NEAS[.]215b8897558318efb0a41f8649fa78f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NEAS.215b8897558318efb0a41f8649fa78f0.exe
Size 252KB
Sample231013-yscp5aha77
SHA256 0caae428d09ead56daed045408604f46bf5bb35128b98a6f22613ea65a1324f4
MD5 215b8897558318efb0a41f8649fa78f0
SHA1 58692712149be74ece498c33ade86d89cf0d590a
SHA512 88b1c146f13b0ca38b8f27407b220819f2ab57e5ce4e994dfb376444f5972bb4b27ed8abcb11b7cb7bf6984b23172a34ec89e9c975b881b5c8576157f5813ceb
SSDEEP 3072:kQcl4zhkLSypQ5vQC//HDA5cZj/LZpbZvGrqzVWBMQF6JI9pfzoI7h+aS1GZ:kQZH40Pp1vuqzCTfzo0naGZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.215b8897558318efb0a41f8649fa78f0.exe

File Explorer

NEAS.215b8897558318efb0a41f8649fa78f0.exe

.exe 252KB

NEAS.215b8897558318efb0a41f8649fa78f0.exe

IMPHASH 0ed3ab6fa6a9839eca54d888b1e38531
SHA256 0caae428d09ead56daed045408604f46bf5bb35128b98a6f22613ea65a1324f4
MD5 215b8897558318efb0a41f8649fa78f0
SHA1 58692712149be74ece498c33ade86d89cf0d590a
SHA512 88b1c146f13b0ca38b8f27407b220819f2ab57e5ce4e994dfb376444f5972bb4b27ed8abcb11b7cb7bf6984b23172a34ec89e9c975b881b5c8576157f5813ceb
SSDEEP 3072:kQcl4zhkLSypQ5vQC//HDA5cZj/LZpbZvGrqzVWBMQF6JI9pfzoI7h+aS1GZ:kQZH40Pp1vuqzCTfzo0naGZ
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42u

ord4418 ord3569 ord567 ord609 ord4270 ord3621 ord3658 ord755 ord2406 ord283 ord472 ord470 ord3397 ord4401 ord3605 ord656 ord6195 ord5261 ord4370 ord4847 ord4992 ord2506 ord6048 ord1767 ord5276 ord4419 ord3592 ord641 ord324 ord2294 ord4229 ord4470 ord3084 ord4704 ord2746 ord6107 ord4688 ord3579 ord543 ord803 ord6211 ord5949 ord2579 ord4400 ord3389 ord3724 ord804 ord616 ord6777 ord6193 ord2078 ord2372 ord3092 ord2403 ord2015 ord4213 ord2570 ord4392 ord3577 ord6168 ord5785 ord4279 ord5977 ord2371 ord5142 ord2092 ord6896 ord3312 ord6237 ord2505 ord293 ord2910 ord1165 ord3090 ord5947 ord2634 ord2854 ord3365 ord2574 ord4396 ord3635 ord693 ord384 ord686 ord4238 ord3288 ord6892 ord2857 ord3993 ord2088 ord2859 ord3905 ord4621 ord795 ord5871 ord3566 ord2966 ord5755 ord6188 ord5752 ord6182 ord4324 ord6185 ord6017 ord5869 ord5790 ord5674 ord5732 ord5575 ord5567 ord6057 ord5860 ord3591 ord323 ord640 ord5781 ord1634 ord1633 ord1143 ord2745 ord4294 ord942 ord5706 ord556 ord809 ord1088 ord2114 ord1105 ord4282 ord5491 ord1202 ord3568 ord6895 ord3802 ord6354 ord6174 ord6437 ord1230 ord3737 ord818 ord3614 ord3688 ord5784 ord5783 ord6868 ord3173 ord3176 ord4053 ord2773 ord5681 ord3269 ord3348 ord4616 ord3574 ord439 ord736 ord1172 ord3211 ord4667 ord4269 ord6371 ord4480 ord2546 ord2504 ord5727 ord3917 ord1089 ord5193 ord2388 ord3341 ord5296 ord5298 ord4074 ord4692 ord5303 ord5285 ord5710 ord3733 ord561 ord815 ord2613 ord1229 ord1131 ord2717 ord4075 ord3074 ord3820 ord3826 ord3825 ord2971 ord3076 ord2980 ord3257 ord3131 ord4459 ord3254 ord3142 ord2977 ord5273 ord2116 ord2438 ord5257 ord1720 ord5059 ord3744 ord6372 ord2047 ord2640 ord4435 ord4831 ord3793 ord5286 ord4347 ord6370 ord5157 ord2377 ord5237 ord4390 ord1768 ord4073 ord6051 ord2567 ord823 ord940 ord1197 ord861 ord4197 ord2756 ord825 ord924 ord925 ord4124 ord858 ord922 ord356 ord2762 ord668 ord3087 ord3871 ord535 ord540 ord800 ord2810 ord537 ord3716 ord538 ord1569

msvcrt

_controlfp _onexit __dllonexit ??1type_info@@UAE@XZ _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __wgetmainargs _wcmdln exit _XcptFilter _exit __CxxFrameHandler wcsrchr _CxxThrowException ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ memmove ??0exception@@QAE@ABQBD@Z _wtoi wcscmp _beginthreadex _purecall swscanf _ftol _wcsicmp free printf malloc strncpy isprint fclose _wfopen fread fwrite fseek ftell fflush fputc getc fgets fscanf wcslen

kernel32

FindClose FindFirstFileW WideCharToMultiByte GetFileAttributesExW CopyFileW GetModuleHandleW GetStartupInfoW FileTimeToLocalFileTime FileTimeToDosDateTime LoadLibraryW GetProcAddress lstrcpynW ResumeThread SetThreadPriority LeaveCriticalSection GlobalUnlock GlobalLock GlobalAlloc SizeofResource LoadResource FindResourceW CreateDirectoryW GetModuleFileNameW InterlockedDecrement DeleteFileW InterlockedIncrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection CloseHandle FreeLibrary GetCurrentProcess LocalFree LocalAlloc InterlockedExchange RaiseException GetLastError LoadLibraryA SetProcessWorkingSetSize

user32

ReleaseDC DrawTextW GrayStringW DrawIcon GetSystemMetrics IsIconic IsWindow LoadBitmapW GetDC InvalidateRect PeekMessageW GetClientRect SetCursor LoadCursorW IntersectRect GetSysColorBrush FillRect PtInRect CharNextW GetClassInfoW KillTimer SetTimer GetSysColor CopyRect GetParent ScreenToClient GetCursorPos PostMessageW MapWindowPoints TabbedTextOutW OffsetRect LoadIconW SendMessageW EnableWindow SetRect

gdi32

CreateSolidBrush CreatePen GetGlyphOutlineW GetTextMetricsW CreateFontIndirectW GetKerningPairsW DeleteObject GetObjectW RoundRect Escape ExtTextOutW TextOutW RectVisible PtVisible BitBlt CreateCompatibleDC CreateCompatibleBitmap EnumFontFamiliesExW GetStockObject SelectObject Rectangle DeleteDC

comdlg32

GetSaveFileNameW GetOpenFileNameW

shell32

DragQueryFileW DragFinish ShellExecuteW SHGetSpecialFolderPathW SHBrowseForFolderW SHGetPathFromIDListW

comctl32

ImageList_ReplaceIcon

ole32

CreateStreamOnHGlobal CoCreateInstance CoInitialize

oleaut32

GetErrorInfo VariantInit VariantCopy VariantClear SysAllocString SysFreeString

shlwapi

PathFindFileNameW PathIsDirectoryW PathFindExtensionW PathRemoveFileSpecW PathAddBackslashW SHGetValueW PathAppendW PathFileExistsW PathRemoveExtensionW