NEAS[.]6b154be039001a872154016460873b60[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6b154be039001a872154016460873b60.exe
Size

236KB
MD5

6b154be039001a872154016460873b60
SHA1

bb829799ad49533746d8332328bce8aeb0c9ef10
SHA256

54d4270709e0ba93566e7d3cba55d5fcf5f530fde59a1b37686f535996014f6c
SHA512

4840bcaca75c5cb63c44a32a308e26ec34af49a65d32aaaca34b02c9fad399bde4988453959f2825e824bf690b35b8e780f1f2dbbf3a104e3c22704aa573ac5e
SSDEEP

3072:QpFqx7EAEMI/3485HAWNj52Kjno/aZaYMqqDL1/N4J0EHv:BUb/3vHAZTqqDLRA0+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6b154be039001a872154016460873b60.exe

Files

NEAS.6b154be039001a872154016460873b60.exe
.dll windows:4 windows x86

e65622077a05170c18abbb9539404fe0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

timeGetTime

kernel32

GetCurrentProcess
FlushFileBuffers
MoveFileA
DeleteFileA
GetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
RtlUnwind
HeapAlloc
HeapSize
HeapFree
HeapReAlloc
GetFileType
CreateThread
ExitThread
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCommandLineA
RaiseException
GlobalDeleteAtom
MultiByteToWideChar
GetVersionExA
HeapDestroy
HeapCreate
IsBadWritePtr
SetStdHandle
SetHandleCount
GetStdHandle
GetStartupInfoA
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
IsBadReadPtr
IsBadCodePtr
SetEvent
CreateEventA
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentThreadId
WideCharToMultiByte
InterlockedIncrement
GetOEMCP
GetCPInfo
GlobalFlags
lstrcmpA
GetProcessVersion
SetLastError
LoadLibraryA
FreeLibrary
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GetProcAddress
GetModuleHandleA
PeekNamedPipe
VirtualFree
GetACP
lstrcpynA
GetVersion
GetFileInformationByHandle
lstrlenA
lstrcatA
GetModuleFileNameA
lstrcpyA
LocalReAlloc
SetErrorMode
InterlockedDecrement
GlobalLock
GlobalAlloc
GlobalReAlloc
GlobalFree
GlobalHandle
GlobalUnlock
LocalFree
LocalAlloc
CopyFileA
QueryPerformanceFrequency
ReadFile
SetFilePointer
SetEndOfFile
Sleep
QueryPerformanceCounter
GetLocalTime
TlsFree
TlsSetValue
TlsGetValue
ResumeThread
TlsAlloc
TerminateThread
CreateFileA
WriteFile
UnlockFileEx
CloseHandle
LockFileEx
WaitForSingleObject
ResetEvent
GetEnvironmentVariableA
ExitProcess
TerminateProcess
VirtualAlloc

user32

AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageA
LoadIconA
SetWindowTextA
IsWindowEnabled
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameA
PtInRect
ClientToScreen
LoadStringA
PostQuitMessage
DestroyMenu
TabbedTextOutA
DrawTextA
GrayStringA
CopyRect
EnableWindow
GetClientRect
GetTopWindow
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextA
GetDlgCtrlID
DefWindowProcA
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetParent
GetNextDlgTabItem
UnregisterClassA
UnhookWindowsHookEx
DispatchMessageA
SendMessageA
GetKeyState
MessageBoxA
CallNextHookEx
PeekMessageA
SetWindowsHookExA
GetWindowLongA

gdi32

SetBkColor
GetObjectA
SetTextColor
DeleteObject
DeleteDC
GetDeviceCaps
SaveDC
RestoreDC
GetStockObject
SelectObject
SetMapMode
SetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetWindowExtEx
ScaleWindowExtEx
CreateBitmap
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetClipBox

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

comctl32

ord17

Exports

Exports

AESCounterStream
AESCounterXOR
AESRegist
Bmg_ReAllocStrFromUUID
Bmv_AllocEmptyBIR
Bmv_FreeBIR
Bmv_FreeBIRHandle
Bmv_GetBIRFromHandle
Bmv_GetBIRPtr
Bmv_GetBioDataBytes
Bmv_GetCaptBioDataPtrs
Bmv_GetHandleFromBIR
Bmv_GetHeaderFromHandle
Bmv_IncAllocBioData
Bmv_InsertCaptImage2BioData
Bmv_MakeUUIDFromStr
Bmv_MoveDataAndMakeInsertSpace
Bmv_ReAllocCaptBioData
D_JpegToDib
GetEncryptParam
HVfree
HVmalloc
HVrealloc
LLCCompensation
LLCCompensation2
LLCError_ClearErrorInfo
LLCError_ClearErrorInfoCancel
LLCError_GetErrorInfo
LLCError_GetErrorInfoCancel
LLCError_Init
LLCError_RestoreErrorInfo
LLCError_SetErrorInfo
LLCError_SetErrorInfoExt
LLCError_Term
LLCGetBytesByStructInfo
LLCGetPtrsByStructInfo
LLCIsBigEndianSystem
LLCMAlloc
LLCMEMTRACE
LLCMEMTRACE_LOCK
LLCMEMTRACE_UNLOCK
LLCMakeBmp
LLCReAlloc
LLCSafeFree
LLCSaveAsBmpFile
LLCSetDataFromLittleEndian
LLCTRACE
LLCThrdStat_CreateCtrl
LLCThrdStat_ExecThrdEndCallBack
LLCThrdStat_FreeCtrl
LLCThrdStat_FreeThrdStatus
LLCThrdStat_GetThrdStatus
LLCThrdStat_SetThrdEndCallBack
LLCTraceLogFileClear
LLCTrace_ChangeFile
LLCTrace_Data
LLCTrace_Extend
LLCTrace_GetInfo
LLCTrace_GetIniInfoStatus
LLCTrace_Message
LLCTrace_Output
LLCTrace_Point
LLCTrace_PointData
LLCTrace_PointMessage
LLCTrace_PointText
LLCTrace_ResetErrorString
LLCTrace_ResetIniInfo
LLCTrace_SetAttachHandle
LLCTrace_SetErrorString
LLCTrace_SetIniInfo
LLCTrace_SetTraceInfo
LLCTrace_Text
LLC_CheckEvent
LLC_CloseHandle
LLC_CreateEvent
LLC_DeleteCriticalSection
LLC_DiffSecond
LLC_EnterCriticalSection
LLC_FileLockEnd
LLC_FileLockStart
LLC_GetFP
LLC_GetFPStatus
LLC_GetMilliSecond
LLC_GetPrivateProfileInt
LLC_GetPrivateProfileInt2
LLC_GetPrivateProfileString
LLC_GetPrivateProfileString2
LLC_GetTime
LLC_InitializeCriticalSection
LLC_LeaveCriticalSection
LLC_LoadPrivateProfile
LLC_LocalTime
LLC_MilliSleep
LLC_ResetEvent
LLC_SetCW_64
LLC_SetEvent
LLC_SetFP
LLC_Thread_Create
LLC_Thread_Create2
LLC_Thread_Resume
LLC_Thread_SetAutoDelete
LLC_Thread_Term
LLC_Thread_TermForce
LLC_Thread_Wait
LLC_UnLoadPrivateProfile
USBTamper_Decrypt
USBTamper_Encrypt

Sections

.text
Size: 140KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e65622077a05170c18abbb9539404fe0

Headers

File Characteristics

Imports

winmm

kernel32

user32

gdi32

winspool.drv

comctl32

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 137KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 40KB - Virtual size: 51KB

.rsrc Size: 12KB - Virtual size: 8KB

.reloc Size: 16KB - Virtual size: 14KB

.text
Size: 140KB - Virtual size: 137KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 40KB - Virtual size: 51KB

.rsrc
Size: 12KB - Virtual size: 8KB

.reloc
Size: 16KB - Virtual size: 14KB