ݱy��m{a�C�, ���5#�qc�6_u{θZ�:��y�����h�'Q�]k��O�&� 7��_8i��H�y��Z7��?��]�8�_�{���K����<�����`u��0ɾ�ޅ����B�V_g���(UK�wQ�m�#<�i����0/����� ޖ�G�8�k�/H��:-p��Ըl��x�N������`�9A$�^�˩*�������������䳛*i����B>Gg7D� I�� �4�2�w��Ddr�[U)8����c&�S��K��I���r L�B"E��U��F�����{@�#ʹz��z��wZ����H� �G�!mDRh�!pm7�7�@�������j"$�sM̥�7��'����/[C��FaD���iS���Bfq�d���L-H�&��>X�V=y�l�n^���d�aRU�q����B����5>�* �<B��j�e�p��!{��"���a�y�xҔ��_b��{7���kMQƤ�o�\�7�bxt���Z�2h�Aj�T���!�#��5 1�(|{�h���:w�WG�w�ۈ<�i�vkJd�"���Qn��Y�|��Ƃe ��y洩4�p��w'�(/ �_���`6���0;o7�>���0��E���Ϭ��j�#a�V�C�LϢ[i�G��R_��ttT�y�FD���W] �Yu. ��?���0�Sc�79J�����v�3���'`2 �Xk_�Sꖮ ij���o���M�Nw���CL>��j8�k��\-R��k���� ����K�|�[�����:2o���z>K�H���kR�F ���e��) �n���4�=W�+aQ�KO�����14Pʝ��[ѕQ��Z��#�d�]���ypے���Z� ��5�����QO`0#Z3buauBե���]�o�1��T������U s�������i.%�iFD�2����p�'(H9Yq4yTS�f��ڨ}�<�KܿO3�W�K9g*��gE��ߵ�k�����BQ���J�h����;�);3�����WǦ�H��d�T���CY��?�9� X|���+�Rt"�nŀB������'��z]���C���p3��~Ͼ��}�1+�� Y;�l~���ʊz"~��,����� 8�t8�t�𥓍������a����������'�)X�ƣ��4�V˜VF~3�>�t{+��,�8��vu�pq��\� 5��%8R��^x�$^�u ���]��f�a|����a�c��%��W��`э,���c��M��fa��JP0l[{��kE�8����LJf�HB�$dP����%�C��U��ؗ�oj�R���k��"�g��w����� �_�/�G��p8��.�Ï*|�ݬ�zG��i����� ��U)�lM~m9��;#�9kV1��h�b�)�k&6�B1eԔQF(��#�]j'�K�����˼:4\>iZ�&,������F�֢J�d�/�$C<J z�_���2ߪ9�{�!�42���N�/�gAx9����������ig p�;#,|�F-����� ���� �F���-qy���<ǒPX�-�X}?a���� g��{���{�vy[2����#�����i���Չ+��E�t@'�+���O�Ҕ����kN ������#ϊVތ��ebn쪽DqX\�e(l�-�����ҕ�]�G�Vqֶ���y.�4Z�����ҹ �M/���H��� ~���6 {�/��M>����þL�݁��ԫ�5K�y��M�d�}�S���E*�tvɠ/��`�U��:�]����,#�[ u�#:���c� ů��9Xqհ\4w+���~� ����H��Q��M�����v@��3�"���?��O�)����y���W!)�`U��EB���ğE��,�ޤ�/�5������w�Iz���u�c�5��TE{��H�y��[�>v�S�l|�O�z�e�7��\Tvv@��X�x3�����yA�:*3�?�5h�' ��j�����-�8�Eu[X��ʜ��>%�i� �TT���'Cd����������^�����~�����?��sp�r�/?���� T:��X�x侺#���=ۦg����OH& �Dϑ�>�]���tbk�5�K���2�U"�[UL`l�����X��'��ń�$�g��`� F0c�!n���ԯS0i¯YէA�DĿf�N��DSq��Lw!�,�(��@�p�����c����{z-6oS�!}�3�۰�m�om^/:���{���eJ�=����Ġ�����<����%����_K)65�{|R��O���[�w��W�,2@�Wnm_�k~���/"(uc�a8�@~����|^g!��`RS�7�ĂL�dz�q<C �@��ZD�$��#H���ak�i+(����~1>��?g�Q�U~�2B�^9�+��� c����{b8�R���Q�|�0 ��;������JD*�{g�M�G#X�k9���(��j4%�?A��\��"�\qH3����_"e����0@c��t��˘���!$}?qсF�hF{gj�����J�i������zo���SE��CT�c�@QIx����w�i"'��G�����}k�vy,�Ƶ��a���@t�t�sݔܯd�x'v��Mӗ��l���+����s�����Z�Hr0)�+gQn��s��5?�O 8����w� ���Rti��ѡ?�>D�r�P0)� �!1C�Cex���mȆ��-I o�a�h�%{KmU}����O$�Om:�N�Ƽ?'�N'���:h�T�Cq&j�ޅ_W�bAKN�"e�UKԨލ��<����J��$cˀ��M[��{J��̩��W��JBF���Ws�~����y#0%�gâ�2+/��B?xN�,a���;���b���c�� z̶��L$�t�r��P��D��F ;���%�/HV&>r�K�g�$��Ah�1�ʡ���:5DBC�1�B�q�Xהu��k�������2��B�����2D� �:w�hg�Y2�M�oYU�[�dV�&�s�a����PY��^��Z���I�_�ʻIe��|I�ClE�Ͷ���h���m � ����Ȇ����S4vt�B��&���^�~�r���%�ю�n��As��0�9v}�Υϟ�xS�-��.�I�X�U�e��S�}��(}\3OB;��B#+�xE�:질944H���eWݟ�V>U�\��n4��7�a���aX����l��'Sr���� �UA�u�F��� �|�ګ��־����Cu?��E���LJ��Pε��*[������^^t����Ġ>�vW�6FV��(�V�����yHnA���I+�"�>�mC�����Z���*XZ��gF��6��l s2�A��2c)cRt�� GI*OvFF����;��m���i�ڬ�7.#@�5! �u�*7ug#�Y7��)x�Pn�v�\���E��$R�k������r�G挨�akw�' �(��;R�)��=WPIj�GԷ7�k:U� f���8i�~n� �*�!=م_�@�[��:�m��.�0jCk� ����[+&K �c��?��w�z���c/ƛ���<l?�z��~#�0����4O�X^�Q�߷����i a��0�L2WU��P���2�$A����-�"���|X
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1510c1ee9ba1651e494ceff25cbbab90.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.1510c1ee9ba1651e494ceff25cbbab90.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.1510c1ee9ba1651e494ceff25cbbab90.exe
-
Size
5.6MB
-
MD5
1510c1ee9ba1651e494ceff25cbbab90
-
SHA1
d8299091db25b45c767a76a4b3eed7fd012cb92b
-
SHA256
7837d5566c07f6e01cd0c6aad078fd97e5534321f7edfbba06cdb2f2b20cb46e
-
SHA512
88487dfc575832fc26dffcd09cfd84a83a59a3b751f030019171d46ad6bb449a50bcf6dbcea42246c2a3309db6ca8581b7fa696e997a2c719f33b2bd21dabf0e
-
SSDEEP
98304:siBhpckl9pXCD7MmMUXHEgSmEXsfWq+cW6j50CeZkAM7WF5lKolm3D:VBLcU7iAm8gSmmsfP+xgGxMs5lK6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.1510c1ee9ba1651e494ceff25cbbab90.exe
Files
-
NEAS.1510c1ee9ba1651e494ceff25cbbab90.exe.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 392KB - Virtual size: 808KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 80KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.3MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 505KB - Virtual size: 508KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 298KB - Virtual size: 12.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE