Static task
static1
Behavioral task
behavioral1
Sample
NEAS.349c649f51b7f2b1e20e325ea54be2d0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.349c649f51b7f2b1e20e325ea54be2d0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.349c649f51b7f2b1e20e325ea54be2d0.exe
-
Size
433KB
-
MD5
349c649f51b7f2b1e20e325ea54be2d0
-
SHA1
3802d370bebc98915a0fd65228f893e1b81cf24e
-
SHA256
f37dbc80be4edf914b65dfbd743fb6d9477c245fd633a5d8b7d226d3abacd742
-
SHA512
bfc4c8087ef5a32365586940776737ac1e4258c0881d8cd804ff38686ef6dfb0a71de6816394c2c272632cf8ea82f10d8331452b65c5e213fd17a9fbbee027b1
-
SSDEEP
6144:ChN2GCmHFOJ52hoicPqcKPJRb9t7AU4LXhrzXI6QoGo2azKLQNA9Mn2rqMb:ChNdO3VSbPj7AvLXhvLcyKL2A5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.349c649f51b7f2b1e20e325ea54be2d0.exe
Files
-
NEAS.349c649f51b7f2b1e20e325ea54be2d0.exe.exe windows:6 windows x64
70b31207c5f3387a08aa531b0daae7fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
qt5core
?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z
?realloc@QListData@@QEAAXH@Z
?dispose@QListData@@QEAAXXZ
?dispose@QListData@@SAXPEAUData@1@@Z
?append@QListData@@QEAAPEAPEAXXZ
?isEmpty@QListData@@QEBA_NXZ
?begin@QListData@@QEBAPEAPEAXXZ
?end@QListData@@QEBAPEAPEAXXZ
??0QCoreApplication@@QEAA@AEAHPEAPEADH@Z
??1QCoreApplication@@UEAA@XZ
?arguments@QCoreApplication@@SA?AVQStringList@@XZ
??0QCommandLineOption@@QEAA@AEBVQString@@000@Z
??0QCommandLineOption@@QEAA@AEBV0@@Z
??1QCommandLineOption@@QEAA@XZ
??0QCommandLineParser@@QEAA@XZ
??1QCommandLineParser@@QEAA@XZ
?addOptions@QCommandLineParser@@QEAA_NAEBV?$QList@VQCommandLineOption@@@@@Z
?addHelpOption@QCommandLineParser@@QEAA?AVQCommandLineOption@@XZ
?process@QCommandLineParser@@QEAAXAEBVQStringList@@@Z
?value@QCommandLineParser@@QEBA?AVQString@@AEBV2@@Z
?values@QCommandLineParser@@QEBA?AVQStringList@@AEBVQString@@@Z
?readLine@QIODevice@@QEAA?AVQByteArray@@_J@Z
??0QProcess@@QEAA@PEAVQObject@@@Z
??1QProcess@@UEAA@XZ
?start@QProcess@@QEAAXV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
?setProgram@QProcess@@QEAAXAEBVQString@@@Z
?setArguments@QProcess@@QEAAXAEBVQStringList@@@Z
?setProcessChannelMode@QProcess@@QEAAXW4ProcessChannelMode@1@@Z
?state@QProcess@@QEBA?AW4ProcessState@1@XZ
?waitForReadyRead@QProcess@@UEAA_NH@Z
?waitForFinished@QProcess@@QEAA_NH@Z
?exitCode@QProcess@@QEBAHXZ
??0QRegularExpression@@QEAA@AEBVQString@@V?$QFlags@W4PatternOption@QRegularExpression@@@@@Z
??1QRegularExpression@@QEAA@XZ
?shared_null@QListData@@2UData@1@B
??0QChar@@QEAA@UQLatin1Char@@@Z
??8@YA_NAEBVQString@@AEBVQStringRef@@@Z
?toInt@QStringRef@@QEBAHPEA_NH@Z
?trimmed@QStringRef@@QEBA?AV1@XZ
??1QStringRef@@QEAA@XZ
?fromAscii_helper@QString@@CAPEAU?$QTypedArrayData@G@@PEBDH@Z
?toStdString@QString@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??8QString@@QEBA_NPEBD@Z
??YQString@@QEAAAEAV0@AEBVQByteArray@@@Z
?number@QString@@SA?AV1@HH@Z
?toInt@QString@@QEBAHPEA_NH@Z
?compare@QString@@QEBAHAEBV1@W4CaseSensitivity@Qt@@@Z
?fromUtf8@QString@@SA?AV1@PEBDH@Z
?splitRef@QString@@QEBA?AV?$QVector@VQStringRef@@@@AEBV1@V?$QFlags@W4SplitBehaviorFlags@Qt@@@@W4CaseSensitivity@Qt@@@Z
?append@QString@@QEAAAEAV1@AEBV1@@Z
?startsWith@QString@@QEBA_NAEBV1@W4CaseSensitivity@Qt@@@Z
?midRef@QString@@QEBA?AVQStringRef@@HH@Z
?detach@QListData@@QEAAPEAUData@1@H@Z
?allocate@QArrayData@@SAPEAU1@_K00V?$QFlags@W4AllocationOption@QArrayData@@@@@Z
?deallocate@QArrayData@@SAXPEAU1@_K1@Z
?sharedNull@QArrayData@@SAPEAU1@XZ
?qBadAlloc@@YAXXZ
??1QByteArray@@QEAA@XZ
??0QString@@QEAA@XZ
??0QString@@QEAA@AEBV0@@Z
??1QString@@QEAA@XZ
??4QString@@QEAAAEAV0@AEBV0@@Z
??0QString@@QEAA@$$QEAV0@@Z
??4QString@@QEAAAEAV0@$$QEAV0@@Z
?arg@QString@@QEBA?AV1@HHHVQChar@@@Z
?indexOf@QString@@QEBAHAEBV1@HW4CaseSensitivity@Qt@@@Z
?contains@QString@@QEBA_NAEBVQRegularExpression@@@Z
?left@QString@@QEBA?AV1@H@Z
?mid@QString@@QEBA?AV1@HH@Z
msvcp140
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Thrd_sleep
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
_Query_perf_frequency
_Query_perf_counter
_Xtime_get_ticks
?uncaught_exception@std@@YA_NXZ
vcruntime140
__C_specific_handler
memset
_CxxThrowException
__current_exception
__current_exception_context
memcpy
__std_terminate
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_exit
_crt_atexit
_initialize_onexit_table
exit
__p___argv
__p___argc
_register_thread_local_exe_atexit_callback
_c_exit
_set_app_type
_seh_filter_exe
terminate
_invalid_parameter_noinfo_noreturn
_cexit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
kernel32
QueryPerformanceCounter
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 396KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ