Static task
static1
Behavioral task
behavioral1
Sample
NEAS.27dfd243b319672ea7b292ec03835210.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.27dfd243b319672ea7b292ec03835210.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.27dfd243b319672ea7b292ec03835210.exe
-
Size
212KB
-
MD5
27dfd243b319672ea7b292ec03835210
-
SHA1
64d96ea00d6f8f430f4518e90cdcbc4f0288f61e
-
SHA256
d530cf3eab176b9a63b227f5422a2f9887eb7a7a5fa79dcc289b0445fedccb80
-
SHA512
18f7e2cc862420139eccac74e50f8be2f7af27ee962c7f6b8697f157707e2069d830587b3c4e66cf70d967381fb8b2795195753a0d8a6eb4a304baedb28f9f04
-
SSDEEP
6144:zxDg/KoRRgXGv0thOxecwhAsnJlbq3H0SfG9dhyM:zAPN8HkexhAes0SfuhyM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.27dfd243b319672ea7b292ec03835210.exe
Files
-
NEAS.27dfd243b319672ea7b292ec03835210.exe.exe windows:4 windows x86
384b3529b8abfa67920d1c50c95838b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
CreateBitmapIndirect
GetLogColorSpaceA
GetAspectRatioFilterEx
GdiSetBatchLimit
CreateColorSpaceA
SetEnhMetaFileBits
user32
CreateIconFromResourceEx
advapi32
ReportEventW
BuildExplicitAccessWithNameA
DuplicateTokenEx
GetTokenInformation
MakeSelfRelativeSD
GetSecurityDescriptorDacl
GetTrusteeTypeA
RevertToSelf
RegQueryValueW
RegSetKeySecurity
SetSecurityDescriptorGroup
RegQueryValueExA
RegCreateKeyA
LookupAccountNameA
GetUserNameW
RegSetValueA
LsaQueryTrustedDomainInfoByName
AccessCheckAndAuditAlarmA
LookupPrivilegeNameW
RegSetValueW
LsaClose
LogonUserA
GetAclInformation
ObjectCloseAuditAlarmW
GetExplicitEntriesFromAclA
LookupPrivilegeValueW
GetOldestEventLogRecord
ObjectCloseAuditAlarmA
BuildTrusteeWithSidW
SetSecurityDescriptorDacl
AddAccessAllowedAce
IsTokenRestricted
LsaFreeMemory
FreeSid
LsaQueryTrustedDomainInfo
RegEnumValueW
MapGenericMask
RegCreateKeyExA
RegQueryValueA
GetNumberOfEventLogRecords
RegLoadKeyA
RegOverridePredefKey
SetSecurityDescriptorOwner
RegDeleteKeyW
CopySid
RegOpenKeyExW
LsaQueryInformationPolicy
CloseEventLog
GetFileSecurityW
LookupPrivilegeValueA
GetUserNameA
RegQueryValueExW
DeleteAce
RegCreateKeyExW
EqualSid
SetKernelObjectSecurity
GetKernelObjectSecurity
BuildTrusteeWithSidA
GetLengthSid
RegQueryInfoKeyA
RegNotifyChangeKeyValue
RegQueryInfoKeyW
ObjectDeleteAuditAlarmW
CreateRestrictedToken
RegReplaceKeyW
SetPrivateObjectSecurity
SetNamedSecurityInfoW
AbortSystemShutdownA
DecryptFileW
InitiateSystemShutdownA
ClearEventLogW
RegFlushKey
InitializeSid
PrivilegeCheck
OpenThreadToken
RegDeleteKeyA
RegCloseKey
GetSecurityDescriptorOwner
RegSetValueExA
RegUnLoadKeyW
RegSaveKeyA
GetEffectiveRightsFromAclW
RegCreateKeyW
ReadEventLogA
LookupPrivilegeDisplayNameA
LsaNtStatusToWinError
OpenEventLogW
IsValidSecurityDescriptor
LsaLookupNames
GetSecurityDescriptorControl
SetNamedSecurityInfoA
BuildExplicitAccessWithNameW
OpenBackupEventLogA
RegDeleteValueW
RegRestoreKeyA
GetSidLengthRequired
GetSidIdentifierAuthority
ReportEventA
RegisterEventSourceA
SetEntriesInAclA
GetSidSubAuthority
SetFileSecurityA
RegRestoreKeyW
ReadEventLogW
OpenProcessToken
CreateProcessAsUserW
GetExplicitEntriesFromAclW
comctl32
ImageList_GetImageInfo
ImageList_ReplaceIcon
ord6
ImageList_DragLeave
ImageList_Merge
ImageList_Copy
ImageList_GetIcon
InitCommonControlsEx
comdlg32
ReplaceTextA
ChooseColorA
msvcrt
__setusermatherr
_adjust_fdiv
_wasctime
__p__fmode
__set_app_type
feof
_ismbckata
malloc
_acmdln
_jn
_onexit
puts
__p__commode
kernel32
GetStartupInfoA
GetModuleHandleA
GetTimeZoneInformation
GlobalSize
GetPrivateProfileStructW
GetSystemTimeAsFileTime
GetProfileIntA
FindFirstChangeNotificationA
HeapCompact
GetDiskFreeSpaceA
Sections
.text Size: 52KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ