�j@]�؟Z��A���[�G��A�u����m� �:n��8�y�ӛС����Ypp6C�� %�#{Y�Ӡo�5ṗ���>����qv 2�4Y��z �ר�i/��?c�X!x�.B��� �\�M����ρ��O�vI���s��s��7z���~5!(�6����Ny�n�>Dl6 �9��P�o=�;���#Y�n,������^������ Q�V����iK`O�#o.���n��~�E�s��R�Y��9��'�������Г� b��Ν(d�$��Ր�^B��v6���9��3�=: g��{�Z[��`YU.ni%����1�����`]�>��Cb��/��";�Ufγ~u��BU���>�ޘ�����sB�C�s��D�\�4�^�o Tc�}ڙ6],�nG���s���U�M�}4\�u���h�;��ml1`�Ԛð|ܵ#� s:���+����98x�&��L�rnOx�õ��wb�����d �����Ý�E�I�M�N8/jF{��*��;BΞ��wthx� ��7�~���J�u8�%=��)�i! B��$�h�R\fi����ij*��,���/��Uj����d�S���P:�����N����O�$O�#�CK���f��l�:��l�i�&+�h �'�����;�,_ab˂������mݨ�/�2���R���Ɨ������@�=`(>���L$ʌ���e@͐�gr#=�lYVc�k|�_��Dž���NQ���P��M��6\:�vu���<����j���xs��N9�䮫�6m<����G����#�(�om��pm�7R��x��J�O��@�L���:�v�{�j�n<���t$c�}.yϋ8��=�+a�����f�&��@��8��a猔r��ARo������>N��D,ķ/zM�u��AS�&)���d;\�4������Q)�А9���V��Wf�h}@����1v����{�1v�Y����0�߯�JY�/V��f��� "�gcmLw�*�"Y��&A;B�}ډ[��a,�����}NA�NU�����o�����X�5lk%,���=Ct����m��]����K�a?*�|��l�]�/O����~:�Y�s�E{/��C�m�H�wW\�E0/և�'�uﯞh-nJ/�zެ�5�z�-���.Q��`]x:���\��Gw���K�T��CIh{�Qq��)�A��F),o�M���7G��P�;*#>+�00���b&Ċla>k85�����Obtg2�F̰��T�!����9I^�D�ѯ��/cr^���h�Y�Fu��&Q�σ�浦S��W�l0_W2$�K{?�@��W�6ܩ>�-��O��%vh���զ����� ��׃P�ҰUٔ�W�F��]ˠ��^��Ʀ�־��fM���"���{v�[��e�3?j�6Gz�}�6�(�he}]�Nb�g�"�� �<��Tyb�i5a����͜w���#���ܲ>������jg�����&��qߢ�����i 8w((�����w�>΄߈�+�%'�����f�̝ID QW}��5�[�s^Y0�W�kS�.�|������ &XL��*�:ct�*&����<J1G�{�O���#V��,A�W����PU:���`՜��3!i��aAz�G��P�Z ��ܞ�t�����BV���*���� #uǚ�Oΐ�^��f�zI���;�=��[C��Cљ�ͺ"�,��Z�H >͊K/����`��^D��p��"Zn�sM�п�[����p��L�z��K���Rto��eW�M�@n{<�����(i7�z5FՇ�f}�h�ض���ҝ�����r��/�z:�?W��XO)���G�'��lG���K^���$XA��33~W�G9���O��hys#\�=���I���}n����H�7��L�o�^ai���AY���_eG�0o�8uF�hS�kUʐJZ�G#�ڮ������RG�}�h/ i��OB��젓)������ɓ�ͦ2�u�߇� �\�u��5N���)=&��= �e6hq�P�hp[����Ā��?������cK�v��G|���?�:�^NQs�"�o�2P �}���?Q��#����U��� �TP�ע���@�fO�ǝ��Em�����D��I��6��qC{�7qS�Wd���Ec&q���`J�'�c�OP��e0�,��S���%��P@'*��D����a�DP�7�-A� ]��|�ཡ�'^�x�CX��A���i=28�1C��@�}}�c�p�!�&PR��K p(����� ��?s�И|�F)8T����&p��KH�7p�-��!�<��q�p���u�����1sO^kxA�ɓφ9}aE�R��a�<�ESq����ó'G�Л2��^,�ǣ>ɤ*�p��[(�g�=K�=��G�q?OX���0����j��&��̑|�vk��Ҹ�v]�����r�{�7pw��?�m!/��F=��Rw}S��_�����M�,�LV���τ}.�džVmμ}�2 ����ᢩ3��l�zwQ�q�߾ g����p֝��)��g2����=�O�������V=Ҍ�����@t˷y�n�4��B�B�f�<{�a�H؞���߇��0cB8U���Q��!��%�Q�zc�ˆ�ﯤb`ל�)"@:W�����ޕ�_�����YJ��rg�͆W3��PMAgi��t�:[!���?��P�߳�1�`=Lx=ɸ�@� ���6��.�9�DTa����G@��K��rp�ň�q��A�Z��4^��yP�ٸ�"� ��N����3��ҥHӇm�L���.A�V�ot�3��|��E0j*B�r2�|Dq��CUM������-���4��e����M ��<��z�0���1�� '� 1?e���lQ�!�rO)y-��6y�a s"C&�Ȁa��=k��o��ý�u�\�=����U?��DǍ�F�e�s��K� ��HFY���X,Q�����;c_2�h�RM�/9�����r={t��u�Cyq]#�"qVd� jB�ه�
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.47d79c13e92e6574aa761ac67192dbd0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.47d79c13e92e6574aa761ac67192dbd0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.47d79c13e92e6574aa761ac67192dbd0.exe
-
Size
6.2MB
-
MD5
47d79c13e92e6574aa761ac67192dbd0
-
SHA1
9cabde1e82a97321d605be899db76e67bf2f6d91
-
SHA256
d4f40b7745b33cfea4725104f23b5bbea65b2112ad55737a92871075776ad151
-
SHA512
536667afbeeb5dc929b149477f41cb5505c1c45269535da031507577ea06c3ecfbeb4b397b0b68965d225f172262ce62359856146ced889b22ecad0f50069a52
-
SSDEEP
196608:tHv+v6jugzlyUcGprShIdsH+JvdqSGvuubo7:q8ugzlDprqIyHmOvuuE7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.47d79c13e92e6574aa761ac67192dbd0.exe
Files
-
NEAS.47d79c13e92e6574aa761ac67192dbd0.exe.exe windows:6 windows x64
fb9fbd68547db0703f1dcba72d2eb0fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleWindow
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetClipboardData
CharUpperBuffW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertFreeCertificateChain
ws2_32
getpeername
shlwapi
PathFileExistsA
psapi
GetModuleInformation
userenv
UnloadUserProfile
ntdll
RtlVirtualUnwind
urlmon
URLDownloadToFileA
vcruntime140
memcpy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-stdio-l1-1-0
feof
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
Exports
Exports
Sections
.text Size: - Virtual size: 425KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.g#` Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.}bS Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.TYa Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ