B:\Sources\DsBusAccessManagerSP\Bin\Release\VeosBusAccessManager.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8c2b14973158555b58890eda622d3750_NEAS.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8c2b14973158555b58890eda622d3750_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
8c2b14973158555b58890eda622d3750_NEAS
-
Size
152KB
-
MD5
8c2b14973158555b58890eda622d3750
-
SHA1
f0c842fe54c89e0ce87ac33624cd3494c601432f
-
SHA256
d41701ab73af59d87be1cd3c79c9267fdafdec721d542bb2bf1fef5874ed2f52
-
SHA512
1b673f7270d2b0289f194ffe758c9d31b1905f598bac268a0f2b137d0290244ae52521439db75d397194c6f3c0ca7731046153c9419a06d65011fe4b94c57c85
-
SSDEEP
1536:mqgP/eM0flGQnEHoj52Nyau2y3KHVYGGXl/3xTe+oZjdBo1StzjMLMl7vNReRs7N:mqM4lGQOE2gfjP8VZvOV78IDh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8c2b14973158555b58890eda622d3750_NEAS
Files
-
8c2b14973158555b58890eda622d3750_NEAS.exe windows:6 windows x86 arch:x86
2c78b7517fd1093842f0cb5061df4ea3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
dssmartbaselib
?openSharedMemory@DsNSharedMemory@@YAHPAPAXPAKPBDKKHHH@Z
?closeSharedMemory@DsNSharedMemory@@YAHPAXKPBDKH_N@Z
dshostinterfacemanagerap
?DsCnHIM_applyFifoConfiguration@@YAJAAVDsCErrorListPool@@PAX1@Z
?DsCnHIM_setFiFoParameter@@YAJAAVDsCErrorListPool@@PAX1K1K@Z
?DsCnHIM_getFiFoParameter@@YAJAAVDsCErrorListPool@@PAX1K1PAK@Z
?DsCnHIM_flushFiFo@@YAJAAVDsCErrorListPool@@PAX1@Z
?DsCnHIM_sendToFiFoNC@@YAJAAVDsCErrorListPool@@PAX1PBEKPAK@Z
?DsCnHIM_deleteFiFoServerHandle@@YAJAAVDsCErrorListPool@@PAX1@Z
?DsCnHIM_createFiFoServerHandle@@YAJAAVDsCErrorListPool@@PAXKPAPAX@Z
kernel32
CreateEventA
CloseHandle
CreateFileA
GetTempPathA
lstrcatA
WaitForSingleObject
ExitThread
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentThreadId
dsoncrpc
svc_sendreply
svcerr_systemerr
svcerr_decode
xdr_int
?SetSvcState@DsCRpcServer@@IAEXJ@Z
svcerr_noproc
xdr_u_quad_t
xdr_free
??0DsCRpcServer@@QAE@AAVDsCErrorListPool@@@Z
??1DsCRpcServer@@UAE@XZ
?setParameter@DsCRpcServer@@QAEJAAVDsCErrorListPool@@KE@Z
?registerInterface@DsCRpcServer@@QAEJAAVDsCErrorListPool@@KKPAX@Z
?unregisterInterface@DsCRpcServer@@QAEJAAVDsCErrorListPool@@KK@Z
?run@DsCRpcServer@@QAEXAAVDsCErrorListPool@@@Z
xdr_char
xdr_array
xdr_vector
xdr_u_short
xdr_bytes
xdr_void
xdr_u_int
xdr_u_char
dserrorhandling
?isSingletonProcess@DsNRtosAbstraction@@YA_NE@Z
?setThreadPriority@DsNRtosAbstraction@@YAXKPAX@Z
?disableSigPipe@DsNRtosAbstraction@@YAXXZ
?usleep@DsNRtosAbstraction@@YAXK@Z
?enableIOPrivilege@DsNRtosAbstraction@@YAXXZ
?setThreadName@DsNRtosAbstraction@@YAXPBDPAX@Z
?setServiceInitialized@DsNRtosAbstraction@@YA_NXZ
?createThread@DsNRtosAbstraction@@YA_NAAVDsCErrorListPool@@PAPAXKKPBDP6GKPAX@Z3@Z
?getErrorCount@DsCErrorList@@QBEKXZ
?sendErrorList@DsCErrorManager@@QAEXAAVDsCErrorListPool@@K@Z
?sendWarning@DsCErrorManager@@QAEXKKPBD@Z
?getErrorCountLock@DsCErrorList@@QBEKXZ
?getErrorCountUnlock@DsCErrorList@@QBEKXZ
?getMasterErrorList@DsCErrorManager@@QBEAAVDsCErrorListPool@@XZ
?registerMessages@DsCErrorManager@@SA_NPBUDsResText@@@Z
?unregisterMessages@DsCErrorManager@@SA_NPBUDsResText@@@Z
?Name@FIFOServer@BusAccessManager@DsNRtosTasks@@3PBDB
?Name@Background@BusAccessManager@DsNRtosTasks@@3PBDB
DsRtosAbstractionTime_getTicksPerSec
?condSignal@DsNRtosAbstraction@@YAJPAPAX@Z
?initCond@DsNRtosAbstraction@@YAJPAPAX@Z
?deleteCond@DsNRtosAbstraction@@YAJPAPAX@Z
?lockMutex@DsNRtosAbstraction@@YAJPAPAXJ@Z
?condWait@DsNRtosAbstraction@@YAJPAPAX0J@Z
?unlockMutex@DsNRtosAbstraction@@YAJPAPAX@Z
DsRtosAbstractionTime_getTicks64
?setError@DsCErrorList@@QAAXKKPBD0ZZ
?createErrorList@DsCErrorManager@@QAEAAVDsCErrorListPool@@KKKKK@Z
?deleteErrorList@DsCErrorManager@@QAEXAAVDsCErrorListPool@@@Z
?setMasterErrorList@DsCErrorManager@@QAEXAAVDsCErrorListPool@@H_N@Z
?clearMasterErrorList@DsCErrorManager@@QAEXH@Z
?serialize@DsCErrorList@@QAEPADAAK@Z
?reset@DsCErrorList@@QAEXXZ
?getInstance@DsCErrorManager@@SAAAV1@XZ
?sendWarning@DsCErrorManager@@QAAXKKPBD0ZZ
?sendMessage@DsCErrorManager@@QAAXKKKKKPBD0ZZ
?Name@RpcServer@BusAccessManager@DsNRtosTasks@@3PBDB
?initMutex@DsNRtosAbstraction@@YAJPAPAXPBD@Z
?deleteMutex@DsNRtosAbstraction@@YAJPAPAX@Z
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
vcruntime140
__CxxFrameHandler3
_except_handler4_common
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
__telemetry_main_return_trigger
memcpy
__vcrt_InitializeCriticalSectionEx
__telemetry_main_invoke_trigger
api-ms-win-crt-heap-l1-1-0
_callnewh
realloc
free
malloc
_set_new_mode
api-ms-win-crt-string-l1-1-0
strncpy_s
strcpy_s
api-ms-win-crt-runtime-l1-1-0
terminate
_controlfp_s
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
exit
_c_exit
_initialize_narrow_environment
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
_except1
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ