Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1cd51ff0a841732d356c7355514fd520.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.1cd51ff0a841732d356c7355514fd520.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.1cd51ff0a841732d356c7355514fd520.exe
-
Size
1.4MB
-
MD5
1cd51ff0a841732d356c7355514fd520
-
SHA1
33b099e933d83b0922427e14a568a93bb2a13f78
-
SHA256
72c6565f1c6ade8473be597e7b87e4506f2e009451c78cc2c53846ebbfbf139c
-
SHA512
baf1903df5e885b1ea67f17f06ee2c6bbee38874a23455b2d77c22a0dc2d2cb60bb593e7e87c3ea096eba6d1687197261f688cd246f94968cdccbac0c2713531
-
SSDEEP
12288:UxMzHcHKdcAjSigcjSVPgfiTbsMtRtjLO+hubU3gYXb1QChhLNsB2:/DcHKkinOlbsMlPjz3dXhQChtNsB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.1cd51ff0a841732d356c7355514fd520.exe
Files
-
NEAS.1cd51ff0a841732d356c7355514fd520.exe.exe windows:5 windows x86
c73764b97dbbe60c12358a38f9113e85
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
GetLastError
DeviceIoControl
CloseHandle
FormatMessageA
CreateDirectoryA
RemoveDirectoryA
CreateFileA
GetFileAttributesA
GetFileAttributesExA
MoveFileExA
MultiByteToWideChar
WideCharToMultiByte
FindClose
FindFirstFileA
FindNextFileA
SleepEx
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
DecodePointer
msvcr120
getenv
free
malloc
strncmp
strstr
isalpha
fwrite
sprintf
memmove
strrchr
isdigit
_dclass
memset
strchr
_stat32
abort
islower
toupper
tolower
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_invoke_watson
_controlfp_s
_except_handler4_common
_getcwd
_strdup
strspn
strerror
exit
_errno
sscanf
puts
__iob_func
isupper
_unlink
libintl-8
libintl_gettext
Sections
.text Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE