NEAS[.]31c0cc053b933b8ee5d8acd77ce42120[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.31c0cc053b933b8ee5d8acd77ce42120.exe
Size

440KB
MD5

31c0cc053b933b8ee5d8acd77ce42120
SHA1

93692d6701647bee0573394294b1a68999d1e405
SHA256

241e57e8739255e722f5b0d79ba25855d861a0323437f56947a5e25ca56f5f91
SHA512

efe6e810a7989e43296bf167c169069064e46cf63b04488e180f3715b50f2e0878f6bef518869f7a9d2d9f5568887c644db2e8dce2181ac762487edf0c684f98
SSDEEP

12288:+Oe+ZRH/VYiB2StLpm1EwtLpm1EuLbviDftq/Nm2:+8iStLpwbtLpwtv7/I

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.31c0cc053b933b8ee5d8acd77ce42120.exe

Files

NEAS.31c0cc053b933b8ee5d8acd77ce42120.exe
.exe windows:6 windows x86

973397171891283c9e4508d41746419d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCloseKey

kernel32

GetNativeSystemInfo
GetPhysicallyInstalledSystemMemory
GetModuleHandleW
FindClose
FindNextFileW
FindFirstFileW
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
SetFilePointer
CreateFileW
ReadFile
GetLastError
CreateDirectoryExW
GetSystemWow64DirectoryW
SetCurrentDirectoryW
GetComputerNameW
FreeLibrary
EnterCriticalSection
LoadLibraryW
GetFileSize
CreateEventW
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentDirectoryW
GetCommandLineW
RegisterApplicationRestart
HeapSetInformation
MultiByteToWideChar
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetNumberFormatW
CreateThread
ResetEvent
DeleteCriticalSection
SetEvent
TerminateThread
CloseHandle
GetTempPathW
GetTickCount
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
LocalAlloc
InitializeCriticalSection
WaitForSingleObject
GetVersionExW
DnsHostnameToComputerNameW
LocalFree
lstrlenW
LeaveCriticalSection
FormatMessageW
UnhandledExceptionFilter

gdi32

CreateSolidBrush
GetObjectW
CreateFontIndirectW
TextOutW
EndPage
EndDoc
StartPage
StartDocW
GetTextExtentPoint32W
GetDeviceCaps
CreateFontW
SetTextColor

user32

SetClassLongW
SetRect
BeginPaint
GetSysColor
FillRect
EndPaint
SetFocus
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetSubMenu
SetMenuItemInfoW
GetFocus
UpdateWindow
ScreenToClient
CopyRect
GetDCEx
DrawFocusRect
ReleaseDC
PtInRect
SetCursor
ReleaseCapture
LoadIconW
SetCapture
GetClientRect
IsWindowEnabled
RedrawWindow
SetTimer
EndDialog
GetWindowTextW
GetDlgItem
SendMessageW
EnableWindow
SetWindowTextW
CheckRadioButton
SetDlgItemTextW
IsDlgButtonChecked
LoadStringW
KillTimer
DialogBoxParamW
PostMessageW
MessageBoxW
SetWindowPlacement
SystemParametersInfoW
CheckDlgButton
InflateRect
OffsetRect
MoveWindow
LoadAcceleratorsW
SetMenu
GetClipboardData
LoadMenuW
IsWindowVisible
IsClipboardFormatAvailable
PostQuitMessage
DestroyAcceleratorTable
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
CreateDialogParamW
LoadCursorW
ShowWindow
GetWindowRect
InvalidateRect

mfc42u

ord6565
ord826
ord269
ord1173
ord1240
ord1571
ord600
ord6867
ord2559
ord5790
ord6168
ord5871
ord5785
ord640
ord6921
ord6919
ord5781
ord2755
ord5597
ord6563
ord2757
ord5618
ord802
ord542
ord394
ord698
ord4182
ord5588
ord911
ord396
ord860
ord323
ord1633
ord6466
ord2442
ord825
ord861
ord858
ord5568
ord2910
ord800
ord540
ord2606
ord538
ord4124
ord913
ord1165
ord535
ord4155
ord823
ord922
ord5706
ord2756
ord1594
ord2810
ord940
ord4184
ord6278
ord941
ord398
ord700
ord2809
ord501
ord909
ord773
ord696
ord5586
ord3430
ord5596
ord1083
ord4180
ord5617
ord998
ord2819
ord6928
ord1184
ord834
ord6218
ord6279
ord2768
ord5852
ord4197
ord925
ord927
ord2805
ord4199
ord3432
ord3658
ord349
ord3608
ord3121
ord5647
ord2385
ord1560
ord537
ord1172
ord3621
ord2406
ord268
ord3614
ord1634
ord352
ord942
ord2813
ord3806
ord2776

msvcrt

_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_controlfp
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_vsnwprintf
__CxxFrameHandler3
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_wcsicoll
_wtoi
_wcsicmp
memcpy
_purecall
malloc
swprintf_s
wcstol
_callnewh
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
wcsncpy_s
_wtol
_ftol2_sse
wcstod
_wcsupr
free
_CxxThrowException
_ftol2
wcstoul
iswalpha
memset

atl

ord30

ntdll

WinSqmAddToStream

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantChangeType
VariantInit
SysStringLen
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetDim
SysAllocStringLen

ole32

CoCreateGuid
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitialize

shlwapi

StrFormatByteSizeEx

setupapi

SetupIterateCabinetW

comdlg32

GetOpenFileNameW
PrintDlgExW
GetSaveFileNameW

shell32

CommandLineToArgvW

comctl32

InitCommonControlsEx

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

UPX0
Size: 144KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

973397171891283c9e4508d41746419d

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

mfc42u

msvcrt

atl

ntdll

oleaut32

ole32

shlwapi

setupapi

comdlg32

shell32

comctl32

Sections

.text Size: 137KB - Virtual size: 136KB

.data Size: 1KB - Virtual size: 20KB

.rsrc Size: 147KB - Virtual size: 146KB

.reloc Size: 9KB - Virtual size: 9KB

UPX0 Size: 144KB - Virtual size: 380KB

.text
Size: 137KB - Virtual size: 136KB

.data
Size: 1KB - Virtual size: 20KB

.rsrc
Size: 147KB - Virtual size: 146KB

.reloc
Size: 9KB - Virtual size: 9KB

UPX0
Size: 144KB - Virtual size: 380KB