Static task
static1
Behavioral task
behavioral1
Sample
NEAS.0585cb1a23adba3d6009bc1315327610.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.0585cb1a23adba3d6009bc1315327610.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.0585cb1a23adba3d6009bc1315327610.exe
-
Size
483KB
-
MD5
0585cb1a23adba3d6009bc1315327610
-
SHA1
2a28e1c7e79ce6f93cd454e5f4406e7555d72c11
-
SHA256
308fffd0d2a345b4673c6b1b760fa7025fe1193ebcab4ac3f0be1df49d6aee8d
-
SHA512
9f47a13023e26aa5214e67c58ec4c9424f968c9ce6c4a7dc91fa156a0a22919aa825872145470c1cf2a81beb8e00150f11634186b82ce28533a4217a982ac681
-
SSDEEP
12288:hvGfla3OXhmmIf397SNq04L5wH4u+/OAbdc:ZmaShmmIFx04L5tu+/rx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.0585cb1a23adba3d6009bc1315327610.exe
Files
-
NEAS.0585cb1a23adba3d6009bc1315327610.exe.exe windows:5 windows x86
05130d884a27bbb9711717bf7c1103ec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextFileW
CloseHandle
GetWindowsDirectoryW
DeleteFileW
LocalFree
GetSystemTime
lstrcpyW
GetVolumeInformationW
ExpandEnvironmentStringsW
CreateProcessW
GetPrivateProfileStringW
GetPrivateProfileIntW
SetFilePointer
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
WaitForSingleObject
OpenProcess
GetVersionExW
TerminateProcess
FileTimeToSystemTime
GetModuleFileNameW
GetShortPathNameA
GetCurrentDirectoryW
GetLongPathNameA
RemoveDirectoryW
GetCurrentProcessId
GetExitCodeProcess
ExitProcess
GetCommandLineW
CreateMutexW
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
lstrcmpW
MultiByteToWideChar
lstrlenW
FlushFileBuffers
OpenMutexW
DisableThreadLibraryCalls
GlobalFree
CreateFileMappingW
lstrcmpiW
lstrcatW
OpenFileMappingW
GetCurrentThreadId
ReleaseMutex
LocalAlloc
FindClose
GetProcAddress
SetLastError
GetLastError
CreateFileW
ReadFile
GetFileAttributesW
CopyFileW
LoadLibraryW
WriteFile
SetFileTime
GetSystemTimeAsFileTime
GetProcessHeap
GetTickCount
GetModuleHandleW
CreateDirectoryW
HeapFree
MoveFileExW
SystemTimeToFileTime
HeapAlloc
FreeLibrary
SetEndOfFile
FindFirstFileW
GetFileSize
HeapReAlloc
LoadLibraryA
WriteConsoleW
SetStdHandle
GetEnvironmentVariableW
SetFilePointerEx
OutputDebugStringW
LoadLibraryExW
LCMapStringW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
Sleep
VirtualProtect
GetModuleHandleExW
GetCommandLineA
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
DeleteCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
RtlUnwind
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapSize
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetFileType
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetConsoleCP
GetConsoleMode
user32
GetDesktopWindow
MessageBoxW
GetWindowThreadProcessId
PostMessageW
GetParent
ExitWindowsEx
EnumWindows
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetNamedSecurityInfoW
AdjustTokenPrivileges
RegEnumValueW
LookupPrivilegeValueW
OpenProcessToken
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
IsValidSid
RegDeleteValueW
LookupAccountNameW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
shell32
CommandLineToArgvW
oleaut32
SysAllocString
SysFreeString
netapi32
NetUserEnum
NetUserGetInfo
NetApiBufferFree
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
shlwapi
PathRemoveFileSpecW
Sections
.text Size: 318KB - Virtual size: 317KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 41KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ