�/�y���*aCi��T��̿ ����qH�([2h5d&~>�����H�\��_$�|�"�K�e4iޘH�}-�>?���8<U��D��J���<�"d{��яVaL����M�V�v�_̜R�tu�4�$�>:Z�q{k/�*ѷC-/y�~�;�������DK|�Ȼf�ye�{ �/�y0�������40�Mֻ�baO��-�Z|U� �̂�R���ؖG��A9����������I�-���#k����� W�D+QjQH_wu��ڪ�ed{j�Ȟ\����B���7�я�;�����N`�0'A�X~X�&adC�?�T�]��S~a�cGT&#jQ�,\ou�o�P�hv���������ݚ�:?~���aG<��E=�A��@�t���.Pۢ��=c|�����CT�\T S�C��*Ӆ�c'�<��}d�R<��[�N~q�;�l��9Z��!��:�:,�����f�����G��x���["�6pz��Zlw��:A�K�V6jt�*�����R�4z�%�\v}�ҕ��,�*K1?5i�l�M��=GzFd+�H��f� 5 ���ܡ��x����A���I#�gu��BTt���n��w2�(C�ن�ɭN�,V?5_���v�xT2��*�hq���`5ƣZ� �@έ ���+-��K�]�vi]��7�6ٟ��ftd�����l�b���)`Yíɲ����혢�01�S��"�Qy���nN��<Q�������� ��^�R�*S�z}���1���N�a9�;:F+��0?f�5 �`jD�;I�����ufn�w�u*��/�0Ԧ�*A�k����Ck�'K{"h�L1��3'� ���_%=�Q�����/��U�@����j,+G�0%3C�ښ�r����A��NO�&a�V��s䮇���6��C3R���'q��� �`AOk}�ut���PU:H�AQ���ǪW������@G�����@~�ܨ�(�W�#2H-�aB�=j\���j7A����a �)�ʰbМ���I����Q����1���Y`�(6SWt0�w>��}�N@V� JR9����~t-͆\ #ヘ� �aN�+�+�l`1���k�����,Tz����F���f�|!=��c��8I�O� N|#��m��"s���E��w\����� "�aW3:�@�A�� �H!����-�1�C:���;�� q�!�x�ΠXml�P��\ �$�3[�~���������ʔt�G���OЌ��qɇ��X�>��Y�������E���0.�eDZI���������O���}KFD_G��V�����h� �Th��/�mk9��0LwG��1~T�s�g� ka.R=й���]5^;u��%o��̙}\%�娺����<��c��F��" �Z�y���2�3��4���k���f��Y~6�cazwTm\�4�)�O,1H�Z+F���7�+�E����R����;%9�����E�H}�v� ��2Sv��c�p������;��8��*�����Β��ѷ@D�E�|�m#�块6�B�Q,"H?���r�|"�;��~X=7��e�[/�V��R�oد�RǷ��v��/$s�{�^�~e-�v��b�*���D&�8e�Ű����Ԛ§���ނ> ���OuW_����m�l�����ώX����j ��ho����$z�FwR�"/�K�D�����B�\��!���CT$����x� ~pϻ����\O����y�E/��R)��s�9*(܇�T�W�C�p�rq�wvUe#��AljW�� �X[U��G�T�p�S�̻���3��Tw� 7]�e{ 8TC�r�ݧ�Y��&�}�ư����*CI�q)8r$zS���q4��ն��Cj5Ta��֨h������h��3�h�YL�3���^��u!�9���6B���BI��:���g�n3���mU�nq���Bm�LtO(㛿�����A���lf1H���{z���I�|��P��Q{�~m��tM�#@qE��u�'#���9�PϚnb��� .�z�6��a�2 �Rk^V,"z$��Qd����$���×������'vd��G��&���ڡ��Mgʅ��������E[�Y��o��xi�����ͅ'�+:�[a�\�^���r��J-*4����L5 �S/�4A�Ձ���/u�B��I�yw��Ø����u7a]�������{�^����旡{L�5�,d�E�)����)����!�L��c;H6C�F����0Ыj�G �Z5Z�wpw�G�4�N� ��%�#�>�qVj4������8�D����Q'�-��5�x��N�A�����9./�rA���>�a�嗝y�F�(w�dȄ�R3����N��"�n���� >J�������ú�jV��}���ySN���H���%\Ndt��K1F�ײ�:Dk���:�&}��,˳���ݶ- DB��=�d����:R�i��x��x������4�I���Ϸ|bF��D���_)(��9�j���O�+Tt�b�L4��T��`еL[/m��|@^F ]*� ��f]�K�N�,���� �y�)9f�qs ��%�Q��ک��t�=g���^�xQ,������}n�@qQ{����H7��Q�4���B���ͽ0,ƁLx������J�mA]Ŋ�-cϫ15�\���~�#����h����pXY�H��HZ�{�W(�Blt���\�!B��hY�/�)5#Ia��-i�����>����D8_I]!->�*k�ڐ��FON�D\R���D3>B���w������1�(v f�J���C �4�(KU�|�\1� ��`����vT��D�3ߔ)O|�:���1��}|���w`0վc�����������C��L���M��ZQYA������s����N�Sα! t��*�����v~�U��U,��n]t���φ�����!���7�c�<�� ��l�ԫ��4�O������2���)���|����~�&2Y��l!Y洡q6�$@G����ڰ��{#�,#��ZZx��:6 Uf7@�C~�S�k��wUh��*#Zk�?[0�h��0���P
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.ce27fcb47454970a2e0a21193974eea0.exe
Resource
win7-20231023-en
General
-
Target
NEAS.ce27fcb47454970a2e0a21193974eea0.exe
-
Size
5.4MB
-
MD5
ce27fcb47454970a2e0a21193974eea0
-
SHA1
9a7a4fd8c55e286a6748d6b0a3648c5c48b3f666
-
SHA256
befbbfac92bdfd71fa818398cdea8df82cbbada0f4763ff15484423d35796b91
-
SHA512
3b527c5c0aec6a2b67ffc2361a4569742c27f0cb18d58e854f3ed0c494cf1b829ea6291acfae52b243b6dfab5956f06e6ab166635d5326ddc04806a4369f856b
-
SSDEEP
98304:oyt/DGqkm5chPjtlnzmWMdPKmgKkk1c7OadvQQAD567Fmnr+rz8mmU:o8DxkmehPRlKWqPkJ5MEFmIoPU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.ce27fcb47454970a2e0a21193974eea0.exe
Files
-
NEAS.ce27fcb47454970a2e0a21193974eea0.exe.exe windows:6 windows x64
7aecfa684e09b40395483bed9246fcdd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
gethostname
iphlpapi
GetAdaptersAddresses
kernel32
HeapReAlloc
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
TranslateMessage
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptAcquireContextA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 726KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rickm0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rickm1 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 184KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ