NEAS[.]1ad3b221f81005a5d1c0c8d921730510[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1ad3b221f81005a5d1c0c8d921730510.exe
Size

309KB
MD5

1ad3b221f81005a5d1c0c8d921730510
SHA1

f7dd23476b1b5ad2e828b431c2062bb848e5ab70
SHA256

393627cbcd4de24e40b7ac383beb772699507daa1a597a405d7dec05a0a125c8
SHA512

5cbb845263dcaa87ff08c437523633be7a5c7b2f2d194ceb0e2b22159804babb466652ddf8d357b9f99a7142f0c05a2ecbf63c80fdc367e7421fd97b1c4245f5
SSDEEP

3072:PrrNoRC8f/TKWQUVxWgfy7O6TDp++nX/fIvuC50HNXqqD+78KO4ZFOIL21kSYwhz:fNACi/ljmjvcuCqxlY5JLvGqCt17

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1ad3b221f81005a5d1c0c8d921730510.exe

Files

NEAS.1ad3b221f81005a5d1c0c8d921730510.exe
.dll windows:6 windows x86

a54e2180093e4b5d643a442c8cfea6fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_isatty
_write
_lseeki64
_fileno
__pioinfo
__badioinfo
wctomb
_itoa
_snprintf
isleadbyte
_ismbblead
_amsg_exit
_initterm
free
malloc
_XcptFilter
_iob
_errno
tolower
isspace
getenv
atoi
_stricmp
_strnicmp
strstr
memcpy
memset
strchr
strncmp
_strcmpi

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
WaitForSingleObject
TerminateProcess
GetCurrentProcess
DuplicateHandle
GetPriorityClass
CreateProcessA
CreateThread
SetFilePointer
GetCurrentProcessId
CreateNamedPipeA
CreateFileA
CreateEventA
ReadFile
WriteFile
WaitForMultipleObjects
GetOverlappedResult
CloseHandle
GetCurrentDirectoryA
MultiByteToWideChar
WideCharToMultiByte
LocalFree
LocalReAlloc
LocalAlloc
RemoveDirectoryA
GetFileAttributesA
CreateDirectoryA
GetLastError
OutputDebugStringA
DebugBreak
SetEnvironmentVariableA
SetLastError
SetCurrentDirectoryA
GetEnvironmentVariableA
DeleteFileA
CopyFileA
GetPrivateProfileSectionA
GetModuleFileNameA

advapi32

RegCreateKeyA
RegSetValueA
RegCloseKey
RegQueryValueA

Exports

Exports

SrcSrvCleanup
SrcSrvEnumTokens
SrcSrvExecToken
SrcSrvExecTokenA
SrcSrvExecTokenW
SrcSrvGetFile
SrcSrvGetFileA
SrcSrvGetFileW
SrcSrvGetOptions
SrcSrvGetToken
SrcSrvGetTokenA
SrcSrvGetTokenW
SrcSrvInit
SrcSrvInitA
SrcSrvInitW
SrcSrvIsModuleLoaded
SrcSrvLoadModule
SrcSrvLoadModuleA
SrcSrvLoadModuleW
SrcSrvRegisterCallback
SrcSrvResolveTokenVar
SrcSrvResolveTokenVarA
SrcSrvResolveTokenVarW
SrcSrvSetOptions
SrcSrvSetParentWindow
SrcSrvSetTargetPath
SrcSrvSetTargetPathA
SrcSrvSetTargetPathW
SrcSrvUnloadModule

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a54e2180093e4b5d643a442c8cfea6fd

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

advapi32

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 42KB

.data Size: 30KB - Virtual size: 173KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 228KB - Virtual size: 228KB

.text
Size: 43KB - Virtual size: 42KB

.data
Size: 30KB - Virtual size: 173KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 228KB - Virtual size: 228KB