Static task
static1
Behavioral task
behavioral1
Sample
NEAS.7aba4e115c921d7e8d3cb02cce2e9e30.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.7aba4e115c921d7e8d3cb02cce2e9e30.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.7aba4e115c921d7e8d3cb02cce2e9e30.exe
-
Size
878KB
-
MD5
7aba4e115c921d7e8d3cb02cce2e9e30
-
SHA1
6d4522054460c8e24e3f846fb0140ba500a422cc
-
SHA256
55f9e4f1f1bb5b93671fa011d29946e3af68479b451199fda6f0c4b92680d30c
-
SHA512
485384fe0aa853fb564ed2560ec498ac839de858a0f1a88bd6dab09fd9a8f0e49ea621205b7e1d5784a6c20383887b1adb4af8933ed6da7f51fd8d52f6bd31e2
-
SSDEEP
12288:CkVuT2Goommzn+7qBQpFm6HDruX8g5l76CfGKigGf75HjXByrE77ifJ4DQ:CkIT2GNzn++GpF7usg5l7figQ5DXByX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.7aba4e115c921d7e8d3cb02cce2e9e30.exe
Files
-
NEAS.7aba4e115c921d7e8d3cb02cce2e9e30.exe.exe windows:5 windows x86
f37295a71096ccb7f8bd10df4a9c36a8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
CreateToolhelp32Snapshot
GetVersionExA
CloseHandle
GetTempPathA
SetErrorMode
CopyFileA
GetModuleFileNameA
GetProcAddress
GetLastError
ReadFile
Thread32Next
CreateProcessA
Sleep
Thread32First
OpenThread
OpenProcess
WriteFile
ExpandEnvironmentStringsA
GetProcessHeap
HeapFree
GetCurrentProcess
Process32First
GetSystemDirectoryA
Module32First
Process32Next
Module32Next
SetFilePointer
GetTickCount
GetFileAttributesA
CreateMutexA
WaitForSingleObject
TerminateThread
ExitThread
GetExitCodeThread
CreateThread
SetThreadContext
TerminateProcess
DuplicateHandle
GetFileTime
SetFileAttributesA
SetFileTime
HeapAlloc
GetModuleHandleW
ExitProcess
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetStdHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
RtlUnwind
SetHandleCount
GetFileType
RaiseException
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
SetEndOfFile
lstrlenA
GetFileSize
CreateFileA
GetComputerNameA
user32
EnumChildWindows
GetForegroundWindow
SendMessageA
GetWindowRect
GetClassNameA
WaitForInputIdle
advapi32
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptHashData
LookupPrivilegeValueA
GetUserNameA
LookupAccountSidA
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
psapi
GetModuleFileNameExA
Sections
.text Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 729KB - Virtual size: 736KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.EBSS Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ