Static task
static1
Behavioral task
behavioral1
Sample
3969d474d2da65c6a3ae97cd34373ad0_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3969d474d2da65c6a3ae97cd34373ad0_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
3969d474d2da65c6a3ae97cd34373ad0_NEAS
-
Size
544KB
-
MD5
3969d474d2da65c6a3ae97cd34373ad0
-
SHA1
8a095737e5c1da661262b4dac5c5b9e200e10814
-
SHA256
ba88e280cac1325f44e530366d7c6d3a7816680e82a0d4646e29238cac0fd402
-
SHA512
4fb9d7c7d6e0d8d87336604b7c04d4e1b3e4cd1e0c4c3bbc8d75918b38d6f5f90d48d7335a755b5456a1b6a509a9614ce7aeafd2c1a3eb1bda0469b7698efee4
-
SSDEEP
12288:lr4DwpRrKO1YYVhiiNdvradYm5MP/idUuYPs4vd8U4Nw4xEd:lrSO1YNWdvCzMPqdUD6dNwB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3969d474d2da65c6a3ae97cd34373ad0_NEAS
Files
-
3969d474d2da65c6a3ae97cd34373ad0_NEAS.exe windows:4 windows x86 arch:x86
1d8a37f2c80392d743f9173bfa9c98c9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
SetLocalTime
VirtualFree
DeleteFileA
GetPrivateProfileStringA
LoadLibraryA
CreateProcessA
HeapFree
LoadLibraryExW
WaitForSingleObject
InterlockedDecrement
CopyFileA
FindNextFileA
GetProcAddress
FindResourceExW
ReadConsoleA
GetShortPathNameA
HeapCreate
IsBadWritePtr
GetFileAttributesA
dsprop
FindSheet
CrackName
CheckADsError
ErrMsg
wtsapi32
WTSSendMessageW
WTSEnumerateServersW
WTSFreeMemory
WTSVirtualChannelOpen
WTSVirtualChannelClose
WTSSetUserConfigW
WTSUnRegisterSessionNotification
WTSDisconnectSession
WTSWaitSystemEvent
WTSVirtualChannelRead
shlwapi
UrlIsNoHistoryW
UrlCreateFromPathW
UrlUnescapeA
PathCompactPathW
PathCommonPrefixW
UrlGetLocationW
UrlIsA
UrlCanonicalizeW
UrlUnescapeA
UrlHashW
PathIsRootW
UrlCompareW
crypt32
CertDeleteCRLFromStore
CertDuplicateCRLContext
CertFindAttribute
CertFindCRLInStore
CertFindRDNAttr
CertNameToStrW
CertFreeCertificateChain
CertCloseStore
CertCompareCertificate
CryptFindOIDInfo
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 211B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 188KB - Virtual size: 187KB
IMAGE_SCN_MEM_READ