NEAS[.]4fdd73af710ab9702d0f9136d7c76830[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4fdd73af710ab9702d0f9136d7c76830.exe
Size

1.1MB
MD5

4fdd73af710ab9702d0f9136d7c76830
SHA1

702c338a6ba5995b6a9e1f781131aae113ebbb2e
SHA256

f26d975adc9c78cbcdce66f805fb8f16a664f48a132c00ceebf4388cc75e3fb2
SHA512

f35d07a3acf99294ef75b70142b3457f990a3f4fc7146632f3a1bc9d78ea27b57d33ddaa9106c7e75f0256c4a4e3d24747499e86242522c0dcaf350dddeea948
SSDEEP

24576:NVMtWqoiawy8nJkjRRkD8LHgZSJ873h5UQ5+:NVMgkaiJkjLkD8LHHJ8zh5UQ5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4fdd73af710ab9702d0f9136d7c76830.exe

Files

NEAS.4fdd73af710ab9702d0f9136d7c76830.exe
.exe windows:6 windows x86

213855c1afe1a9636c3c70cb223546d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

advapi32

RegCreateKeyExW
RegQueryInfoKeyW
RegEnumValueW
EventUnregister
GetSecurityDescriptorDacl
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegDeleteValueW
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
SetNamedSecurityInfoW
ConvertSidToStringSidA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetUserNameA
RegEnumKeyExA
RegEnumValueA
RegQueryInfoKeyA
DeregisterEventSource
RegisterEventSourceW
ReportEventA
ReportEventW
OpenProcessToken
AddAccessAllowedAce
AddAccessDeniedAce
AllocateAndInitializeSid
CheckTokenMembership
CopySid
CreateWellKnownSid
EqualSid
FreeSid
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
IsValidSid
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
RegOpenKeyExW
EventWrite
RegEnumKeyW
RegGetValueW
EventRegister

comctl32

ord17
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create

cabinet

ord22
ord23
ord10
ord21
ord11
ord13
ord12
ord14
ord20

gdi32

CreateFontIndirectW
GetTextFaceA
CreateFontIndirectA
CreateFontA
DeleteDC
DeleteObject
GetDeviceCaps
GetTextExtentPoint32W
RestoreDC
SaveDC
SelectObject
SetBkMode
SetMapMode
SetTextColor
SetTextAlign
GetTextMetricsA
GetObjectA
GetObjectW
ExtTextOutW

kernel32

GetShortPathNameA
GetLastError
EnterCriticalSection
LeaveCriticalSection
GetLocalTime
GetCommandLineW
DeleteFileW
CloseHandle
SetUnhandledExceptionFilter
SetErrorMode
ReleaseMutex
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateThread
GetModuleHandleA
GetProcAddress
SetProcessWorkingSetSize
WaitForMultipleObjects
MapViewOfFile
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
GetVersionExW
FreeLibrary
GetModuleFileNameW
MultiByteToWideChar
FindClose
FindFirstFileW
FindNextFileW
WriteFile
SetLastError
GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW
LocalFree
MoveFileW
GetDateFormatW
GetTimeFormatW
GetFileSize
ReadFile
SetFilePointer
RaiseException
ExitThread
SuspendThread
SetPriorityClass
GetTickCount64
UnmapViewOfFile
CreateFileMappingA
GetComputerNameA
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExA
MulDiv
GetACP
GetSystemDefaultUILanguage
GetSystemDefaultLangID
GetSystemDefaultLCID
SetEnvironmentVariableA
ExpandEnvironmentStringsW
CreateDirectoryW
GetFileAttributesW
SetEndOfFile
GetTempPathW
SetEvent
CreateRemoteThread
SetThreadPriority
CreateProcessW
OpenProcess
GetSystemInfo
IsWow64Process
VirtualQueryEx
ReadProcessMemory
WideCharToMultiByte
IsDBCSLeadByte
GetStringTypeExW
IsValidCodePage
CreateFileA
CreateFileW
GetFileType
CreateMutexA
CreateEventA
OpenEventA
OpenMutexA
CreateSemaphoreA
OpenSemaphoreA
HeapAlloc
HeapFree
GlobalFree
LocalAlloc
GetCurrentThread
GlobalAlloc
GetLocaleInfoEx
InitializeCriticalSectionEx
GetCurrentThreadId
LocaleNameToLCID
GetUserDefaultLocaleName
IsValidLocale
CompareStringW
GetUserDefaultLCID
CompareStringEx
LCIDToLocaleName
GetSystemDefaultLocaleName
EnumSystemLocalesEx
GetDateFormatEx
GetCalendarInfoEx
GetThreadUILanguage
LoadResource
SetFileAttributesW
RaiseFailFastException
OutputDebugStringA
GetVersion
LoadLibraryW
WaitForSingleObjectEx
GetDiskFreeSpaceExW
GetFileAttributesExW
GlobalMemoryStatusEx
GetSystemDirectoryW
GetNativeSystemInfo
GetProductInfo
GetTimeZoneInformation
GetUserGeoID
GetUserDefaultUILanguage
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
RtlUnwind
HeapReAlloc
HeapSize
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCPInfo
GetOEMCP
IsProcessorFeaturePresent
LCMapStringW
GetStringTypeW
InterlockedExchange
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLongPathNameW
GetShortPathNameW
lstrcmpiW
FindResourceW
SizeofResource
LoadLibraryExW
LoadLibraryA
RtlCaptureStackBackTrace
GetUserDefaultLangID
GetSystemDirectoryA

ole32

CoCreateGuid
CoUninitialize
CoInitializeEx
CoCreateInstance
StringFromIID
CoTaskMemFree

oleacc

CreateStdAccessibleObject
LresultFromObject

oleaut32

SysStringLen
SystemTimeToVariantTime
VariantTimeToDosDateTime
SysAllocString
SysFreeString

Sections

.text
Size: 473KB - Virtual size: 473KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 300KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 350KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

213855c1afe1a9636c3c70cb223546d6

Headers

DLL Characteristics

File Characteristics

Imports

version

wintrust

advapi32

comctl32

cabinet

gdi32

kernel32

ole32

oleacc

oleaut32

Sections

.text Size: 473KB - Virtual size: 473KB

.data Size: 300KB - Virtual size: 304KB

.rsrc Size: 15KB - Virtual size: 14KB

.reloc Size: 350KB - Virtual size: 352KB

.text
Size: 473KB - Virtual size: 473KB

.data
Size: 300KB - Virtual size: 304KB

.rsrc
Size: 15KB - Virtual size: 14KB

.reloc
Size: 350KB - Virtual size: 352KB