NEAS[.]b146c93f926c7960cd7800e299876e50[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b146c93f926c7960cd7800e299876e50.exe
Size

533KB
MD5

b146c93f926c7960cd7800e299876e50
SHA1

25dc4577fd134fe46603a36cb43668e31868cd49
SHA256

8cf7fc2cd8e433373450e7f1bbeb01e8923c10881f6855b22f1a8f723fcc2363
SHA512

06fcbacae7238f347739ddf7e4fce0e42217a2ad67d6cf13bbd79a34a3ff679c0358f67607391333fc4bd26c54b5918b7f8cad56934b2fbd06fc3f636dd86640
SSDEEP

6144:uqRBtNtJoblutJ4eIJU6csxGFJdGJLL3m1KUpeu2qnb7LHqVPXkEzIWWO7DiKAFT:vtNtJ8NYfBGJLLORQuVnTqVkExH/y/b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b146c93f926c7960cd7800e299876e50.exe

Files

NEAS.b146c93f926c7960cd7800e299876e50.exe
.dll windows:6 windows x64

adccd1656103b3932921c12d853358ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

zlib

zlibVersion
inflateInit2_
inflateEnd
inflate
inflateInit_

libssh2

libssh2_session_last_error
libssh2_session_last_errno
libssh2_session_block_directions
libssh2_session_flag
libssh2_userauth_list
libssh2_userauth_authenticated
libssh2_userauth_password_ex
libssh2_session_method_pref
libssh2_userauth_publickey_fromfile_ex
libssh2_userauth_keyboard_interactive_ex
libssh2_session_hostkey
libssh2_hostkey_hash
libssh2_session_free
libssh2_channel_read_ex
libssh2_channel_write_ex
libssh2_session_set_blocking
libssh2_channel_send_eof
libssh2_session_disconnect_ex
libssh2_session_handshake
libssh2_channel_wait_eof
libssh2_session_callback_set
libssh2_channel_wait_closed
libssh2_channel_free
libssh2_scp_recv2
libssh2_scp_send64
libssh2_session_abstract
libssh2_version
libssh2_knownhost_init
libssh2_knownhost_add
libssh2_knownhost_checkp
libssh2_session_init_ex
libssh2_knownhost_del
libssh2_knownhost_free
libssh2_knownhost_readfile
libssh2_knownhost_writefile
libssh2_exit
libssh2_init
libssh2_knownhost_get
libssh2_agent_init
libssh2_agent_connect
libssh2_agent_list_identities
libssh2_agent_get_identity
libssh2_agent_userauth
libssh2_agent_disconnect
libssh2_agent_free
libssh2_sftp_init
libssh2_sftp_shutdown
libssh2_sftp_last_error
libssh2_sftp_open_ex
libssh2_sftp_read
libssh2_sftp_readdir_ex
libssh2_sftp_write
libssh2_sftp_close_handle
libssh2_sftp_symlink_ex
libssh2_sftp_seek64
libssh2_sftp_rename_ex
libssh2_sftp_stat_ex
libssh2_sftp_unlink_ex
libssh2_sftp_statvfs
libssh2_sftp_mkdir_ex
libssh2_sftp_rmdir_ex

ws2_32

WSACleanup
WSAStartup
select
__WSAFDIsSet
htonl
ioctlsocket
recvfrom
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
ntohs
WSACreateEvent
WSAWaitForMultipleEvents
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
closesocket
WSACloseEvent
listen
accept
gethostname
freeaddrinfo
getaddrinfo
WSAIoctl
htons
socket
setsockopt
recv
sendto
WSASetLastError

wldap32

ord301
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord73
ord216
ord14
ord133
ord145
ord219
ord46
ord147

advapi32

CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash

crypt32

CryptQueryObject
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore

bcrypt

BCryptGenRandom

kernel32

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
InitializeCriticalSectionEx
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetFileSizeEx
CreateFileW
VerifyVersionInfoW
GetModuleHandleA
VerSetConditionMask
GetTickCount
QueryPerformanceCounter
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
LoadLibraryW
GetModuleHandleW
GetSystemDirectoryW
QueryPerformanceFrequency
FormatMessageW
SetLastError
GetLastError
GetCurrentProcessId
MoveFileExW
Sleep
GetEnvironmentVariableA
DeleteCriticalSection
SleepEx
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
CloseHandle
TerminateProcess
WaitForSingleObjectEx

vcruntime140

__C_specific_handler
strstr
wcschr
memcmp
memchr
strrchr
strchr
memmove
memset
memcpy
__std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

_write
feof
__acrt_iob_func
_read
_close
fclose
ftell
_wopen
_wfopen
fputs
__stdio_common_vsscanf
fflush
fwrite
__stdio_common_vsprintf
fputc
_lseeki64
fread
fseek
fgets

api-ms-win-crt-convert-l1-1-0

strtoul
strtoll
wcstombs
atoi
strtol

api-ms-win-crt-time-l1-1-0

_gmtime64
strftime
_time64

api-ms-win-crt-runtime-l1-1-0

_errno
__sys_errlist
__sys_nerr
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_beginthreadex

api-ms-win-crt-string-l1-1-0

strncmp
_wcsdup
strcspn
wcsncpy
strcmp
strpbrk
wcspbrk
wcsncmp
_strdup
strncpy
strspn

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_unlink
_fstat64
_waccess
_wstat64

api-ms-win-crt-heap-l1-1-0

calloc
malloc
realloc
free

api-ms-win-crt-math-l1-1-0

_fdopen

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_header
curl_easy_init
curl_easy_nextheader
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_option_next
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_url_strerror
curl_version
curl_version_info
curl_ws_meta
curl_ws_recv
curl_ws_send

Sections

.text
Size: 396KB - Virtual size: 396KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

adccd1656103b3932921c12d853358ae

Headers

DLL Characteristics

File Characteristics

Imports

zlib

libssh2

ws2_32

wldap32

advapi32

crypt32

bcrypt

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 396KB - Virtual size: 396KB

.rdata Size: 104KB - Virtual size: 103KB

.data Size: 9KB - Virtual size: 11KB

.pdata Size: 18KB - Virtual size: 18KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 396KB - Virtual size: 396KB

.rdata
Size: 104KB - Virtual size: 103KB

.data
Size: 9KB - Virtual size: 11KB

.pdata
Size: 18KB - Virtual size: 18KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 2KB - Virtual size: 2KB