NEAS[.]3e44e3682724f97978c4826d36675230[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3e44e3682724f97978c4826d36675230.exe
Size

1.1MB
MD5

3e44e3682724f97978c4826d36675230
SHA1

90218274360e2f228e316c8ce0d668616dfeecf6
SHA256

f14eba82443bc76a4c8376fffd00b33a8d499c8a0c46bffb9ae76212a45cedcc
SHA512

fea5e66815f4e95db153713881741bb4b49613fb589217b40ed1ca04be98d2e42be57e35cf78b97db942aa6380595a151f9d412a3e5f30f503f83656121efdce
SSDEEP

24576:5EnoMO8UCr5psY1k9wmLHgZuJ8t09mwwsqx7qrPzeGru5em:5EKk5psq0wmLHLJ8tww1urPzew2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3e44e3682724f97978c4826d36675230.exe

Files

NEAS.3e44e3682724f97978c4826d36675230.exe
.dll windows:6 windows x86

df744b1cb2105de385ec066d19204503

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wintrust

WinVerifyTrust

advapi32

ConvertSidToStringSidA
SetSecurityDescriptorDacl
RegCloseKey
RegCreateKeyExW
OpenProcessToken
AllocateAndInitializeSid
CreateWellKnownSid
EqualSid
FreeSid
GetTokenInformation
IsValidSid
OpenThreadToken
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
EventRegister
EventUnregister
EventWrite
RegQueryInfoKeyW
RegGetValueW
RegEnumKeyW
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorDacl
GetLengthSid
CopySid
CheckTokenMembership
AddAccessDeniedAce
AddAccessAllowedAce
ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

CopyFileW
SetLastError
WaitForSingleObjectEx
GetCommandLineW
SetCurrentDirectoryW
GlobalFree
GetCurrentThreadId
GetFullPathNameW
GetSystemDirectoryW
MultiByteToWideChar
VerSetConditionMask
WriteFile
VerifyVersionInfoW
GetUserDefaultLCID
GetDiskFreeSpaceExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalAlloc
LocalAlloc
LocalFree
SetFilePointerEx
GetFileType
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetTickCount
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
ReleaseMutex
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount64
RaiseFailFastException
GetFileSize
GlobalMemoryStatusEx
GetNativeSystemInfo
GetProductInfo
GetUserGeoID
GetUserDefaultUILanguage
GetSystemDefaultLCID
TerminateProcess
LCIDToLocaleName
CreateMutexA
OpenMutexA
ReadFile
GetACP
IsValidLocale
RaiseException
RtlCaptureStackBackTrace
HeapAlloc
HeapFree
GetProcessHeap
DecodePointer
GetCommandLineA
EncodePointer
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
HeapSize
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCPInfo
GetOEMCP
IsValidCodePage
GetStringTypeW
LCMapStringW
InterlockedExchange
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW
lstrcmpW
InitializeCriticalSection
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
DeleteFileW
CreateDirectoryW
GetCurrentThread
GetCurrentProcessId
CloseHandle
ExpandEnvironmentStringsW
WideCharToMultiByte
FormatMessageW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetVersionExW
SetErrorMode
FindFirstFileExW
FindClose
CompareStringEx
IsWow64Process
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
CreateFileW
LoadLibraryA
LoadResource
SizeofResource
FindResourceW
GetShortPathNameA
LocaleNameToLCID
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
CompareStringW

ole32

CoCreateInstance
CoCreateGuid
CoUninitialize
CoInitializeEx

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

gdi32

DeleteObject
CreateSolidBrush
DeleteDC
GetDeviceCaps
CreateDCA

Exports

Exports

WinMain

Sections

.text
Size: 409KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 212KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 309KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df744b1cb2105de385ec066d19204503

Headers

DLL Characteristics

File Characteristics

Imports

version

wintrust

advapi32

kernel32

ole32

oleaut32

gdi32

Exports

Exports

Sections

.text Size: 409KB - Virtual size: 408KB

.data Size: 212KB - Virtual size: 242KB

.rsrc Size: 164KB - Virtual size: 163KB

.reloc Size: 309KB - Virtual size: 312KB

.text
Size: 409KB - Virtual size: 408KB

.data
Size: 212KB - Virtual size: 242KB

.rsrc
Size: 164KB - Virtual size: 163KB

.reloc
Size: 309KB - Virtual size: 312KB