Static task
static1
Behavioral task
behavioral1
Sample
NEAS.fe835e9d1c38a5739165394a6465b1d0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.fe835e9d1c38a5739165394a6465b1d0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.fe835e9d1c38a5739165394a6465b1d0.exe
-
Size
408KB
-
MD5
fe835e9d1c38a5739165394a6465b1d0
-
SHA1
5bbc534c765c42c32ee1822f6568c0cb91d63325
-
SHA256
783baf718bac287fd16d75fa7a8c0a3e3992005e457c5bd6e136410c549542bc
-
SHA512
3947d422b937422c638ab6477be15a18f713f07b0f6036a68e20073c3af1d6b2623dffbc2179080ce04c54319d19839cc11089d1a14b8b5b02045f8acbc61635
-
SSDEEP
12288:F5sgEUG9t5XB/NOwJhLaadW6bbB5QY8z4:FKgEVt5XB/NOwJhLaarx5b8s
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.fe835e9d1c38a5739165394a6465b1d0.exe
Files
-
NEAS.fe835e9d1c38a5739165394a6465b1d0.exe.exe windows:6 windows x86
f0f1c78ede68cd359bbee49b2c143e1b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
LockResource
HeapReAlloc
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
CreateDirectoryW
MultiByteToWideChar
GetCommandLineW
FindNextFileW
FindClose
OpenEventW
CreateEventW
GetTickCount64
DeleteFileW
WideCharToMultiByte
GetTickCount
SetEndOfFile
WriteConsoleW
CreateFileW
SetStdHandle
HeapSize
InitializeCriticalSectionEx
HeapFree
FindFirstFileW
SizeofResource
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
ReadConsoleW
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
CloseHandle
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
SetFilePointerEx
GetFileSizeEx
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LocalFree
GetLocaleInfoEx
LCMapStringEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetStringTypeW
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
RaiseException
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
user32
wsprintfW
advapi32
RegOpenKeyExW
RegCreateKeyW
RegQueryValueExW
RegCloseKey
shell32
ShellExecuteW
CommandLineToArgvW
ole32
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
oleaut32
VariantClear
SysAllocString
SysFreeString
urlmon
URLDownloadToFileW
rpcrt4
UuidToStringW
UuidCreate
RpcStringFreeW
winhttp
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpOpen
Sections
.text Size: 295KB - Virtual size: 294KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ