Static task
static1
Behavioral task
behavioral1
Sample
d03b8ccb0f0914d50a525f2ee202de80_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d03b8ccb0f0914d50a525f2ee202de80_NEAS.exe
Resource
win10v2004-20240426-en
General
-
Target
d03b8ccb0f0914d50a525f2ee202de80_NEAS
-
Size
473KB
-
MD5
d03b8ccb0f0914d50a525f2ee202de80
-
SHA1
34ae25dcb1242638f07c244560db5b67bdb9186d
-
SHA256
48f10afd4d6caf31f72c286b0b7f11de5b89b145ce212786c40884ef28e7535c
-
SHA512
832c7bb05132db9c559fa49b0d8a1f4e384e7133ed4e5d1e14352f65a82bec3228c386910a0240caa8497f8e549bd345567a6e041a11fc03cdfb1cab6a852802
-
SSDEEP
6144:KOFeXqSR90sO1JmUV1alfYi6e5mdss9qmFkIX/P3lD2w8jqnilGrs/b4zeAx:zFeXqSR9HeJ9V8lfuOs9HMex
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d03b8ccb0f0914d50a525f2ee202de80_NEAS
Files
-
d03b8ccb0f0914d50a525f2ee202de80_NEAS.exe windows:5 windows x86 arch:x86
8fc193de7324ac2f1169e4acd37738a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
WriteFile
GetCurrentThreadId
GetCurrentProcess
GetLastError
ExitProcess
GetProcAddress
HeapFree
GetCommandLineA
HeapAlloc
GetProcessHeap
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
InterlockedIncrement
InterlockedDecrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
MultiByteToWideChar
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
Sleep
GetStringTypeW
LCMapStringW
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
RtlUnwind
HeapReAlloc
HeapSize
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW
Sections
.text Size: 301KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ