NEAS[.]20cea48e2e61c277f018afcb139fc7e0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.20cea48e2e61c277f018afcb139fc7e0.exe
Size

743KB
MD5

20cea48e2e61c277f018afcb139fc7e0
SHA1

30846ada08cc8f00923fce82be71f64485afd9b2
SHA256

52b2c539c69e5010b3dccde3641ce21dc48ca3ee9828624766a94a59f63a4525
SHA512

0da2a5ee0e388ff3232f7fc094f6c99c71b4296ff6d7371a9fbc9d5dd0757235f4d7c2dc55cdc735d3edbf4245ceef1901eb45ab9f97359f7226fbe7f48a0174
SSDEEP

12288:UR3Nwi7uvdiry8iu7zGnMeEtdoafeSdhMJt3QU9M/Du02C/Tlk6sJEcjEfGPAfIN:UR3Wru7e4gafeSRDJwrNA2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.20cea48e2e61c277f018afcb139fc7e0.exe

Files

NEAS.20cea48e2e61c277f018afcb139fc7e0.exe
.dll regsvr32 windows:5 windows x86

207a1ae03022ef0c0445434e37a382f1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mpr

WNetGetConnectionW
WNetCancelConnection2W
WNetUseConnectionW

winmm

timeGetTime

comctl32

ord17

userenv

LoadUserProfileW
CreateEnvironmentBlock
UnloadUserProfile
DestroyEnvironmentBlock

kernel32

CreatePipe
CreateFileW
FreeLibrary
GetProcAddress
GetModuleHandleW
lstrcmpiW
RaiseException
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
DecodePointer
GetThreadLocale
SetThreadLocale
EncodePointer
Sleep
GetCurrentThreadId
GetVersionExW
IsWow64Process
GetSystemInfo
LoadLibraryA
GlobalLock
GlobalUnlock
GlobalAlloc
OpenProcess
TerminateProcess
GetSystemDirectoryW
GetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
SetPriorityClass
QueryPerformanceCounter
VirtualFreeEx
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
CreateToolhelp32Snapshot
Process32FirstW
GetStdHandle
SetSystemPowerState
QueryPerformanceFrequency
OutputDebugStringW
WideCharToMultiByte
SetStdHandle
RtlUnwind
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapReAlloc
HeapSize
GetModuleHandleExW
ExitProcess
SetLastError
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetCommandLineA
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
IsDebuggerPresent
WriteFile
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
HeapFree
GetProcessHeap
HeapAlloc
WaitForSingleObject
CreateThread
DuplicateHandle
GetCurrentProcess
GetCurrentThread
CloseHandle
GetLastError
CompareStringW
GetFileType
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleFileNameA
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
Process32NextW
WriteConsoleW

user32

OpenClipboard
DestroyWindow
EnumWindows
GetDesktopWindow
IsWindow
IsClipboardFormatAvailable
IsWindowEnabled
IsWindowVisible
ShowWindow
EmptyClipboard
MoveWindow
InvalidateRect
GetClipboardData
CloseClipboard
GetForegroundWindow
CountClipboardFormats
GetUserObjectSecurity
OpenWindowStationW
GetProcessWindowStation
SetProcessWindowStation
OpenDesktopW
CloseWindowStation
SetClipboardData
GetDC
ReleaseDC
GetCursorPos
mouse_event
LoadCursorW
WindowFromPoint
GetCursor
ClientToScreen
SetWindowPos
VkKeyScanW
GetMenu
GetMenuItemCount
GetMenuStringW
GetMenuItemID
GetSubMenu
GetClientRect
IsIconic
IsZoomed
CreateWindowExW
MonitorFromPoint
GetMonitorInfoW
CopyRect
FindWindowW
SetWindowLongW
SetLayeredWindowAttributes
ExitWindowsEx
SetForegroundWindow
SystemParametersInfoW
keybd_event
SendInput
GetAsyncKeyState
SetKeyboardState
GetKeyboardState
GetKeyState
EnableWindow
GetWindowLongW
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetWindowTextW
ScreenToClient
SendMessageTimeoutW
EnumChildWindows
RegisterWindowMessageW
GetClassNameW
GetParent
GetDlgCtrlID
SendMessageW
MapVirtualKeyW
PostMessageW
GetWindowRect
SetFocus
CharNextW
CharUpperBuffW
SetUserObjectSecurity
CloseDesktop
GetCaretPos

gdi32

GetDIBits
GetPixel
DeleteDC
StretchBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject

advapi32

CopySid
InitiateSystemShutdownExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
InitializeSecurityDescriptor
InitializeAcl
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
DuplicateTokenEx
CreateProcessAsUserW
CreateProcessWithLogonW
GetLengthSid
LogonUserW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
GetSecurityDescriptorDacl
GetAclInformation
GetAce
AddAce
SetSecurityDescriptorDacl

shell32

DragQueryFileW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemFree

oleaut32

SafeArrayDestroyDescriptor
VariantClear
VariantCopy
SysAllocString
SafeArrayAllocDescriptorEx
SafeArrayAllocData
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroyData
VarUI4FromStr
RegisterTypeLi
SysStringLen
SysFreeString
BSTR_UserFree
VARIANT_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserSize
BSTR_UserSize
VARIANT_UserMarshal
LoadRegTypeLi
UnRegisterTypeLi
LoadTypeLi
VariantInit

rpcrt4

NdrOleFree
NdrStubForwardingFunction
NdrOleAllocate
NdrDllRegisterProxy
NdrDllCanUnloadNow
NdrStubCall2
IUnknown_Release_Proxy
NdrCStdStubBuffer2_Release
IUnknown_AddRef_Proxy
NdrDllGetClassObject
NdrDllUnregisterProxy
IUnknown_QueryInterface_Proxy

Exports

Exports

AU3_AutoItSetOption
AU3_ClipGet
AU3_ClipPut
AU3_ControlClick
AU3_ControlClickByHandle
AU3_ControlCommand
AU3_ControlCommandByHandle
AU3_ControlDisable
AU3_ControlDisableByHandle
AU3_ControlEnable
AU3_ControlEnableByHandle
AU3_ControlFocus
AU3_ControlFocusByHandle
AU3_ControlGetFocus
AU3_ControlGetFocusByHandle
AU3_ControlGetHandle
AU3_ControlGetHandleAsText
AU3_ControlGetPos
AU3_ControlGetPosByHandle
AU3_ControlGetText
AU3_ControlGetTextByHandle
AU3_ControlHide
AU3_ControlHideByHandle
AU3_ControlListView
AU3_ControlListViewByHandle
AU3_ControlMove
AU3_ControlMoveByHandle
AU3_ControlSend
AU3_ControlSendByHandle
AU3_ControlSetText
AU3_ControlSetTextByHandle
AU3_ControlShow
AU3_ControlShowByHandle
AU3_ControlTreeView
AU3_ControlTreeViewByHandle
AU3_DriveMapAdd
AU3_DriveMapDel
AU3_DriveMapGet
AU3_Init
AU3_IsAdmin
AU3_MouseClick
AU3_MouseClickDrag
AU3_MouseDown
AU3_MouseGetCursor
AU3_MouseGetPos
AU3_MouseMove
AU3_MouseUp
AU3_MouseWheel
AU3_Opt
AU3_PixelChecksum
AU3_PixelGetColor
AU3_PixelSearch
AU3_ProcessClose
AU3_ProcessExists
AU3_ProcessSetPriority
AU3_ProcessWait
AU3_ProcessWaitClose
AU3_Run
AU3_RunAs
AU3_RunAsWait
AU3_RunWait
AU3_Send
AU3_Shutdown
AU3_Sleep
AU3_StatusbarGetText
AU3_StatusbarGetTextByHandle
AU3_ToolTip
AU3_WinActivate
AU3_WinActivateByHandle
AU3_WinActive
AU3_WinActiveByHandle
AU3_WinClose
AU3_WinCloseByHandle
AU3_WinExists
AU3_WinExistsByHandle
AU3_WinGetCaretPos
AU3_WinGetClassList
AU3_WinGetClassListByHandle
AU3_WinGetClientSize
AU3_WinGetClientSizeByHandle
AU3_WinGetHandle
AU3_WinGetHandleAsText
AU3_WinGetPos
AU3_WinGetPosByHandle
AU3_WinGetProcess
AU3_WinGetProcessByHandle
AU3_WinGetState
AU3_WinGetStateByHandle
AU3_WinGetText
AU3_WinGetTextByHandle
AU3_WinGetTitle
AU3_WinGetTitleByHandle
AU3_WinKill
AU3_WinKillByHandle
AU3_WinMenuSelectItem
AU3_WinMenuSelectItemByHandle
AU3_WinMinimizeAll
AU3_WinMinimizeAllUndo
AU3_WinMove
AU3_WinMoveByHandle
AU3_WinSetOnTop
AU3_WinSetOnTopByHandle
AU3_WinSetState
AU3_WinSetStateByHandle
AU3_WinSetTitle
AU3_WinSetTitleByHandle
AU3_WinSetTrans
AU3_WinSetTransByHandle
AU3_WinWait
AU3_WinWaitActive
AU3_WinWaitActiveByHandle
AU3_WinWaitByHandle
AU3_WinWaitClose
AU3_WinWaitCloseByHandle
AU3_WinWaitNotActive
AU3_WinWaitNotActiveByHandle
AU3_error
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

207a1ae03022ef0c0445434e37a382f1

Headers

File Characteristics

Imports

mpr

winmm

comctl32

userenv

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

rpcrt4

Exports

Exports

Sections

.text Size: 264KB - Virtual size: 264KB

.orpc Size: 512B - Virtual size: 52B

.rdata Size: 142KB - Virtual size: 141KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 308KB - Virtual size: 308KB

.text
Size: 264KB - Virtual size: 264KB

.orpc
Size: 512B - Virtual size: 52B

.rdata
Size: 142KB - Virtual size: 141KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 308KB - Virtual size: 308KB