rm��|W��� D���|���:R���9��!�F`�]dO�Dj��W�*Q���;j8����O�@�sI<���"5�����������b��Rj��I2�g��v��k�_^ǹ��v��G#�x���B� �Nr�bD#���v�.~c!.�%=+�Et\m5�;��]3���}����ce�@�48a]c|'7ψ*w�z���)��>ˏ�{|�/����]��lܡS��~w��%�H�w���ʢi-���`<l�2��|�֘�^�i$[ePz��=���Q�'l,��v[���B�����G|s�P��`���5�U� /-q�`kDw����Ϣ��{�t{8�X��J��.ӓB^΄]�����\�2_������Xz��H|�Qr�8�>��h�[���/h��10 �����N���vbw�Ó���E �6ω��b��>0����"j��H����ł�Os��������� �&3ZEL���{D�ƥ۾&h+����` -���!�r%+�t�v�h9����5B�F�p��t�S#M�j�q��t�������60 y|Q����Y�~�������`O��f��[6�s�c3U���[�NzY�F�����L�2gxF5�8�$ȡ켺W���@�A�|O�.��*[�{<���Ą����7��0g�&��o�u�M�^Їi�L��N\CX~t�OW$���� �-��q$��#�FH:U|j� �p�_��E(� m�V���JWEJ��P��]����XE#Hy�r*�T�ގ��WR�W�2k��i�*襊D2�}����N�<긼��ߙ�2�sI�����!a���e�>�&CQ#ϣ81��MC"+�`>�K�^x����=ɘ�%�0�Գ��w��)U��� �Y��%�`��t1�BG2��*�.R�8 ����B����C��[k�8-K��L:J��V�C��:���h�K,�?�Fgԏ�a�9�S#���lD�1��>����E�:@���e���a�:!�C8�p�_;:� ������(��K�k2.'�5'cSJYo0�"�<�I�& ��_w�����$��7��^�(����k�DD�PT8���Wֈ5�����і�f�ٷ�[~H0f��5�Io�Y�W`l���cQd-.h�2+�ފ��kG���� u�~��)��b����|��O3�+�(���=���'�솅,����<�ʸ^�ެz�'*4"��U���I��:v�"�1��,�lf��Y��X��II�.:Z�q����N�Z"N��vk0��'/���+c��דL�I� iʚHn��� K�o�h-X� �JU� � `�{ES��k���b����o+�|y_:F[7�а�wc�&�K��Mm*$7��Hi���0���O�-Z2e7�|C^5X�DZ@v��|v�=R����Gg�h5t�r��`��y }ut�r���Hc�0Ec��L�&���K[|���or�5���V�+���/z�+L����I5'/�p�p�[�u�e�,cڎ��"��X� ��!�N�Yá�T���,P��Dw%��ٱ�Q��XyÁH��Р�&4�4���e%��E����\P>�W?�,�@[A}"����T1.g�Gxo��أ��z�7P\^����֞?�\-�֖ߝE�Z�����Κey�HI�(Qꦵ��?x�D����K�����ʙx�%$�� ��X��^y�-Sx�Z��%z|���Q���k���W��줆;oG��۴��M#0���j6&���r�(����R��}�8��o��"�$���J�d���Q1�k�Q���DTJ=Q��4�+�}�Kc�e����)�>a(��|��z�T�I�ߐ~�����8M.��Gt=A�*��#U,ȳ3u��g�^����/�ռ���?nt�}�Qfg��f�B��~�� x.PXgS-w-�=dD�ư4�^��$������!��.]Z����E.�V����1�2ܼ�F�N�� ��hWxR"��&�lUb/���7Ӧ��N���P�V�d�e��k����0� %;@�_6���+W�nJ��G��|i�j���$�䱟�|�mn��y���\���!W eF:����@�����`���Y�H[3^U�V�Zl�D��V��=� ��ᖖ S*�圤w{�["�C���G�� ��]9� uRh�� ��S���kmŝ�G�5*h8 MpȊ����<�LQ�r�� �s0L�pXdf5g��Y��p�iY�+�<��^������� �DA�Լ�nB�A� �ۿL�y���\�'�[�ql���>��D��&�t*F�WF�ò?� U�W�vm�&����'���8$�w�H�72K�U[;(�=.�W��ʑ�ox�e$#� o;�����e��:�-3dIa��Գ�&�o���nAm�C��T4 �"������Uo2t:�x:�����_�I�x��{6!}�↟6�� �]X��A�F0H_&��yf��~�b��[���2| ͂T�M�m�����C_�7�#�F�q$����(�&gX���aTO��7���Be�>��G����2IV21��R���0���,��d:+b`2ָ�h�#���']�g-����*vu�ΣrBR�$wPaBABU;��)� �ʛ�팎�<;*���=�=��Ew�$�e����qL��y��5w����dz���"�F[����V��a}�!Z�;n0L���ζ#��*?dP�h��_U[I�s0㈇��V��n��F���ش�t��$�^(��������T���) h��,iB������6R��� �0Vt�w�:�����.%XI�H�Z*���"^6�^��<`pH"fB\-�μFk�ygijY�P�s�b;Ð<� ��K�?�J�0s�� �_�\���Z)��N��*>�M�]bv��El��F��-b+|��� ]-Pn����@�1R�������#8���RL�<����T�9���^��E��b��8���O��]:����!}��^��3|E �����G꒽�OB�L�j�b9���`*#4>�@;%�E���Z������b��\d��K��/�$�������R�t�z]o�{�����5k+ϡ�yϮl�ٲO"p�#��Tw���m7�>$�0Oq�A�O��M���v#u���dz���w䍴�B-��8�c��{2�X�ԋXG��b����$6�!`5��n���g�J�p�pg,W4���!�o٪Y�{����Y�X�P���vG!�m�n�(�,�0e�r���y�[z*I��^����S�w8�Ó�Hd>�c����?���p.R���t��?*iiؙMLݿ�Y�Y�z��.��jmR �'�����M�z���e���X��}���V���7>��I`eo�h�6���COf% /es^��]�~0N�'%0[ݢD�x��5��\'��G�~�xY�X��b��x���� �7��'�����J I���:HZ1s�M�G@3r���0��Q�M�J0܈p�-R��C��PN�^P�[M�9~b�RC[Q�j|Ig�!�rJ#�`�C���|-��w�c���j/�8���(�%�����@��Cnם�E�聮 q^
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f70c4553ceb011eca909b58231f66f40.exe
Resource
win7-20231023-en
General
-
Target
NEAS.f70c4553ceb011eca909b58231f66f40.exe
-
Size
6.5MB
-
MD5
f70c4553ceb011eca909b58231f66f40
-
SHA1
b79d4487ce195b34898ecb85c0aaeaf9ad24e323
-
SHA256
3b871bf342311db4ccf21c684839f429c8b3fc983e02732dfe171d7f91f224f6
-
SHA512
c958b16c72a5e8112aeaa8001384e0ea3d99dc2853f94a827716279fcbafe5dcff8d46885496f2d9b7aa9357ac8ad900ecd63402f421f7400c94154671928b36
-
SSDEEP
196608:KA/ZM1IOy4sEYKHA14agqUTKNfiFsFcF:KA/ZRObALgq4KnFc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.f70c4553ceb011eca909b58231f66f40.exe
Files
-
NEAS.f70c4553ceb011eca909b58231f66f40.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Exports
Exports
Sections
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 4.2MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE