Static task
static1
Behavioral task
behavioral1
Sample
NEAS.556146314fb123fec56f3849735ab050.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.556146314fb123fec56f3849735ab050.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.556146314fb123fec56f3849735ab050.exe
-
Size
4.5MB
-
MD5
556146314fb123fec56f3849735ab050
-
SHA1
5c2f3a04b7fd70ae13b370deeb1316453547875e
-
SHA256
fb4c2b1f99c5b4e55e4cd4724c9036001bfdeabb5d3cd1f3e05e7b745f304db2
-
SHA512
e8da22401c486d1ad17de770d9b3a7545c4889ea5b5de6a48354cce69c6011c90af5a4852346197ce5b4830c8b82d90aff455964d7ecc159c233c8df1d3c07b7
-
SSDEEP
98304:yC5I7ut30H2Li7VFmhOUdZUyEomXrZhz/szAiqylbdbI:ydut30Hci7YOUcyEvXrZhz/2Aiqy/I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.556146314fb123fec56f3849735ab050.exe
Files
-
NEAS.556146314fb123fec56f3849735ab050.exe.exe windows:6 windows x64
46afc61b34fb8e20ac7399f0df86ba31
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharNextA
advapi32
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateInstance
Sections
.text Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.\%\%\%\ Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.\%\%\%\ Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.\%\%\%\ Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 151KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ