NEAS[.]4c8787e55e3f6ef67607ec21634f9a80[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4c8787e55e3f6ef67607ec21634f9a80.exe
Size

747KB
MD5

4c8787e55e3f6ef67607ec21634f9a80
SHA1

5738e3c253185c9fb63c939212dce0af4baad0a1
SHA256

21ee4a7d00e6ec53a1310843d7da39a4de93e7af27a1dd324bc28094f7f34c7f
SHA512

ba0ecac861bba3f08a33f1f2d6b5f3bef1ea1ce78a569c4d93d76783a30f0e2d18480b51908d525dfaa1438bd88ce23deeb065f1f39c74874e35d45631fa37c4
SSDEEP

12288:7IWoJbXFRFiDts+QLKHppvG8b0rZA+JIZM6ie8ohMAxFC:ENJbXFRFMts+QLKHXn0rZaLie8vAb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4c8787e55e3f6ef67607ec21634f9a80.exe

Files

NEAS.4c8787e55e3f6ef67607ec21634f9a80.exe
.dll windows:6 windows x86

7910e63895ff57c982c97daed8e107e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameW
CreateFileW
SetFilePointerEx
CloseHandle
GetModuleHandleW
OpenThread
GetPrivateProfileStringA
RemoveVectoredExceptionHandler
Thread32Next
Thread32First
GetCurrentThreadId
CreateToolhelp32Snapshot
AddVectoredExceptionHandler
GetThreadContext
GetCurrentProcessId
SetThreadContext
DecodePointer
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
HeapReAlloc
HeapSize
SetStdHandle
GetStringTypeW
GetProcessHeap
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW

ntdll

RtlNtStatusToDosError
NtWriteVirtualMemory
NtFlushInstructionCache
RtlCompareMemory
NtOpenFile
NtMapViewOfSection
NtUnmapViewOfSection
NtProtectVirtualMemory
RtlInitUnicodeStringEx
NtClose
RtlSetLastWin32Error
LdrLoadDll
RtlInitAnsiStringEx
LdrGetDllHandle
RtlEncodeSystemPointer
NtCreateSection
NtQueryVirtualMemory
LdrGetProcedureAddress
RtlImageDirectoryEntryToData
RtlAnsiStringToUnicodeString
RtlGetNtVersionNumbers
RtlImageNtHeader

Sections

.text
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tp0
Size: 648KB - Virtual size: 648KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 233B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7910e63895ff57c982c97daed8e107e9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ntdll

Sections

.text Size: 63KB - Virtual size: 63KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 2KB - Virtual size: 5KB

.tp0 Size: 648KB - Virtual size: 648KB

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 233B

.text
Size: 63KB - Virtual size: 63KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 5KB

.tp0
Size: 648KB - Virtual size: 648KB

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 233B