���Q��W^R�&����#��~-�����żsT�'��\�b[s� _��+�+�ԗJ�+4��o � L�\��*�X��K$V�[#+�0�y�k���3��=�\DҟY膵��r�o�k �&�h��ѯ�s���)�K��r�3����v��V�ڒ`����/E�NJ���&���[C�U$��'c T�_������ ���|C׃jnEM,1��9��N%�f烓��e f]{�@��)���$T�u<�%b�*I�sD�jYM�� �8����9ei����8d���Mz�=�k]9�3E`]w@3�C�S��q��S�F��O��fu����ͼ�d%������?�)����i�P�9\�6�_`�F/����k7��Q E����,d�Ɏ�S3lKO|uhy��0D�%�҆^c�I�ަ�Ӄ�ɺ��X�SJ�l��j������r��ov��a<�Y٩����$n����f�hE���p״J�p��u�{yE0i_Z�%����pc�z+�*vO���$��r�U'EZW��P�m� ��#/�p��=���ϐ���-�$]E�f%�� Yi`1���e�E`ey|7E�p����e# ��;���d)U]E�O���7�ާc�\��x��G�F{�[���zG7�P�P�]q�ꌭ�)r�����G�g�,���]j��0�f@"�w̕�Lu�(�Q�^eI5+���H�2yx�J�X�Ź�; ����S��$��$��*�Z3�\���%��z<�H#{,}��t��p�$��S�&����A��T]h@�,��|�fɚ=�0��.�e���E�N�F�����KA�j��K���3d%�p$��%�xoMl�%�@M/'S�wyq��4.�"]M�"#k�ҽ�ې��V5<�P�&�4b�����yV�4aU��� �̼�kKC�A�dQ�ש��MV@d��!lD6�K8<k`j~�z�� ���_��3G��=�|��p��F?�A7�� &�;���6�Q�p�,�����:��+�o��Oi�m�eQ/���3�@��1���E)���rQ�*���v>.��H:��>�M�UPP���0��XUkH����~w舐&Ƣ���w�D2��!�TDN��/R�+Ьf�p���@��kt�b����$133���p���q��mຼ��:sU%B�8.Z��,�Z{��),�"jl���� �F�R�F&�1��W�ka���o�Sj�ݧ)��,r ������a�1}0 ��v��X�/������j$^RG�F]:y4����~K6T��b�B�Ndc��Ϩ����z����Q �w�0u���%��c�œ�\�E�p��E����dk�P�����T< ��T��*ad�}_��ž]NԲObi�����|��Wӣ07eF�9f��;�ݣ-�+�A�J@��)S�6f�����ad���Єjf�v�Y�:���D��z���J}�̃��m�9���e�6{�D8���9H#/Jm��� 1t��g&�#��H~��E�Z���]���n�H���H��@�|>�Z����J�0�r����B�b����T�D�Z3��x~� �%�9;9��TW$= \e��<ɥ̈2�A$�ܰ�uy���bw�4/�_<&���_���'v]�XS;���UQ���^r⤈�o�r�kDwE@���z��n�Yz� 0�[�Z;���E��\�M��>�����M��w�����aB "�2��E���~�w�a�{�n�u�M��O/�؟]#:-��j��.�X�Q�o��mΘ2�R�����@��變�-f�{�1��S�FL�1%A��x" ���#��w��Z3���`�V5� n3'��ލ[�f%�R�R]'�c�/�V��}���c�ú��||`�J��v9_��d� R� ����� DS�{[3��V�d=�a�ON��J^�ʯ�cCE���v�&8yz���9<R�=`[,J���pcQ�z"Jak��^��<��0TW-&�b�˖��r7�5���Zx?��df����n���.������:�@g��f�q�>��A���N^\U!�*�nӚ���t]g1C���I�́����.��M�q�o���Aȏ��Թw�����+-���*���0n�p*��Y"1��DA���7�-��-X��{z���O�l���� ��"�����d�o�1�L���5S���أp�d��u���_�*��3����7��_���ټfƥ���>�i�����1. b���f�B��̑Kmpj<ßkPʐQ�}��� �K��8���fPI��S}+����hoz�>z!i�����9����UQ<�I%Dz��XQ����)��Wy��z�BT@?[ �*������r��H.U���ҷ��p�+i4���RȎ(5�徣*_�����/X8��#'6S�zzo��@`��Ŗ�Q�ь4G��fjl�b@�.]|�I�όn}��}�H�<{xй$��t�'a�P��@2���4���]?�`�r^��"���\-�f���6� �\B���� �1�S�Xe�?}%> sگ|$s��Mg�I�w�pdL�@G�9�����͐��o��S����F������Ԧ��S \DyHRe��p馔��OLi#>Tt#2���Y�{ ������d��iY���u�|Ï����ZbkO�1�620�ѻ��h*�(4Hu;�{�]����~oIuB��s�Ϣ�;����J�'� �?-Vo1�5P���́l�"XN�)c����*�O����K0�4}5M�$$�n3U�\��SÍ�Z %��V�-�55��x�PE�R]e]bk�F�ş6�ƍ��7"�$}����M�\����bK��tEp�щ�ʆ&K��X�w�0���/p_%��Y2JJ�.S����@M�C�:l<����P�RZ�������[�8f�t(L�vnh����H/|������K \ιy<���O��wg��2VIJ�2���bn��?� �}��yY�C�븃�J�T�mb��v# �������i�G(P� '�NA-��y �9�ռ= ���t��#�'6��g/N u&1�5����F��u~��0s���+�x� ?�X�~ϼ��c��ޮ>��.����v�� L����W��^�M��Hx�Dm���*�2�%���r��p�&�$B��5�;L �������< I�Ma�/�A�&�۱��5�lŐ̹Q@ �r�~�м~@7j]f
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.3fb9ec13c080a9359a506f482e1bb460.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.3fb9ec13c080a9359a506f482e1bb460.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.3fb9ec13c080a9359a506f482e1bb460.exe
-
Size
5.0MB
-
MD5
3fb9ec13c080a9359a506f482e1bb460
-
SHA1
09112dcaf24e4583d892056a077b3022cf9469db
-
SHA256
f4d9b9ab34a6bddf0bce3ab5437ca909ced16253f7d4645da3a18cc4e53a5a0f
-
SHA512
49f520735a733f4b7092a3c1ed03574c4c8472204dd60bcec338738fcd7ccfad56b160f55e045bac26482700f59727f53a029380c35918fe513d394adf82a6c1
-
SSDEEP
98304:auwpwJDGLXehhlIG7hWjpAVrvspHTVW9ICdKlGfWNuSMU:Hwpw02lIG66ipzYiHlGON
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.3fb9ec13c080a9359a506f482e1bb460.exe
Files
-
NEAS.3fb9ec13c080a9359a506f482e1bb460.exe.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.2MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 193KB - Virtual size: 13.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE