�i�z _y��6N��{z�v��jҦ���Y��YFR&� �Ҳ�����qAm!�<n���ծ+d"��b�@6EK!�^t�}�Yfn��%�Ntb>z#���\����c_����z�J�=T~��h��%���%��f��ѭ��E~�+���{����H�����Ȏ!Ui�d� �'�7�珲K�?r��D�I���Oa\����%���K�k08�^�^Ǹ�։OO21���܃���J�4�DC�� ��,<�4R�Cnḥm��f}Gw�����#�xu X���v�VLZ��zܝ���j�&�l��:�S�|}�*TJ�[γŔ7V�ݗ�ʗ�6&r�����"���m�~�����&J��\CEyJ*#CBV�%!@�T�� o����W�g�}/2�wSSA�C���>LC=��4k� ��9����etY��3m�$��������X��n�w��T��Ήu�[ח]?�n�Q����E�]�+�Ol�mQ�B�7�`�XԼ�5���V���[�^�E/��12��wi�8 �N�mB�u1�#��yG%������ѹ�#�e�����Сv�2Vb�OR��P��&���/��Ęo��0���5�g,�����1%5 �P��C��3j�W��ܘ�O�9 8h������[qM9}���y�z�d�;�2��Wm�*(����[�Ƨ�C���Q�kͿ��D)�ؑ��v�w2�d4���?Ux/]�_�h���O� ,�&F?�rht<��[SNz��-�;Y<(�$@��g�ʼ����c�tZ���j����~�@��fsE���3�oҐ����-7�(�<���3��KG�#�b�b�������=?l-0EHgc�si��WjM���7��5o��Ĵ�+��taA���h���@��$���Y��>��9�¯���4��f����}b^�������N@��w+��d<���7�� /�L�#�_���9ā%$r��H ;��wbYj��%�5�3��<���D<!��"�,/;/nK�]�d���Q �+���rd��riX�z��E�W�<����:�k��N����`�s�?L��ι�f��vw��@Wb��z��x�՝�X��k�ҌfM&�/��.N�=���kD.Ǚ}U4H)��k�3���]8S+�Ӈ�(�y�M� %Vjb ��yT�p��?GY���;B�@r�uHx�*���ͥ����3u+C��1۔�k"-�u��5�n"�嵬��$\��(��B�"�x��G�;����1�������-��Rſ &�0t�ɝ0���N�Itq��J��Xǵ�W^�Q02Sq<���������;�믿;G�R���=Iv%]���u�R�Cv��c�G��ŷ�t���6��#.6��q�A����/-{@�X��}��j�KmtF�0Z��y���Q:��M� ��$,r��K㩍�s��}/"��Y"�m���h.(��?v�\�U/���>���Q��g�:~��j�J������;FRr�{#Y 03��L�c����¾�*~�#�<p�֛���L�VO*Z0OJ�?�[���%@ٸ=g���� j����xI��r��_���4.\�X���,+�}u�YH���2/{�O{��HC]!�����u�t�9R�)w�w�1����8&J���P���߹�d^>����z��G����G�w����� �3�)�� �В�Kt ��c�=���L3�>��$��=:�*��w �&O���(��nߢZ*�M���T��H�Y�?�З���0B�I��f���� JE����p�@mЛC�Y�n�%x V�6PH9��6�'����� ����r��7��sYjո�qx���]a�4��;7��-�֩��I��ʯI�NY�K}EQ-k�R�iM�T���1��TP����s�f���$Q�u F :m������!x�8�JwܲRWiӰ��h����}��1��{tT�]M-Ξ����BtJ�����L6n��ҋ�% �*���Iݎ])x0�$Y���@zKME���`P�v�������EYƠ@;@ou������&<�*(�_-�X� м��Q���{��sϋm_(�\�)m����>Vg| �^�/f-�Bv�D��"��$�),�ur�����jE�[s��1��G��Ҵ��� "��Z��y+�$n�W�:��?�I���^�Z��Uo_9�ƈ�-~~��[���̤�*-%X����kЯ{=z�?*4���#�<u���������ʃ(2O��YC�*�@�m�߁u]��R�����34q��k #���S>I<n�tO�N~����@7�5*;ڭ�2d�"a��%��2kQ�S�|>~:���AZ���ї�jȃGM��x�&'Dd֙�P�d& ]T�e����z2| �Si�f���djr'�u�����WUB���Fw�%�j�dk�o�J\�\'4t�F!!��$m�/O�z�C �Ф��y] [��\�1�&��+��C����`v?�ê:j؎�D2܁%D9!d �:*��KU���$/+!rB�~�P��>��!tA��<Y��Q����2h#N�ĥt�d5�\1�f��֠?�亂���PM�Hw���{��7��B��!��@�BK8:|��6x}<4���'m��&�������:����~�V��v%5L[�r�ҫH ��i�ʷ��p�H�@�)��+f����HHq�β<��~KoV3���3�&��>_��fj��(�奦uF�Ӳ�3��u2�o �b�pW7K$�_�x��F{ݟf���w�3�R�bM�e��Y�!����SfĂN�2����5<��y�X�������4a/��X��f��<�D��x�3�S�<4}�l�G1���1�ۡ�=�%|��BXm�Fަ�����r6X0-���n{E��v��_�W��=AD��/��O,bŖ�� �<44���LE�h����+�t����#v����0(|qg[�.=�6���|�}�f�[\�<�:op>\��bo����]���?����}���H�G�䧫����n���V���F��a"��$� ���f@+w��tx� �#vlā�,�F����!R/��� =�wҌ�s�d�nk�2�^�
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.0704ef9f5b3185a179730d0a01d23550.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.0704ef9f5b3185a179730d0a01d23550.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.0704ef9f5b3185a179730d0a01d23550.exe
-
Size
648KB
-
MD5
0704ef9f5b3185a179730d0a01d23550
-
SHA1
8c7e378346c637f459e130f8328bbec7972bdba6
-
SHA256
352bf4a80e01d7962b805e469d70bbd5776392f7c344d5b4e2c77e129a2dc418
-
SHA512
416b603964736c3215d0950b393f8521bd6b14c21d5f614a7c80576cc944ac538c869f02c7fa7e0ca5926a6748475564c6e823c23e2b75470d4c28c18d43c180
-
SSDEEP
12288:610NInCgUnWJNVfFceEX80zwjM8qX/sXH7yXWyGwkeX3+JQIz0Q:6iwN4KNCd5VwH7yNL+JX4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.0704ef9f5b3185a179730d0a01d23550.exe
Files
-
NEAS.0704ef9f5b3185a179730d0a01d23550.exe.exe windows:5 windows x86
927957398548ab3914dbe3897e8c7348
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord612
kernel32
RaiseException
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
Exports
Exports
Sections
.text Size: - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text0 Size: - Virtual size: 540KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text1 Size: 636KB - Virtual size: 633KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ