HPInit
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.c4a31dcd01d36012d6740fcbc4c272a0.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.c4a31dcd01d36012d6740fcbc4c272a0.dll
Resource
win10v2004-20231020-en
General
-
Target
NEAS.c4a31dcd01d36012d6740fcbc4c272a0.exe
-
Size
240KB
-
MD5
c4a31dcd01d36012d6740fcbc4c272a0
-
SHA1
cf3e7786029be9a84e308cb81530d64da862c2b6
-
SHA256
b49bd12e5fbaaff0f03d41ffc13fce378203cf749086c53f382496bfbcc40347
-
SHA512
9dbdc74c0349d15057c79f4d939a6bff6bad6d673f5ee41285b88b3601ff28738ee7f296f04c2bd6fa7618da3ed509a78e04041a1193ec2dae82708837ad726c
-
SSDEEP
3072:bpH8HUxf5ixwMbJ21cNN1VZals1Bj3pfre9Paf6mf7prlFgO2lwUEcnUtAUiRr:J8e5inE1cFVZasJpimfTFZoILtN2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.c4a31dcd01d36012d6740fcbc4c272a0.exe
Files
-
NEAS.c4a31dcd01d36012d6740fcbc4c272a0.exe.dll windows:5 windows x86
ca7ebdbadfdf6d8e71807b03018263f8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
IsBadCodePtr
VirtualProtect
FlushInstructionCache
WaitForSingleObject
ExpandEnvironmentStringsW
GetModuleHandleA
GetCurrentProcess
GetModuleFileNameW
DebugBreak
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
DeviceIoControl
CreateFileMappingW
GetLastError
MapViewOfFile
UnmapViewOfFile
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LocalFree
FormatMessageA
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetSystemTimeAsFileTime
HeapAlloc
HeapReAlloc
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
RtlUnwind
RaiseException
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeW
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
SetEvent
SetLastError
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetACP
GetOEMCP
IsValidCodePage
GetFullPathNameW
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryA
GetConsoleCP
GetConsoleMode
SetFilePointer
ReadFile
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
FreeLibrary
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
SetStdHandle
SetEndOfFile
GetProcessHeap
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetDriveTypeA
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
LocalAlloc
CloseHandle
TlsFree
CreateEventA
OpenEventA
ResetEvent
VirtualQuery
shell32
ShellExecuteW
iphlpapi
GetAdaptersInfo
cryptdll
MD5Update
MD5Init
MD5Final
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
Exports
Exports
Sections
.text Size: 176KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ