NEAS[.]488f85fe53abe90a9c59263a55cff760[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.488f85fe53abe90a9c59263a55cff760.exe
Size

92KB
MD5

488f85fe53abe90a9c59263a55cff760
SHA1

2bd3574f067d744fb550f15db311bbe8392f61dc
SHA256

1a021a626782798f7c588945de98e22e1db095fa1ea5717487d33f36fd40a4e3
SHA512

0acaa895f18f0d6c5671bce46f17898853516aa84cc3486dc5d822866b1bf492eafda64f03429a4b18928e8d2042ad2d1d6fe7c429ea29ba38857a225d252026
SSDEEP

1536:NMnqboNWms9MiwjtPh1Ow7mjcVVLdnH2+8JwcFmK7v49604:NMnqbowBwtZ1OwyOVlWJJpmKjo6l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.488f85fe53abe90a9c59263a55cff760.exe

Files

NEAS.488f85fe53abe90a9c59263a55cff760.exe
.dll windows:4 windows x86

2c1a483c3c1dcf0d77e30bec401a94b9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsGetValue
GetLastError
TlsSetValue
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
TlsFree
CreateMutexA
CloseHandle
ReleaseMutex
WaitForSingleObject
GetSystemDirectoryA
LoadLibraryA
FormatMessageA
GetProcAddress
FreeLibrary

msvcrt

_vsnprintf
sprintf
strlen
strerror
strncpy
strcpy
_strdup
malloc
_errno
_assert
abort
free
strchr
strcmp
strtoul
strcat
realloc
calloc
_stat

ws2_32

gethostbyname
gethostbyaddr
getservbyport
ntohs
inet_addr
htons
getservbyname
htonl
inet_ntoa
WSASetLastError
WSAGetLastError

Exports

Exports

krb5int_clear_error
krb5int_close_plugin
krb5int_close_plugin_dirs
krb5int_free_error
krb5int_free_plugin_dir_data
krb5int_free_plugin_dir_func
krb5int_freeaddrinfo
krb5int_gai_strerror
krb5int_get_error
krb5int_get_plugin_data
krb5int_get_plugin_dir_data
krb5int_get_plugin_dir_func
krb5int_get_plugin_func
krb5int_getaddrinfo
krb5int_getnameinfo
krb5int_getspecific
krb5int_gmt_mktime
krb5int_in6addr_any
krb5int_key_delete
krb5int_key_register
krb5int_mutex_alloc
krb5int_mutex_free
krb5int_mutex_lock
krb5int_mutex_lock_update_stats
krb5int_mutex_report_stats
krb5int_mutex_unlock
krb5int_mutex_unlock_update_stats
krb5int_open_plugin
krb5int_open_plugin_dirs
krb5int_pthread_loaded
krb5int_set_error
krb5int_set_error_info_callout_fn
krb5int_setspecific
krb5int_vset_error

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2c1a483c3c1dcf0d77e30bec401a94b9

Headers

File Characteristics

Imports

kernel32

msvcrt

ws2_32

Exports

Exports

Sections

.text Size: 12KB - Virtual size: 10KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 992B

.rmnet Size: 60KB - Virtual size: 60KB

.text
Size: 12KB - Virtual size: 10KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 992B

.rmnet
Size: 60KB - Virtual size: 60KB