4�Vn��D��3�Q<�F�aߎ���.B��}�r1�q�^��<H�tZ��V�#+dy㪨���M��p���g*a@��G��c%�8�헜UB�m,^�����L��ʼ_�(�(��08a�t�ڢ( �_AŇ�`L�Y�Y�Gi������V���o��睗l'|�%�u��W�"]$�$���,V�a7�^��Ѹ%���<����x�i<�OMN7�(s�xp ��ԡ�ϨU����0 �M).#�_4/\��Gcg��փkn.��5��fk���o:-Ni '�v�[Ɉ\�X�Տ��W�5.K)����B:$ ݉�7�(8ЎΙ�~�4&�(@�8��9nk(i�-��(x2��t�(D��.�c�n���c���T� }�=�������]A��B�C�ʶd����L�{ϡ!d���}��_�7sC������X�&��5[��Y|O8����a/?�3՟l��$~�Iz��=�Ó4^вt�|�z@���Z�}��b`GH`�e�$��ظ���E�р��i�%��'�+���/٬��6��.�\�MI �"��:�ה�ݾ_j�p�3]`y�C�=�"v&��r��&�,�s{rY�� ��q�U�{��.O(@̩9K��kT�� 萂^�O-Ft���i|E������8�d}e���`<��uĂ,�8 vbA�+�çL��u���1��e�_�����#�З���"�S����������x\�U9l&q?�[ ���N*����u0�h���`y ���2����e�\dV܄�6P���rxn�P�K{ �ݝ+��V}Q|��J��sl���4�/�J�����?�% �Hg�2X��s����,i �/�3~/U<E�' ���ؓ�������KAv��i��찑C�T�=Y�'��+���ʍ�e��fH�|�7���u!�M���an�fU��J�G��<2��3ۺ����~8�Z<��Q�W#���(&(.�c�=�=����,���_䖉�w$��=����)Y���E���g�-�K�6��0�#�KFeF_H~�ƌ9�B̹6� -T��^��+=��(�.~��)�7�J�����u�5�Z^���x¸��ӄ'����Q����?��Z�o�����9�A���)��,��*�I�hq�b�z�t����"u���!)e��.VB7L���m����Ǭ�~5 �� �i��j!b!���" �X�i������fO����,H=��Ly{�������i'�6�!�(��A�u�G�槲�����g�, � ᖦ�㪭�]�=0���I2�w�j��� =`����_�=�O��:roI qY/됉E�pFp4 ����.����R�b���.L����TO�xG6E)SG��^_�x��g9e�C��o~�LՇgI��{{"��4����'�����^·���F^/�E�^ƫ��_n��v��^���%�l=I~mS�F-���".�]��"�G��-a���|�Q�tGw�T���+�9��o �����p∦T��A��A���?�� y�ӆ���B�sG=8b�ŭ�+�Z�C�+�d���v�8���.���ة��(qly.��s�\�+� Q�q0�X��P��?$��/w*�4f:,=��Z�x��<�cfk'���ܵ��t��V�����s@��TZЄ˖�_hH[g���`�������f��/p�KhOY���{җ#�����8��i��80ڋ��g�V�����\�A�D�mL?n����� ,��.���N�%Z�7@g Qp��x��l�9���l'L�%%��oHt�O#U{�3�B�g����N��G{h�S@S�~�g� 4j�Ա���O�EeV6���eC`Ct�Fߝq��[=�à����A���|]��%����E1�� %a����1��bPU��X1�O�&��#�Tr���7��ũ�����sX�R�>��g(������ނ#,��Z����,�����b$$�$s����xn6�� �O���|3j�+���l���K���E��w��'Z��Gٓ�)�Qh�,�*S7(�ߠ�n�o��Hw��:ĨI��T��WA���z-���@[W��c��m��l�ѻ��������L��h�l�:��Jq�mt۬�H�&����fW�����M�s�!C/O>�@��̺��_�|�#;$��r���8H]8`��v�o�0�B���r3�rzF�� �i��h�% ��o��D��, 9A�4�.���s[�a�x��!�"z�H����Ν�掸���4��WR<)_*�I*(j���(�R�H�Tʏ���*��r���r�@~|�����>!(ž��5�"���>h�3��6�ǯ��;e����k��iA�\����I$"-�FK�Vfc'�ߖ���7�j��K�ج�,�|�Z�����[��E�Z�*#�B;c|��ƨH*�Fﲵ�6�G��n �Tz���ۇ�\�J#6l�.;-�`��O�,uM���� {?|��'��F*/��71Q~� F���x�M��rLݞJǩ��M|Ѕ�|���ƀ�3����Q; ���Ql�g�^��D� ��i���e�Vꌲ���C-\�������_q����F�x9�=���M w��Ϸ3e��1��G~4:��v����S�N��9��y{K �U�n�9*�##�:<�خf#MQ��2����4S&��� ��*fwhx���A�J��Vj:�AN�b Q��=�sGc,<g��9�� �^�p#���@'���C 饤����Bh,"8A5����E �������D��(�v��E�\�8n�˶�\ԁ��b%��zT��vbA�j��GO�|max֝q�_�v�[@�٢�n��>�^҈����A����_�3�qp��4�Ly��&��$�mU�7�D��3�_s^;�ᮝ=�W}������MJmim9��Q�a���Q��Eh,fDVp�X�&/�w��W��f������J�ĭ� G�kT�5]����Ҍ2#fv)̹��\}�<+���u���眰b���xӽ�S�_���������<>?�"�>i'/ &Q ��#��J
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1018434e4eab22029aab4400958d9eb0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.1018434e4eab22029aab4400958d9eb0.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.1018434e4eab22029aab4400958d9eb0.exe
-
Size
6.6MB
-
MD5
1018434e4eab22029aab4400958d9eb0
-
SHA1
cdf0aa404eabeee1c99ac9937881cfc81d3581d7
-
SHA256
0a386cc9dcc5ba3b8702b3b290034de4b80092c868a65fc7e05dbcd9a089fad4
-
SHA512
285f3acf5e691d785bf094f4cd77ddf238653562f60d4993e60189df80388ff8dac9eefe87fe4bea495766ea0e06e1f4accc33d06e6817510209e42ecaf15f3c
-
SSDEEP
196608:opcfCCLaS4Fud3RhynroD3WffJAYuZ8JP2ZaHwVN:4CCCGSnhhynroLWffybw2x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.1018434e4eab22029aab4400958d9eb0.exe
Files
-
NEAS.1018434e4eab22029aab4400958d9eb0.exe.exe windows:6 windows x64
ace278f8c046060c8fa7df5b795b0305
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
CreateProcessA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowRect
CharUpperBuffW
advapi32
CryptGenRandom
msvcp140
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
imm32
ImmSetCandidateWindow
d3dcompiler_43
D3DCompile
normaliz
IdnToAscii
ws2_32
gethostname
wldap32
ord32
crypt32
PFXImportCertStore
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-runtime-l1-1-0
_errno
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsscanf
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_ctime64
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-math-l1-1-0
__setusermatherr
Exports
Exports
Sections
.text Size: - Virtual size: 732KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 378KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pedrin0 Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.pedrin1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pedrin2 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ