jefri.pdb
Static task
static1
Behavioral task
behavioral1
Sample
540a8c30b9d29f87b77ddcecb31b58e0_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
540a8c30b9d29f87b77ddcecb31b58e0_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
540a8c30b9d29f87b77ddcecb31b58e0_NEAS
-
Size
44KB
-
MD5
540a8c30b9d29f87b77ddcecb31b58e0
-
SHA1
b70105f3efb15e1c01e1b95bf80415d7f4a0644b
-
SHA256
32e832a33880b203f3c06e8aab5fa5687b2ba787e83e19b4d60a80207adab56e
-
SHA512
91682b5313a87034612757bfff4e08bddf11ba75aa250d37455938de2936bdb6b94791063e4e38cea4d3e655a5e02d00d12e6a51c614d5f58ec5a45d4503f6ac
-
SSDEEP
768:Pf+Fn+PDdK8CMeIVKGucOyGAwggggggLvggggggggSaSQPndWMoj8Z:Pf+Is8CMdicOWuSMowZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 540a8c30b9d29f87b77ddcecb31b58e0_NEAS
Files
-
540a8c30b9d29f87b77ddcecb31b58e0_NEAS.exe windows:4 windows x86 arch:x86
58513824c990be56f1e07213c3610d56
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shell32
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHGetFileInfoA
StrChrA
SHChangeNotify
SHGetMalloc
ShellMessageBoxW
FreeIconList
SHGetFolderPathA
DragFinish
SHCreateShellItem
ExtractIconA
SHFileOperationA
wtsapi32
WTSEnumerateServersA
WTSTerminateProcess
WTSFreeMemory
WTSRegisterSessionNotification
WTSVirtualChannelRead
WTSUnRegisterSessionNotification
WTSEnumerateProcessesA
WTSLogoffSession
WTSEnumerateSessionsA
WTSVirtualChannelWrite
WTSSendMessageA
WTSQueryUserToken
WTSQuerySessionInformationA
dciman32
DCICreateOverlay
DCICloseProvider
DCIBeginAccess
DCIDestroy
DCIEnum
kernel32
lstrcpynW
GetSystemTime
ReplaceFileA
GetModuleHandleW
GetStringTypeA
SetErrorMode
FindFirstFileA
ReadConsoleW
GetProcAddress
GetLocalTime
WriteConsoleA
DeviceIoControl
GetLastError
GetPrivateProfileIntW
GetPrivateProfileIntW
GetStdHandle
SearchPathA
FindNextVolumeW
GetTickCount
IsBadStringPtrA
lstrcmpiA
CompareStringW
SetEnvironmentVariableW
FoldStringA
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ