Static task
static1
Behavioral task
behavioral1
Sample
NEAS.242432db30341332ab0842bfde6fa120.exe
Resource
win7-20231023-en
General
-
Target
NEAS.242432db30341332ab0842bfde6fa120.exe
-
Size
948KB
-
MD5
242432db30341332ab0842bfde6fa120
-
SHA1
e881b17f026bae1f9ff81eee81b72f640aeb850c
-
SHA256
724580a4a6de598e1aa6ecbbde306a448593dd82a374eb40500423ed65f81320
-
SHA512
7516c5d05d3d14d3946f26b7ce7a063393849c11a8560943b72d0b5cef6a6a098c1a2e4cfbba6802a3f9279bc664261e0b0f1418152e9a9f126e100aa11ce8c5
-
SSDEEP
12288:cffHoi1fj74r6TOjczKLOeZbSeifE0n8elgty14hR4fYZwjPsNPjGWNnxMqGGVO:cXHoP63sOdB8GgtywRBw7sNPj3NnxMPB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.242432db30341332ab0842bfde6fa120.exe
Files
-
NEAS.242432db30341332ab0842bfde6fa120.exe.exe windows:5 windows x86 arch:x86
c812ad22e56a9efd49952032ab7e6ef3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
shlwapi
PathFileExistsA
PathAppendA
PathFindFileNameA
PathFindExtensionA
mfc100
ord7491
ord7927
ord11940
ord796
ord337
ord4131
ord12128
ord7875
ord4143
ord4345
ord917
ord11728
ord11941
ord11812
ord341
ord4782
ord6836
ord6628
ord722
ord6009
ord12002
ord1173
ord10595
ord12189
ord6131
ord12694
ord3946
ord7301
ord3143
ord12721
ord12718
ord4317
ord2183
ord11924
ord2219
ord3988
ord4505
ord11431
ord943
ord12861
ord374
ord5801
ord12099
ord6054
ord11437
ord11455
ord11949
ord12124
ord12790
ord12473
ord12850
ord7994
ord12847
ord11875
ord12857
ord11878
ord4589
ord2068
ord2023
ord2818
ord2270
ord741
ord1248
ord3497
ord5212
ord13316
ord848
ord7997
ord2505
ord1292
ord1281
ord4274
ord4588
ord13170
ord13137
ord13131
ord4212
ord4144
ord7600
ord11280
ord1025
ord481
ord4993
ord7297
ord1985
ord1940
ord880
ord2195
ord740
ord7363
ord6332
ord2759
ord1290
ord890
ord6117
ord11939
ord12865
ord13305
ord11277
ord5208
ord3364
ord4341
ord6521
ord4340
ord2184
ord9414
ord4935
ord4933
ord422
ord3621
ord5627
ord978
ord7581
ord3167
ord7892
ord11744
ord3839
ord6133
ord6132
ord1854
ord3977
ord262
ord13095
ord12285
ord7322
ord2406
ord6971
ord2769
ord2843
ord11655
ord2137
ord2138
ord12702
ord6150
ord12705
ord12344
ord5204
ord788
ord1210
ord10030
ord3251
ord457
ord1952
ord4343
ord6073
ord5435
ord6104
ord1900
ord5774
ord6207
ord5762
ord421
ord6970
ord10906
ord13312
ord2524
ord977
ord7178
ord1242
ord1004
ord1277
ord2067
ord6637
ord1890
ord7474
ord11172
ord1288
ord7584
ord7510
ord11726
ord13767
ord4724
ord2163
ord11420
ord11421
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord7091
ord1732
ord14075
ord10922
ord13181
ord11413
ord7144
ord13483
ord13480
ord13485
ord13482
ord13484
ord13481
ord3409
ord5238
ord11180
ord4078
ord7355
ord9449
ord11184
ord11153
ord11787
ord5098
ord9281
ord6112
ord888
ord9399
ord6835
ord1479
ord2119
ord2617
ord1224
ord2932
ord2819
ord6060
ord1263
ord3755
ord2838
ord8231
ord6090
ord11882
ord7933
ord7889
ord7206
ord1483
ord3758
ord2939
ord2841
ord8234
ord5432
ord6098
ord5821
ord3429
ord2613
ord7861
ord3741
ord2744
ord8224
ord5784
ord4554
ord12440
ord12962
ord878
ord5830
ord1929
ord968
ord919
ord1271
ord1278
ord4499
ord13329
ord11297
ord13310
ord11274
ord2056
ord2063
ord320
ord6010
ord2076
ord3253
ord3738
ord2742
ord8222
ord5444
ord5777
ord3970
ord7487
ord915
ord3354
ord3241
ord300
ord11781
ord1313
ord385
ord6680
ord11108
ord8330
ord948
ord5776
ord5837
ord3439
ord5207
ord4464
ord12090
ord4498
ord11439
ord7871
ord6316
ord3373
ord3390
ord2611
ord4344
ord2187
ord3475
ord7863
ord3746
ord5875
ord1294
ord2061
ord1982
ord1448
ord3254
ord3744
ord5534
ord12535
ord2417
ord8228
ord11154
ord5302
ord8304
ord5858
ord895
ord12170
ord1012
ord6314
ord316
ord9475
ord4283
ord1316
ord265
ord266
ord310
ord11627
ord4785
ord12868
ord13219
ord901
ord6678
ord946
ord11067
ord8137
ord10007
ord10360
ord3620
ord2974
ord2973
ord2752
ord5532
ord12531
ord2881
ord2878
ord7349
ord2416
ord14059
ord14061
ord14060
ord14058
ord14062
ord14045
ord13972
ord13973
ord8235
ord11025
ord3395
ord10883
ord13294
ord8070
ord11107
ord6217
ord9994
ord8351
ord2847
ord12644
ord11190
ord11188
ord1496
ord1503
ord1509
ord1507
ord1514
ord4373
ord4410
ord4381
ord4393
ord4389
ord4385
ord4415
ord4406
ord4377
ord4419
ord4398
ord4364
ord4368
ord4401
ord3991
ord13980
ord3984
ord2661
ord13302
ord7074
ord13300
ord6128
ord10672
ord12482
ord5253
ord2338
ord11060
ord3484
ord2945
ord2944
ord2846
ord11103
ord4622
ord4903
ord5095
ord8439
ord4881
ord5123
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9286
ord8305
ord5803
ord381
ord1296
ord12552
ord2088
msvcr100
fgets
fopen
realloc
strerror
_errno
_stricmp
_strupr
_splitpath
_unlock
__dllonexit
_lock
isdigit
_except_handler4_common
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
__CxxFrameHandler3
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
__iob_func
ldiv
atol
_mbscmp
malloc
_localtime64_s
strftime
vfprintf
fseek
ftell
fprintf
_vsnprintf_s
_ctime64_s
strncpy_s
fopen_s
fputs
getenv
memmove_s
calloc
free
_time64
_difftime64
_CIpow
strtoul
_itoa_s
fclose
fsetpos
_fseeki64
fgetpos
fwrite
memcpy_s
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
fflush
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
memcpy
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
fgetc
fputc
ungetc
_lock_file
_unlock_file
_onexit
setvbuf
??0exception@std@@QAE@ABQBD@Z
memmove
_purecall
memset
vsprintf_s
strcat_s
strcpy_s
sprintf
_setmbcp
_controlfp_s
kernel32
GetVersionExA
GetTickCount
MulDiv
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalSize
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetCurrentProcess
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleW
DuplicateHandle
WaitForSingleObject
CloseHandle
SuspendThread
ResumeThread
ActivateActCtx
GetLastError
DeactivateActCtx
SetLastError
GetProcAddress
GetModuleHandleA
LoadLibraryA
lstrcpynA
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryA
Sleep
GetPrivateProfileStringA
GetPrivateProfileStructA
GetPrivateProfileIntA
WritePrivateProfileStructA
WritePrivateProfileStringA
WritePrivateProfileSectionA
FindFirstFileA
FindNextFileA
FindClose
InterlockedExchange
GetModuleFileNameA
user32
SetWindowPos
LoadStringA
GetDlgCtrlID
DrawIcon
EnableMenuItem
ModifyMenuA
SetMenuItemBitmaps
LoadMenuW
PostMessageA
GetSystemMenu
IsIconic
GetClientRect
LoadIconW
GetSystemMetrics
ReleaseDC
GetDC
SystemParametersInfoA
SetRect
InflateRect
FillRect
FrameRect
DrawEdge
LoadCursorA
DrawTextA
GetSysColor
SetCursor
IsRectEmpty
EqualRect
InvalidateRect
GetParent
GetKeyState
IsWindow
IntersectRect
InvertRect
ClientToScreen
ScreenToClient
SetTimer
KillTimer
GetCapture
SetCapture
GetFocus
TabbedTextOutA
DrawTextExA
GrayStringA
DefWindowProcA
GetClassInfoA
IsClipboardFormatAvailable
GetMessagePos
ReleaseCapture
ClipCursor
GetCursorPos
CopyRect
WindowFromPoint
GetDoubleClickTime
wsprintfA
PtInRect
LoadAcceleratorsA
IsWindowVisible
GetWindowRect
PeekMessageA
DispatchMessageA
TranslateMessage
InsertMenuA
GetSubMenu
AppendMenuA
DeleteMenu
CreatePopupMenu
SendMessageA
EnableWindow
TranslateAcceleratorA
gdi32
GetTextMetricsA
PatBlt
Escape
PtVisible
ExtTextOutA
RectVisible
BitBlt
GetBkColor
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
CreateFontA
CreatePen
GetCurrentObject
GetDeviceCaps
GetTextExtentPoint32A
CreateFontIndirectA
TextOutA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
shell32
SHOpenFolderAndSelectItems
ord155
SHParseDisplayName
ShellExecuteA
DragQueryFileA
comctl32
ord17
oleaut32
SystemTimeToVariantTime
VarUdateFromDate
VariantTimeToSystemTime
msvcp100
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Xlength_error@std@@YAXPBD@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?setf@ios_base@std@@QAEHHH@Z
??7ios_base@std@@QBE_NXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_BADOFF@std@@3_JB
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?good@ios_base@std@@QBE_NXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??0_Lockit@std@@QAE@H@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
Sections
.text Size: 497KB - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 339KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE