gfL��O@�~(�r����" `���Q�M��~��Մ4/������+,2L�����js�Jq��t�깪�gD��(g�}�1������a�h:א��;_��V�oC���s�\�����E}|*q�u(���n�h����Z�hX9G��)ص6.�j(�Z�Qz����~�+�c�p���`{-<����Z����)ġ�2 { �feK�[�����s�2�/�s��AC���=��eU��\ٛ����Y������f�o�\����Ԉ�,��0� dG��?�N_�åg�|{�9�c��.��U�Z����W�#a�=�Y�j[Y��O b�������p.��P��cFdm����z׃Z�d�%�e������ɳ�O)��)�9E��o dt�eV3�}�?Ɗ'u���Х^�V�R(�_���$?l���f1U+7<mJ�q�sj�Iu�Ҹ���ݺ�E9H(@���-u!��T!"(:sH�0�O}XN}��-�nHyE��K�ih C�q�l,��PY�_��>a��g�=��}������ߩ->#�p.���e<zb8]9���%>��(F� ���r��\�"�uO���v��|ǓQ�HW��p�7��q� ����# �k��d�^K�^�'"Y���^λ��T���}����� �IEWs�����9^RЅ[���L'bj�t���s�Y��� "��0�����Q�e��m�'�;Q�o M�TN"5 `�����v��e�Y+����HV�p�ć�P��ˋT�ATOEVgz�0v�I,J���Ta�E�i����x&��*����N��Q/T������.u���������8�jGm����Ml�/��?�2����{�R�j*%�d�U3f��_]f��������B�yo���eX�A�����g3�� �J.��t-d�<���s_����-كT���0�5Z����1�p��4G���W�--�/Xh�,������00�֙���u� K"CDuZJ��b����_�qM&U�1ҽ+�q8X�����Y�Iч]��۱i�J���B9jN7s����bl���RZ�i� 4���!���>_�d$h �(��������hHnC2x1�A=����l�\���E��z�L#�^�x>��3�sx�)��������f�X��UX����oB�79`�Ƕ�^�9�����lsscuяnd7#=B�%����sa��thf��Á�E�e�^�#:��j:���gӦ��,i&-���Ut��N0i����.k��uXx�l�e��_.���҈J%�w���I���xU����؛&�s��o�t�sػ�(�?�]�;���a)|c�zBuAA" ������������z���%\����alh#��n8U|{��sa��L)�vĉ����J��%u��O�F��}.[!����iUQ����L�jM�J\��Vg7��g�� �2�Q��q�����S�Kw�c�mS{ &L��� �o4�zݝ,Ap>���4,cI)�{C�QC�}�ᬳs��Jv]lT�{�2 XŦ~c��+��Eh� �G��*�t ���%-gT����}�� �,uK��������b�zP�CD��C7=x�Ԛ/���Nb �â��V�$�%�ݻD@����dz�UAJ?���vSa�=Q�����6Q���۔�x����?�)+�.$Ԏ�ALR�ZKO�_����M|������FX��f-�:'/�ͦH]VC�I_� {!48ӓC��+�m����vKj�l�"�o�Ak_�)2�b�#M�mwk����a������d�@��%}P ��=XN�X��2�/k�bM2�����wł���d<!ܟ���ݽUl���.w�a�[G]�6�Xx[����܍����\2�[���$�jk���[8�$)N-���mD��7[9͠co����r��g�ۊ�p�����#�f��-V��6��[J�0$����o���������Z?��J�-'0Cvbh>~J����N5gD���U_����ԝ";R����G54�V� ���ϐ� h)��[ޙ�H��݆�/3Q�(am�ZB��~��>�����˅/CNI��Uw�y��X�(b*9�\F�������3<��E��n���J�h5�� �T�}A���%�`�6��E�K?�6��a�Xj��q%�'�GY��r���b���H�>��@h)�&1F*�A>��ע�[7L�y<��L��~��4����*��vSG�B��_Ge���L�)(���n)���EVь1SӐ��x�e�?ٽ��+���&��IJV[xV�$������l|!�-"dI�w��j�]������n[�ϓ�5�� 9wH h�-5�S�Qd��bN6�)GM儀��Tw���Qi���y�ZD(];�� j�*&Ν4���@��X�m5[������"!�e��KG���Ŋ�������O�8T�Tm��ɛz�����Q}6 �ŀh��m�OmNR��^{�eZV֞����C�om p�г�+9e�v�%���HN�%������C�/�7�Ms Ji���ebs�+X��WK�2 *T�k�՞���)�Xr^]��I#�B`LY��zX�l�Q���kHL`��CV�Y�ևϔ#�B��3��u��"�&�W�,��t��� �֟�]�ۙ`���4��NV����4^�)��K�4ܪ���Ӏ;�'�"#C�N�p�&����7��D�����N�g\\�B�P_A���,���{�D���� ,F��ؕ8(Zd����/�Qs�8�khϖ������0g#c �-���7h��*�Mג�1C,4����A��Y����T&���]�A��C,��������Z�/K.H�'�g/uy" <�Ә�6��ֆ�@�p&j�t7�2���ǀ�|�!�Ha"8<��f#Z�L"N�zF���F���IY]A��P2���*M���7̨r#�ѡ�����p����W5���Ã�x��Р.�F��������fcpU��7�{z��ʮߘ&L��s���K=o��I;��/����VhK���c��!ʬl@���5����B����)ǭ�
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.ab2a0f503b6ca9129efc2f7222915c70.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.ab2a0f503b6ca9129efc2f7222915c70.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.ab2a0f503b6ca9129efc2f7222915c70.exe
-
Size
8.2MB
-
MD5
ab2a0f503b6ca9129efc2f7222915c70
-
SHA1
e6c0bdf72daa2b72cf8a22e62d17b31f20f109ed
-
SHA256
fc91ab700fac7ba4ff19557bc84f70f45efeeec92f27e1941d5813023a49c2dd
-
SHA512
dcbf42d45f6eab45e1a1758b824aa389a1072aac30e088a265c98b41f8886db8d45423d11bce9184cf1bc02bc3fdc20b60e6d67ef9ae685fd72fa97644b73f84
-
SSDEEP
196608:gk8XFOmWqBWQbhknQB5sIMwZLuduAEHOpayWeM8G73SLty:H2FOmwYcosIMyWkukgM8I3yty
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.ab2a0f503b6ca9129efc2f7222915c70.exe
Files
-
NEAS.ab2a0f503b6ca9129efc2f7222915c70.exe.exe windows:6 windows x86
6b8cda56dfd395eb0a7f0db9ec2d5c1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACloseEvent
crypt32
CertFindCertificateInStore
wldap32
ord143
normaliz
IdnToAscii
kernel32
CreateFileW
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
OpenProcessToken
shell32
ShellExecuteA
api-ms-win-crt-stdio-l1-1-0
_close
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
aIzoyxp? Size: - Virtual size: 363KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
r:prZU6b Size: - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
y+Fb]/N7 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
`.n_K>a` Size: - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
*snk@R,w Size: 8.2MB - Virtual size: 8.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
:[i*rtH- Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ