L���}�-�ܓ���?��%���m*?Mh�7��79���pe��킥4�|[�����Z� �s�0�L�ݍ����O1�}��T�MO)�b�W��S\H.��]H5��yўD�����Z�FV�%��q���������`�TDO��a��L�|7Z��)�.#��m�Q��� Q�)rсR�C7\]l��u��;��Y0�E~��ѓF��0b}����O�꺧/��y�-6� (u�:���OW>�X����u��-����>�b{�GU0� Kmq�4.���?e � y��FP =�?dX�)��}F*Q����˄�����zme����LK;�J1D_T�S����5����� A:YNw�0 i"W}ɽ��Q� sL�LzG�����?��Y��L�d�#������\2�k;�`�{p����<�ș�#�aN�@����y��W�'�)���7RC�FhG�$��5��x+�ɀ���y�&`��/k-�ѝ�2�<�>����NO Eo��� ��� L�E��)�4\Z�x�?qi�?������3�u���v>���Oݑ�$3��k��CA�`����%�LT�ٴ�����L���_5y���4悛Hb�)�aB7��}��8�����Iw\]�`ur�A��Y�ݏL�C��O;%o�������(�Lp(��2�L��o�������.���I"�M���:/7��p�)��ۗ�/rA��n7m��v!x�S7amˉ] ��w�e��0r��ܣb�Jre�l~`!������E�gB+�W�K�9B��������\��IF�Q!�2d��yV������n�@ ���?U�I���^w[a�BNz�:��]Wn�GN�eo� �#f�K~>���m���&1M����Z�,�! B��$(v�)��ÐB�"k�ړ�����*y�|^c߰�� �N�MT����W\+T>v]�$����فxt �g�DFO�,�9�~� )$�$�Z^��r� M'5�>����uX(m銹�:<�g:���v�.;�.�ia�FP�M��SN[HQk�aC����Qd��tk�\ЙܽUo:)�K�K�ޟ��"E!��h�����2��4�q��#��SpR���KW�����5����U�j�\��4kKrb��]Uέ-6�x> �/� �`IR�����k32�%ȯz {�J����o�A��6 ���{=J(ǧ����ERW�<�3�C7�j �0���x}�RӐ�"�^�>�2?��K�n}����S �K]��ɝ�6b1���<z}�D���-}�ޞR#�0�P1��Zv�L]-Ķ��\���F�!4�}ʪZ�?{�̏l~ʭ{���Y�;QX}�c'M��X�!�JUUr\VT��{�����\Ua"�����%�����x�C�]� ����w�V���gZѰ�l �q �������������AK+!��54���br������6�$�����6Hꄷ+�I3���k��CƔz�4FD�p�v)��a�Iz��NA���^�x���aq.����M2��U^�@2�TSnk�'@�c�(���~3�Y~� �V�&���_ⶊ�>Y/!|�&�ȫ�Vg���)H��J$)�5���&9�!�>����~�rl(��h9l��}1W�ϿWp}�2�n>I<��������OF�����Ť�A��ŗΑ��E\�4C���H;\Y����wh.n�:�����G�`o�l҃��RR�.�Mgu��M2�t��f9�7�#�e �F���ZB�q9�lxj&pTnR�ZC����'��p3\K:|�w!w�ք�A��J�P���ݻ�r�`j�_.J�b϶�w�e(�&nӗ6��a�%���1h,��b����'_���yj�������XBJ&���Q�L/l�E҈M����:(�Ő���e0�@oX(���k����v#^�ki�������o�.dk6z.�����O@}ëh��'{�(��{a�?5n��}:������iʿF�p�˻Z2� �g9�* ���X��{�-�q�n\�V.wI7�{!vL��������r�N�l��@�q's�������SXm��[��uSJ?�Y#�L��a���G�"9�$�1�Z|Hg}�F��ˇ�S�&~mEnTgテ�1eF��_9R��˺�����ߓ�����N�p�r���8��S��JUVR���`��M��ic��� ��6�C�j-��n ��Ah�jC���8탄� ��`H�)_�Ͷ�� -�n�P�����zN��b���� r/խ٦�!�I(�K����%���0w&��# �cy{�ude:���!@#D.��N4�dY�P�l�Jo�)���]-f� �#����0M��U�D3�x1�:�� 5ʤN�ߌq^�-ȸwN�*�@q�Z���!���i�(�O�>���b�(�*�g���O�OO�s܍\!��r�e�?\4Ϸb�V�<�b�ɛ��l1yR�Z��'s�.�����!���e��X����k���6��|�l��Rz@��e����e��&8̣��]���4�U���w�HK�0����]k��l�4\��O����^̈��I��z�_����;4ʟ=�u4Ԩ�j�aZ��>��-�dy2:�g�l7bTeu�<�QcC�+#F͔�����Et�6V��1Y�8�2��8�͂�}^9��_�}l����1/ ����V)����it��G�|m�o;A�<��XH�'F^g1�������� 0�F�Η�����0T�f3��.�n{��3$�t����<:Gq��va�B�M������Xi�b�R�,��8^v��;:XZf�?�"q�H�� �(A��-���+N���M�<�obF՛XR�w/ ah�;s�?D���u����Mn:&�Ŝp�ax �G��ڶI�F> ���"WQhd�/���L����2t��X���{&�{��F�r�T0�^�i�����U��5ݾi���;�R�M���� tƠHb�R�.���§��'w\�X[sI��'�y���SSS'>_{�K�WiL�2/M}2c��.�YGB{2��7#��<%�*��|oDd�q�����X��0@��p� ����Lh��
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.bb4a9ca6e8a368edfc6888a39624da90.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.bb4a9ca6e8a368edfc6888a39624da90.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.bb4a9ca6e8a368edfc6888a39624da90.exe
-
Size
8.3MB
-
MD5
bb4a9ca6e8a368edfc6888a39624da90
-
SHA1
7b330dd0f7e1097c08249a204ddef0a136678db1
-
SHA256
12465514f763a0ddbc7d8836bb4a9fec30af71a701738120bb256f5112ca5022
-
SHA512
2e32d21919e9e7cb63d64c6a0d806a3ba05f497d0e02e3f5a60b1df1c3610e8aa89226f266d7cfb3801cf6db98e77250495bdb03fd0d6f05d6ce74dde693f642
-
SSDEEP
196608:P8XKMMv9ISF8ANzq50SrW3+Lf+jrC2F5ZMjmlm96qp7a54SZktm/9G:cKMySSeozqXEGf+PT5KihofSym/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.bb4a9ca6e8a368edfc6888a39624da90.exe
Files
-
NEAS.bb4a9ca6e8a368edfc6888a39624da90.exe.exe windows:6 windows x64
8ba18325f622bd3b98b73ec804421e19
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetEnvironmentVariableA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DefWindowProcA
CharUpperBuffW
ole32
CoInitialize
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
imm32
ImmSetCompositionWindow
dwmapi
DwmExtendFrameIntoClientArea
ntdll
NtSuspendProcess
normaliz
IdnToAscii
wldap32
ord46
crypt32
CryptStringToBinaryA
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
terminate
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
roundf
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlink
advapi32
ConvertSidToStringSidA
Exports
Exports
Sections
EXIT-ON- Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
EXIT-ON- Size: - Virtual size: 315KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EXIT-ON- Size: - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
EXIT-ON- Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EXIT-ON- Size: - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
EXIT-ON- Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
EXIT-ON- Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
EXIT-ON- Size: 512B - Virtual size: 224B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
EXIT-ON- Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ