NEAS[.]1db49c27d12b5f7fbcd041c2830c3860[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1db49c27d12b5f7fbcd041c2830c3860.exe
Size

84KB
MD5

1db49c27d12b5f7fbcd041c2830c3860
SHA1

cb911a533f4dfcaa5dffd9b6fc7744afe8aae145
SHA256

1fbb163fd23f3a25a3f0aa2b039252694306b719773b73d0bbed4c146761e52c
SHA512

774848cebd7f0e152eb32a0d3f8ad15b6d8d4c685173edb48dca7baad9a759855473ef2bb671260e6142e92f16199037deca6868fd9f266b0d6c333aacd91b30
SSDEEP

768:u3ncJu5hBXF2pmiq2V41xNmAFgGyi4XwP13GT9W28z/zMp5xAFiE3s:u3cJu5hBVWq2kN6LXwPVGT9lgA5gs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1db49c27d12b5f7fbcd041c2830c3860.exe

Files

NEAS.1db49c27d12b5f7fbcd041c2830c3860.exe
.exe windows:4 windows x86

af7bbc720f4103a2065171def931dc1a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord6374
ord4299
ord2379
ord4710
ord4287
ord4234
ord324
ord1168
ord1146
ord3597
ord4425
ord4627
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord5163
ord2385
ord5241
ord4407
ord1775
ord825
ord4078
ord6052
ord4998
ord5265
ord823
ord2514
ord641
ord561
ord815
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4673
ord1576

msvcrt

__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
_adjust_fdiv
_strdup
_mbscmp
_mbstok
memmove
srand
rand
wcscpy
_setmbcp
__p__commode
__p__fmode
__set_app_type
__dllonexit
exit
_mbsstr
_mbsrev
_mbsnbcpy
_mbsnbcat
_splitpath
swprintf
wcsrchr
wcscmp
_mbsnbicmp
_mbsicmp
_mbsupr
wcschr
_mbslwr
malloc
free
__CxxFrameHandler
_mbsrchr
sprintf
_access
_except_handler3
_vsnprintf
fopen
fprintf
_mbslen
fclose
_mbschr
_controlfp

kernel32

CreateFileA
GetCurrentProcessId
GetLocalTime
GetModuleHandleA
OutputDebugStringA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetModuleFileNameA
TerminateProcess
DuplicateHandle
GetCurrentProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcpynA
GetLastError
FormatMessageA
LocalFree
SetLastError
OpenProcess
WaitForSingleObject
CreateThread
GetCurrentThreadId
Sleep
GetProcessHeap
Process32Next
Process32First
LockResource
SizeofResource
LoadResource
FindResourceA
WriteFile
GetTempFileNameA
GetTempPathA
CreateFileMappingA
OpenFileMappingA
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
WideCharToMultiByte
GetStartupInfoA
WriteProcessMemory
GetProcAddress
LoadLibraryA
GetTickCount
SetUnhandledExceptionFilter
FreeLibrary
VirtualAllocEx
VirtualFreeEx
ReadProcessMemory
CreateProcessA
GetVersionExA
CreateMutexA
LoadLibraryExA
MapViewOfFile
UnmapViewOfFile
LocalAlloc
ResumeThread
GetWindowsDirectoryA
SetFileAttributesA
SetPriorityClass
GetShortPathNameA
GetEnvironmentVariableA
Module32First
CreateToolhelp32Snapshot
ExpandEnvironmentStringsA
HeapFree
CloseHandle
HeapAlloc

user32

EnableWindow
wsprintfA
PostMessageA
GetWindowThreadProcessId
SendMessageA
GetWindowLongA
SetWindowLongA
SetTimer
LoadIconA
ClientToScreen
FindWindowExA

advapi32

AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueA
GetTokenInformation
GetSecurityInfo
FreeSid
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
LookupAccountSidA
RegDeleteValueA
RegEnumKeyExA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetSecurityDescriptorDacl
GetLengthSid
InitializeSecurityDescriptor
SetSecurityInfo
OpenProcessToken
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SetEntriesInAclA

shell32

SHGetSpecialFolderPathW
SHGetDesktopFolder
SHGetDataFromIDListW
SHGetSpecialFolderLocation
ShellExecuteA
SHGetPathFromIDListA

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance

msvcp60

??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

dbghelp

MiniDumpWriteDump

wininet

DeleteUrlCacheEntry

shlwapi

PathUnquoteSpacesA
SHDeleteKeyA
PathRemoveArgsA

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af7bbc720f4103a2065171def931dc1a

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

advapi32

shell32

ole32

msvcp60

dbghelp

wininet

shlwapi

Sections

.text Size: 40KB - Virtual size: 39KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 8KB - Virtual size: 89KB

.rsrc Size: 20KB - Virtual size: 16KB

.text
Size: 40KB - Virtual size: 39KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 8KB - Virtual size: 89KB

.rsrc
Size: 20KB - Virtual size: 16KB