NEAS[.]9a4333ae8e4ec86a4800a797add6f200[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9a4333ae8e4ec86a4800a797add6f200.exe
Size

58KB
MD5

9a4333ae8e4ec86a4800a797add6f200
SHA1

b41b5dabf721d5e3b38678ac4488ec4114cd826f
SHA256

b6399da6f65787bf4dcdb0267eec2dfe96e9a34bdc44bddb179758b8dd50f89f
SHA512

85a0b927d51c328a57d2dd56ffb6b9cce65b91e7c66c2d6236047743f8c05be412519664eb1ee93615a23ae9d6107a239ff86e272fad268097f6cce67dc548b2
SSDEEP

1536:Ff0La26n6jbWFzKh4bRAXzoJ9iz865Qx56tX4jPCG:Ff0p4uh4tL+QxstEPCG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9a4333ae8e4ec86a4800a797add6f200.exe

Files

NEAS.9a4333ae8e4ec86a4800a797add6f200.exe
.dll windows:5 windows x86

0d5accc98c28808ef3d6963a432fe994

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ntdll

RtlUnwind

cmutil

GetOSVersion
SzToWz
WzToSz
WzToSzWithAlloc
CmMalloc
CmFree

advapi32

RegCreateKeyExA
GetUserNameA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA

kernel32

SetStdHandle
FlushFileBuffers
CloseHandle
DeleteCriticalSection
TlsFree
DisableThreadLibraryCalls
TlsAlloc
CompareStringA
CreateDirectoryA
CreateEventA
SetLastError
CreateFileMappingA
CreateFileA
CreateMutexA
CreateProcessA
DeleteFileA
ExpandEnvironmentStringsA
FindResourceExA
GetDateFormatA
GetFileAttributesA
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
MultiByteToWideChar
GetPrivateProfileStringA
GetStringTypeExA
WideCharToMultiByte
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
GetTimeFormatA
GetVersionExA
LoadLibraryExA
OpenEventA
OpenFileMappingA
GetLastError
lstrlenA
SearchPathA
SetCurrentDirectoryA
WritePrivateProfileStringA
TlsGetValue
TlsSetValue
FreeLibrary
GetProcAddress
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
ExitProcess
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetSystemInfo
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
LoadLibraryA
LCMapStringA
LCMapStringW
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
SetFilePointer
InterlockedExchange
VirtualQuery
VirtualProtect

shell32

ShellExecuteExA
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA
Shell_NotifyIconA

user32

GetClassLongA
CallWindowProcA
GetMessageA
GetWindowLongA
GetWindowTextLengthA
IsDialogMessageA
DefWindowProcA
DispatchMessageA
CreateDialogParamA
CreateWindowExA
DialogBoxParamA
FindWindowExA
InsertMenuA
LoadCursorA
LoadIconA
LoadImageA
LoadMenuA
LoadStringA
RegisterClassExA
RegisterWindowMessageA
SendMessageA
GetDlgItem
UnregisterClassA
WinHelpA
CharLowerA
CharUpperA
SetWindowLongA
PostThreadMessageA
PostMessageA
PeekMessageA

Exports

Exports

FreeCmRasUtoA
InitCmRasUtoA
InitCmUToA
RasDeleteEntryUA
RasDeleteSubEntryUA
RasDialUA
RasEnumDevicesUA
RasGetConnectStatusUA
RasGetEntryDialParamsUA
RasGetEntryPropertiesUA
RasGetErrorStringUA
RasGetProjectionInfoUA
RasHangUpUA
RasSetEntryDialParamsUA
RasSetEntryPropertiesUA
RasSetSubEntryPropertiesUA
SHGetMallocUA
SHGetPathFromIDListUA
SHGetSpecialFolderLocationUA
ShellExecuteExUA
Shell_NotifyIconUA

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d5accc98c28808ef3d6963a432fe994

Headers

File Characteristics

Imports

ntdll

cmutil

advapi32

kernel32

shell32

user32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 48KB

.data Size: 3KB - Virtual size: 10KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 48KB - Virtual size: 48KB

.data
Size: 3KB - Virtual size: 10KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB