Static task
static1
Behavioral task
behavioral1
Sample
NEAS.369a1c48758074213c284b0469028f20.exe
Resource
win7-20231020-en
General
-
Target
NEAS.369a1c48758074213c284b0469028f20.exe
-
Size
1.3MB
-
MD5
369a1c48758074213c284b0469028f20
-
SHA1
f6d48ab0dee65e7e70a61490b1a25d7723b78492
-
SHA256
c9c295bc79bbae8d36afd000048fbaf12b84391b3c2a2d5b84f118f3025656b4
-
SHA512
32fca9ed2f967c75611225c634250461d8718fd183516c58aba06c87f0950fd16fc09f58ff0e580b53c33e8e5a4190815d00a04580900039282b7e4291240baf
-
SSDEEP
24576:GiysI6AZ2O/jdBtX1bPzg8M2LX3JTFwoEh/:UsIn2O/jHbLg8B3p6F/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.369a1c48758074213c284b0469028f20.exe
Files
-
NEAS.369a1c48758074213c284b0469028f20.exe.exe windows:5 windows x86
96da216068592e571255a84eed185de8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shfolder
SHGetFolderPathW
SHGetFolderPathA
shlwapi
SHDeleteValueA
SHDeleteKeyA
setupapi
SetupOpenInfFileW
SetupFindFirstLineW
SetupGetLineTextW
SetupCloseInfFile
SetupFindNextLine
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
kernel32
ReadFile
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetFileAttributesA
LoadLibraryW
GetSystemDirectoryW
GetVersionExW
GetSystemDefaultLCID
GetUserDefaultUILanguage
FreeResource
LockResource
LoadResource
GetLastError
FindResourceExW
GetModuleHandleW
FreeLibrary
GetProcAddress
LocalFree
GetModuleFileNameA
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetStartupInfoA
FindClose
FindNextFileA
FindFirstFileA
RemoveDirectoryA
Sleep
DeleteFileA
SetFileAttributesA
MoveFileA
FindNextFileW
DeleteFileW
FindFirstFileW
GetCommandLineA
CopyFileA
CreateDirectoryA
CreateFileA
GetSystemDirectoryA
ExitProcess
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleA
SetLastError
LoadLibraryExW
CreateProcessW
LocalAlloc
lstrcmpW
ExpandEnvironmentStringsW
GetFullPathNameW
VerifyVersionInfoW
VerSetConditionMask
GetModuleFileNameW
CreateFileW
lstrcmpA
OutputDebugStringW
SetStdHandle
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
CompareStringA
CompareStringW
SetEnvironmentVariableA
ExpandEnvironmentStringsA
GetLocaleInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapAlloc
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapSize
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
user32
MessageBoxW
advapi32
RegOpenKeyW
OpenSCManagerW
OpenServiceA
CloseServiceHandle
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegSetValueExW
RegCreateKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Sections
.text Size: 573KB - Virtual size: 573KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 632KB - Virtual size: 636KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE