NEAS[.]6730e7857204738f099b0febbe5ddfb0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6730e7857204738f099b0febbe5ddfb0.exe
Size

88KB
MD5

6730e7857204738f099b0febbe5ddfb0
SHA1

ef7d5c88006d64b5b6335cd582c3cb916c8fe37a
SHA256

ba90dfaaddacdc0fcdbadb14d5b4180b1c3438ae0bc19bb4dcdeb3e515f8c848
SHA512

40df7dea07e130130c7eed8478317c91c6f675a860bcb50204c60a188349eece3ea80cd9e4a358082cdf0679a11c5eb6ddfc288c2913f69e725d2eb9a143ab7a
SSDEEP

1536:0eV05qP7cAkhcC+8lTeZikKlZdGezl9IZ:0eVz7cz+R8p3dVzl9IZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6730e7857204738f099b0febbe5ddfb0.exe

Files

NEAS.6730e7857204738f099b0febbe5ddfb0.exe
.dll windows:4 windows x86

58bd2ce459cd8417863c8702ecdcfbf6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

WSAGetLastError
closesocket
ioctlsocket
getsockopt
sendto
send
recvfrom
recv
gethostbyname
inet_ntoa
WSACleanup
WSAStartup
socket
setsockopt
inet_addr
htons
connect
select
__WSAFDIsSet

kernel32

IsBadWritePtr
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CloseHandle
CreateThread
CreateEventA
TerminateThread
GetExitCodeThread
SetEvent
HeapAlloc
HeapFree
RtlUnwind
GetCommandLineA
GetVersion
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
GetProcAddress
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
InterlockedDecrement
InterlockedIncrement
SetFilePointer
SetUnhandledExceptionFilter
IsBadReadPtr

Exports

Exports

TFC_CheckRemoteUser
TFC_ConnectServer
TFC_DisconnectServer
TFC_FILE_CloseHandle
TFC_FILE_CopyFile
TFC_FILE_CreateFile
TFC_FILE_Download
TFC_FILE_GetFileSize
TFC_FILE_ReadFile
TFC_FILE_SetFilePointer
TFC_FILE_WriteFile
TFC_GetServerBackupDvr
TFC_GetServerDvrDate
TFC_GetServerLogicalDrives
TFC_GetVersion
TFC_IsConnected
TFC_SeekServerCommonFiles
TFC_SeekServerDvrFiles

Sections

.text
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

58bd2ce459cd8417863c8702ecdcfbf6

Headers

File Characteristics

Imports

ws2_32

kernel32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 45KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 16KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 944B

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 48KB - Virtual size: 45KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 944B

.reloc
Size: 8KB - Virtual size: 4KB