Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f841c68b9acb47d61c09101def8fcc40.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.f841c68b9acb47d61c09101def8fcc40.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.f841c68b9acb47d61c09101def8fcc40.exe
-
Size
971KB
-
MD5
f841c68b9acb47d61c09101def8fcc40
-
SHA1
5c72fac6ba7a1bc14fce9255e0c9f6be53cb4feb
-
SHA256
af1207919530bb0e10402e05c16b92960f1517de2a8019294d964eec43b483f7
-
SHA512
dd73f48ba58e966d555f7f607d2b018d75f685aecafabf9c8cea5a021318d947fd0607d04c8a6c0779cf76c5fb14a1fb6f5413cccb89e73d06e90e94e94410a4
-
SSDEEP
24576:RFYPUaVFtlO1kDa2Nng/2rJNdqCPiPPnyqio6jSkyzC:RiRVF3O14l7rffinny
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.f841c68b9acb47d61c09101def8fcc40.exe
Files
-
NEAS.f841c68b9acb47d61c09101def8fcc40.exe.exe windows:6 windows x64 arch:x64
7d7ea677cc5d45520d722016c8cd1d0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
VerSetConditionMask
QueryPerformanceFrequency
LoadLibraryA
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GlobalUnlock
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OutputDebugStringW
GetFileSizeEx
CreateFileA
FormatMessageA
SetLastError
WaitForMultipleObjects
PeekNamedPipe
ReadFile
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetTickCount
GetConsoleWindow
GetModuleHandleW
GetCurrentProcessId
CreateThread
CloseHandle
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
Sleep
VerifyVersionInfoA
GetSystemDirectoryA
LeaveCriticalSection
EnterCriticalSection
LocalFree
DeleteFileA
MoveFileExA
Process32NextW
HeapFree
GetFileAttributesA
GetTempPathA
CreateToolhelp32Snapshot
GetCurrentThread
CheckRemoteDebuggerPresent
IsDebuggerPresent
SleepEx
GetProcessHeap
DeleteCriticalSection
GetProcAddress
HeapDestroy
HeapAlloc
HeapReAlloc
GetLastError
QueryPerformanceCounter
HeapSize
GetModuleHandleA
InitializeCriticalSectionEx
GetCurrentProcess
RtlVirtualUnwind
user32
GetCursorPos
ShowWindow
GetSystemMetrics
ScreenToClient
SetWindowPos
FindWindowA
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetWindowLongA
SetWindowLongA
DispatchMessageA
MessageBoxA
TranslateMessage
FindWindowW
PeekMessageA
UpdateWindow
ClientToScreen
GetForegroundWindow
SetCursor
GetClientRect
LoadCursorA
GetAsyncKeyState
SetCursorPos
advapi32
CloseServiceHandle
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
IsValidSid
GetLengthSid
GetTokenInformation
OpenServiceA
QueryServiceStatusEx
OpenProcessToken
OpenSCManagerA
CryptReleaseContext
ole32
CoInitialize
CoUninitialize
CoCreateInstance
msvcp140
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xbad_function_call@std@@YAXXZ
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Xtime_get_ticks
?_Xlength_error@std@@YAXPEBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
_Thrd_detach
_Query_perf_counter
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
userenv
UnloadUserProfile
urlmon
URLDownloadToFileA
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmAssociateContextEx
ImmGetContext
d3dcompiler_43
D3DCompile
normaliz
IdnToAscii
wldap32
ord26
ord79
ord30
ord200
ord301
ord143
ord41
ord50
ord45
ord60
ord211
ord46
ord35
ord22
ord33
ord32
ord27
ord217
crypt32
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertFreeCertificateChainEngine
PFXImportCertStore
CryptStringToBinaryA
ws2_32
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
closesocket
gethostname
ntohl
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception_context
__current_exception
memchr
memcmp
strstr
memmove
strrchr
memset
memcpy
__C_specific_handler
strchr
__std_terminate
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_cexit
_seh_filter_exe
_register_onexit_function
_initialize_onexit_table
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_initialize_narrow_environment
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_errno
exit
__sys_nerr
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_beginthreadex
system
terminate
strerror
_getpid
_set_app_type
_resetstkoflw
api-ms-win-crt-heap-l1-1-0
_callnewh
free
realloc
calloc
_set_new_mode
malloc
api-ms-win-crt-stdio-l1-1-0
_set_fmode
fopen
fputs
_lseeki64
__stdio_common_vsscanf
_wfopen
__acrt_iob_func
fputc
fseek
_pclose
__stdio_common_vfprintf
feof
fgets
_popen
ftell
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
_read
setvbuf
fgetpos
__stdio_common_vsprintf
fwrite
fgetc
__stdio_common_vsprintf_s
_write
fclose
fflush
_close
_open
__p__commode
api-ms-win-crt-time-l1-1-0
_time64
clock
_gmtime64
api-ms-win-crt-utility-l1-1-0
srand
qsort
rand
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_stat64
_stat64i32
_fstat64
remove
_access
_unlink
_lock_file
api-ms-win-crt-string-l1-1-0
strspn
strcspn
isupper
strncmp
strpbrk
tolower
strncpy
_strdup
strcmp
api-ms-win-crt-convert-l1-1-0
atoi
strtoull
strtoll
strtol
atof
strtoul
strtod
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-math-l1-1-0
pow
logf
log
fmodf
sinf
cosf
ceilf
sqrtf
atan2
asin
_dclass
powf
acosf
__setusermatherr
tanf
Sections
.text Size: 790KB - Virtual size: 790KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ