrentProcessId
GetCommandLineA
GetProcessHeap
GetCurrentThreadId
FormatMessageW
SetEvent
WaitForSingleObject
SetEvent
MultiByteToWideChar
WaitForSingleObject
GetModuleHandleW
MultiByteToWideChar
GetCurrentThreadId
SetUnhandledExceptionFilter
VirtualFree
GetModuleHandleA
GetCurrentProcessId
GetTickCount
SetEvent
GetModuleHandleW
GetCurrentProcess
GetModuleHandleA
VirtualAlloc
GetCurrentThreadId
GetProcessHeap
MultiByteToWideChar
QueryPerformanceCounter
MultiByteToWideChar
GetCurrentProcess
LocalAlloc
FormatMessageW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcess
GetTickCount
SleepEx
FormatMessageW
GetModuleHandleW
FormatMessageW
GetCommandLineW
VirtualFree
GetTickCount
FormatMessageW
GetACP
SetUnhandledExceptionFilter
FormatMessageW
QueryPerformanceCounter
GetModuleHandleA
GetTickCount
advapi32
OpenThreadToken
RegDeleteKeyW
AdjustTokenPrivileges
RegSetValueExW
SetSecurityDescriptorDacl
InitializeAcl
RegDeleteKeyW
InitializeAcl
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExA
RegOpenKeyExW
RegEnumKeyExW
InitializeAcl
SetSecurityDescriptorDacl
AdjustTokenPrivileges
RegSetValueExA
RegSetValueExW
OpenProcessToken
RegEnumValueW
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges
GetLengthSid
RegQueryValueExW
gdi32
GetStockObject
GetStockObject
GetStockObject
SetTextColor
SetTextColor
GetStockObject
SetTextColor
SetTextColor
SetTextColor
GetStockObject
SetTextColor
GetStockObject
SetTextColor
SetTextColor
GetStockObject
GetStockObject
GetStockObject
GetStockObject
GetStockObject
SetTextColor
SetTextColor
GetStockObject
GetStockObject
SetTextColor
SetTextColor
SetTextColor
SetTextColor
GetStockObject
SetTextColor
SetTextColor
GetStockObject
GetStockObject
GetStockObject
SetTextColor
GetStockObject
shell32
SHChangeNotify
SHGetSpecialFolderPathW
DragFinish
DragQueryFileW
DragFinish
ShellExecuteExW
SHGetSpecialFolderLocation
SHGetDesktopFolder
Shell_NotifyIconW
SHGetDesktopFolder
ExtractIconExW
CommandLineToArgvW
DragFinish
SHGetMalloc
DragAcceptFiles
SHGetFolderPathW
SHGetSpecialFolderLocation
SHGetFolderPathW
DragQueryFileW
DragQueryFileW
DragAcceptFiles
ExtractIconW
SHChangeNotify
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteExW
DragQueryFileW
DragAcceptFiles
DragAcceptFiles
SHChangeNotify
user32
DestroyWindow
SendMessageW
GetSystemMetrics
SendMessageW
ShowWindow
GetMessageW
GetMessageW
GetSystemMetrics
SendMessageW
SendMessageW
LoadIconW
DestroyWindow
GetSystemMetrics
DestroyWindow
SendMessageW
GetSystemMetrics
LoadIconW
ShowWindow
SendMessageW
GetMessageW
LoadIconW
LoadIconW
SendMessageW
GetMessageW
GetSystemMetrics
DestroyWindow
DestroyWindow
LoadIconW
ShowWindow
GetMessageW
GetSystemMetrics
ShowWindow
ShowWindow
GetMessageW
SendMessageW
DestroyWindow
LoadIconW
ShowWindow
ShowWindow
SendMessageW
DestroyWindow
DestroyWindow
DestroyWindow
GetSystemMetrics
ShowWindow
SendMessageW
DestroyWindow
GetMessageW
SendMessageW
SendMessageW
DestroyWindow
LoadIconW
GetMessageW
DestroyWindow
ShowWindow
GetMessageW
Sections
UPX0 Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE