Static task
static1
Behavioral task
behavioral1
Sample
NEAS.08d81afbb5732f9d6c63d6b4e1fd8820_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.08d81afbb5732f9d6c63d6b4e1fd8820_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.08d81afbb5732f9d6c63d6b4e1fd8820_JC.exe
-
Size
160KB
-
MD5
08d81afbb5732f9d6c63d6b4e1fd8820
-
SHA1
1f5105be68b81a1708dc49172aed1b80f9e4c450
-
SHA256
5620b4520998065bfbf8cb23d1f3fe3d6e9556fa93c575305bc8550418e902cc
-
SHA512
fe3d61e946eba7d8cf830a7c2320fa66f82ce69358df91a3bd01df926e92d9723d740b913d96fef24bc28527628b17ec7d4af363b8e8fce534377f6f1522f011
-
SSDEEP
3072:+kkLc80pJ/jGftRgg4zjKcaSCBJl04wC81ZVfMy/8OrIOyIH9ayy:+kR1i14zuxSulwPn/Unyy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.08d81afbb5732f9d6c63d6b4e1fd8820_JC.exe
Files
-
NEAS.08d81afbb5732f9d6c63d6b4e1fd8820_JC.exe.exe windows:6 windows x86
5a23357764f0c833dcd1a07cf87f8149
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathIsDirectoryA
PathAddBackslashW
SHRegEnumUSKeyW
UrlGetLocationW
StrNCatA
kernel32
GetCurrentProcessId
WriteConsoleW
HeapSize
CreateFileW
SetStdHandle
HeapAlloc
GetProcessHeap
Sleep
GetProcAddress
LoadLibraryA
EnumSystemCodePagesW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
CloseHandle
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapFree
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
WriteFile
GetStdHandle
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
QueryPerformanceCounter
SetEndOfFile
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
mswsock
EnumProtocolsA
EnumProtocolsW
WSARecvEx
AcceptEx
SetServiceA
GetAddressByNameA
rcmd
getnetbyname
rexec
user32
CharUpperA
UserHandleGrantAccess
CreateIconFromResourceEx
mouse_event
DdeSetQualityOfService
wsock32
WSAStartup
WSASetBlockingHook
getprotobynumber
msacm32
acmFilterChooseW
acmFilterEnumA
acmStreamUnprepareHeader
acmStreamConvert
acmFormatTagEnumA
acmDriverAddW
acmDriverOpen
acmFormatEnumW
acmGetVersion
acmMetrics
ole32
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
VariantInit
SysAllocString
Sections
.text Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE