NEAS[.]a48aaaae668af3b8fdaf025e098816d0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a48aaaae668af3b8fdaf025e098816d0.exe
Size

94KB
MD5

a48aaaae668af3b8fdaf025e098816d0
SHA1

02f9fc549b3354f3cfa08e4097dc64821b51c024
SHA256

f1af94c9012cc057fa307bc369813071c76f35b4cc66933842c8faf87f8d6e8e
SHA512

3607a377efdcf4050a35784903fcdc57db8267ff1fd1d459e4daa4d9f147d0af891b7e69253b5121bfc8b5aa74972468eecb14b06f174bbc1e8157a4b85ec2e2
SSDEEP

1536:G83X3NmToXO+aIxdr6O9esIXq9eFHUAf9HeIMTWmg9Ppki6EPAyVF:G83X3NmTSO1uB6O9caMFHt1BWg9RkkBz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a48aaaae668af3b8fdaf025e098816d0.exe

Files

NEAS.a48aaaae668af3b8fdaf025e098816d0.exe
.dll windows:6 windows x64

f8bc49b65d02a3de30852cdcff525c92

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

unrealserver-core

??1FString@@QEAA@XZ
??4FString@@QEAAAEAV0@AEBV0@@Z
??0FString@@QEAA@XZ
?Free@FMemory@@SAXPEAX@Z
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
?OptionallyLogFormattedEnsureMessageReturningFalseImpl@FDebug@@CA_N_NPEBD1HPEAXPEB_WZZ
?CheckVerifyFailedImpl@FDebug@@SAXPEBD0HPEAXPEB_WZZ
?PromptForRemoteDebugging@FWindowsPlatformMisc@@SAX_N@Z
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
?IsDebuggerPresent@FWindowsPlatformMisc@@SA_NXZ
?Malloc@FMemory@@SAPEAX_KI@Z
?IsEnsureAllowed@FGenericPlatformMisc@@SA_NXZ
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPath@Private@CoreUObject@UE@@EA
?GIgnoreDebugger@@3_NA

unrealserver-coreuobject

??1ICppStructOps@UScriptStruct@@UEAA@XZ
?ConstructUScriptStruct@UECodeGen_Private@@YAXAEAPEAVUScriptStruct@@AEBUFStructParams@1@@Z
?ConstructUPackage@UECodeGen_Private@@YAXAEAPEAVUPackage@@AEBUFPackageParams@1@@Z
?GetStaticStruct@@YAPEAVUScriptStruct@@P6APEAV1@XZPEAVUObject@@PEB_W@Z
?RegisterCompiledInInfo@@YAXP6APEAVUPackage@@XZPEB_WAEAU?$TRegistrationInfo@VUPackage@@UFPackageReloadVersionInfo@@@@AEBUFPackageReloadVersionInfo@@@Z
?RegisterCompiledInInfo@@YAXPEB_WPEBUFClassRegisterCompiledInInfo@@_KPEBUFStructRegisterCompiledInInfo@@2PEBUFEnumRegisterCompiledInInfo@@2@Z
?HasGetTypeHash@ICppStructOps@UScriptStruct@@QEBA_NXZ
?Z_Construct_UScriptStruct_FGuid@@YAPEAVUScriptStruct@@XZ
??0ICppStructOps@UScriptStruct@@QEAA@HH@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list
__current_exception
__current_exception_context
memcpy
memset
__C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_cexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
terminate
_initialize_onexit_table

kernel32

QueryPerformanceCounter
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW

Exports

Exports

??$StaticStruct@UFSessionServiceLog@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFSessionServiceLogSubscribe@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFSessionServiceLogUnsubscribe@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFSessionServicePing@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFSessionServicePong@@@@YAPEAVUScriptStruct@@XZ
?StaticStruct@FSessionServiceLog@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FSessionServiceLogSubscribe@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FSessionServiceLogUnsubscribe@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FSessionServicePing@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FSessionServicePong@@SAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FSessionServiceLog@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FSessionServiceLogSubscribe@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FSessionServiceLogUnsubscribe@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FSessionServicePing@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FSessionServicePong@@YAPEAVUScriptStruct@@XZ
InitializeModule

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.uedbg
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f8bc49b65d02a3de30852cdcff525c92

Headers

DLL Characteristics

File Characteristics

Imports

unrealserver-core

unrealserver-coreuobject

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 13KB

.uedbg Size: 4KB - Virtual size: 3KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 1024B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 59KB - Virtual size: 58KB

.reloc Size: 512B - Virtual size: 468B

.text
Size: 13KB - Virtual size: 13KB

.uedbg
Size: 4KB - Virtual size: 3KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 1024B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 59KB - Virtual size: 58KB

.reloc
Size: 512B - Virtual size: 468B