012309a58dd2e8ae888f3205c5de3400_NEAS

Sharing

Copy URL

Twitter E-mail

General

Target

012309a58dd2e8ae888f3205c5de3400_NEAS
Size

149KB
MD5

012309a58dd2e8ae888f3205c5de3400
SHA1

c5e60d33932729b9ba926b6e29e5d78415f04aa6
SHA256

f6a727cd2d213b91837349fbf602cb617aa946ff2a058b1d1926e177e931adfe
SHA512

f080c9a4c9da9cea243a1f35a5cd68d5814e3d631e257a743f5c50cb2f93493e69af930db664f6dbd5894a97b517c5587856457864627e7fb1c37ccabd2e17d7
SSDEEP

3072:7rHB/FKLITQwmUaBlGIf13Qf8T4QYiDkf:ppMwmhKK13Z4f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
012309a58dd2e8ae888f3205c5de3400_NEAS

Files

012309a58dd2e8ae888f3205c5de3400_NEAS
.exe windows:6 windows x64 arch:x64

71d294f29696546d36533c34df325b5f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

llama

ggml_scale
ggml_argsort
ggml_mul_mat_id
ggml_mul_mat
ggml_timestep_embedding
ggml_rms_norm
ggml_norm
ggml_leaky_relu
ggml_cpy
ggml_concat
ggml_pad
ggml_upscale
ggml_cont
ggml_view_2d
ggml_permute
ggml_format_name
ggml_dup
ggml_add
ggml_acc
ggml_mul
ggml_div
ggml_sqr
ggml_sum_rows
ggml_time_us
ggml_backend_compare_graph_backend
ggml_pool_2d
ggml_im2col
ggml_clamp
ggml_backend_reg_init_backend
ggml_backend_reg_get_name
ggml_backend_reg_get_count
ggml_backend_is_cpu
ggml_backend_cpu_init
ggml_backend_supports_op
ggml_backend_graph_compute
ggml_backend_synchronize
ggml_backend_tensor_get
ggml_backend_tensor_set
ggml_backend_free
ggml_backend_name
ggml_backend_buffer_free
ggml_backend_alloc_ctx_tensors
ggml_internal_get_type_traits
ggml_quantize_chunk
ggml_quantize_requires_imatrix
ggml_quantize_free
ggml_graph_overhead_custom
ggml_graph_overhead
ggml_new_graph_custom
ggml_rope
ggml_soft_max_ext
ggml_new_graph
ggml_diag_mask_inf
ggml_build_forward_expand
ggml_unary
ggml_repeat
ggml_arange
ggml_get_rows
ggml_group_norm
ggml_transpose
ggml_get_next_tensor
ggml_get_first_tensor
ggml_new_tensor_4d
ggml_new_tensor_3d
ggml_new_tensor_2d
ggml_new_tensor_1d
ggml_new_tensor
ggml_free
ggml_init
ggml_tensor_overhead
ggml_is_quantized
ggml_op_desc
ggml_type_name
ggml_row_size
ggml_blck_size
ggml_nbytes
ggml_nrows
ggml_nelements
ggml_print_backtrace
ggml_fp16_to_fp32

msvcp140

?_Random_device@std@@YAIXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_hardware_concurrency
_Thrd_join
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__current_exception
__C_specific_handler
memset
memmove
memcpy
memcmp
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_purecall
__current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_beginthreadex
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
abort
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
exit
terminate
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
fflush
__stdio_common_vsprintf_s
__stdio_common_vsprintf
__stdio_common_vfprintf
_set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdsign

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_set_new_mode
free

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

71d294f29696546d36533c34df325b5f

Headers

DLL Characteristics

File Characteristics

Imports

llama

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Sections

.text Size: 117KB - Virtual size: 116KB

.rdata Size: 24KB - Virtual size: 24KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1024B - Virtual size: 644B

.text
Size: 117KB - Virtual size: 116KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1024B - Virtual size: 644B