EEGetModuleInterop
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.007dabad97fefa0a7b4764ff504b0690.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.007dabad97fefa0a7b4764ff504b0690.dll
Resource
win10v2004-20231023-en
General
-
Target
NEAS.007dabad97fefa0a7b4764ff504b0690.exe
-
Size
209KB
-
MD5
007dabad97fefa0a7b4764ff504b0690
-
SHA1
57181c473267716b8169f904c9e72ca9867d3636
-
SHA256
1b72e3e655af54a063fb5dbb918ea57d03fc9c21016bc5ba3149a0db04bcd947
-
SHA512
95d9e04c7ad4cd583977b446d5e6ddcbca4dd4ed8ad6ced90d579914dc7ccfd2c88d7112a9f41b8287da784fc4c46420bd91473a4623b410c7c5cd97b23daecb
-
SSDEEP
6144:U/TBIJyrwflI4ESv+1EJb6nI7TYn0FOJR9:U/1Iaw9IFSZ6/08Jb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.007dabad97fefa0a7b4764ff504b0690.exe
Files
-
NEAS.007dabad97fefa0a7b4764ff504b0690.exe.dll windows:4 windows x86
ebe45b25e58b4afb9a31d0a95651f3e0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
xprt5
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
?IsOpen@TFile@XPRT@@QBE_NXZ
??1TFile@XPRT@@UAE@XZ
??0TFile@XPRT@@QAE@XZ
_XprtMemRealloc@8
xprt_iswdigit
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?Replace@TBstr@XPRT@@QAEHPBG0@Z
xprt_strlen
_XprtInitialize@8
_XprtUninitialize@0
?Unlock@TSpinLock@XPRT@@QAEXXZ
?Lock@TSpinLock@XPRT@@QAEXXZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
deflateInit2_
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
xprt_memset
_XprtGetMilliseconds@0
_XprtDestroyThread@8
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
_XprtMemAlloc@4
?Init@TFileInfo@XPRT@@IAEXPBGI_JABVTTime@2@22@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
_XprtMemFree@4
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
?GetInfo@TFile@XPRT@@SA_NPBGAAVTFileInfo@2@@Z
?SetLastWriteTime@TFile@XPRT@@SA_NPBGABVTTime@2@@Z
?CreatePath@TFile@XPRT@@SA_NPBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?Set@TTime@XPRT@@QAEXHHHHHH@Z
inflateInit2_
unzGoToFilePos
unzClose
unzGetGlobalInfo
unzCloseCurrentFile
unzOpen2
xprt_memmove
xprt_strcmp
_XprtAtomicIncrement@4
?Detach@TBstr@XPRT@@QAEPAGXZ
_XprtFreeString@4
deflate
??0TBstr@XPRT@@QAE@PBDPBG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
kSystemEncoding
?AddTrailingSeparator@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?FileNameFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
??0TFileFinder@XPRT@@QAE@XZ
??1TFileFinder@XPRT@@UAE@XZ
?Find@TFileFinder@XPRT@@QAE_NPBGI@Z
?FindNext@TFileFinder@XPRT@@QAE_NI@Z
?GetFileSpec@TFileFinder@XPRT@@QBE?AVTBstr@2@XZ
?GetYear@TTime@XPRT@@QBEHXZ
?GetMonth@TTime@XPRT@@QBEHXZ
?GetDay@TTime@XPRT@@QBEHXZ
?GetHour@TTime@XPRT@@QBEHXZ
?GetMinute@TTime@XPRT@@QBEHXZ
?GetSecond@TTime@XPRT@@QBEHXZ
?GetTm@TTime@XPRT@@QBE_NPAUtm@@@Z
?GetTickCount@TTime@XPRT@@SA?AV12@XZ
deflateEnd
unzOpenCurrentFile3
unzGoToNextFile
xprt_iswalnum
_XprtHashString@4
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
_XprtCompareString@8
_XprtCreateThread@8
_XprtAllocString@4
unzGetCurrentFileInfo
inflateEnd
unzGetFilePos
inflate
kUtf8Encoding
??0TBstr@XPRT@@QAE@PBG@Z
??0TBstr@XPRT@@QAE@GH@Z
??0TBstr@XPRT@@QAE@XZ
??1TBstr@XPRT@@QAE@XZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?IsEmpty@TBstr@XPRT@@QBE_NXZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
crc32
xprt_memcpy
unzReadCurrentFile
kernel32
ExitProcess
SetLastError
GetLastError
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
InterlockedExchange
CompareStringA
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
CloseHandle
FreeLibrary
DisableThreadLibraryCalls
user32
MsgWaitForMultipleObjects
KillTimer
SetTimer
TranslateMessage
msvcrt
_initterm
??2@YAPAXI@Z
free
malloc
strcmp
qsort
_snwprintf
_purecall
memcpy
_except_handler3
strlen
fopen
fread
fwrite
ftell
fseek
fclose
__dllonexit
_adjust_fdiv
??3@YAXPAX@Z
_onexit
ole32
CoCreateInstance
CoUninitialize
CoRegisterMessageFilter
CreateBindCtx
CoInitializeEx
oleaut32
VariantClear
VariantCopy
VariantTimeToSystemTime
SysAllocString
VariantChangeType
VariantInit
SystemTimeToVariantTime
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
SafeArrayDestroy
SafeArrayCopy
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayRedim
Exports
Exports
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 936B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE