NEAS[.]cc0ec6441d41ae19d1d27bd0163ab0c0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.cc0ec6441d41ae19d1d27bd0163ab0c0.exe
Size

158KB
MD5

cc0ec6441d41ae19d1d27bd0163ab0c0
SHA1

4053107800a96df4ee1f60695d3984a8981bb406
SHA256

437276ee7c1000dfd1b5038c8fbb241180f393dd8710f75ec838a7058db2d126
SHA512

860479b59c8e2a2d8f8aa90be6546770308231a66817137add2f8cc3cf65129560c55b8762c5210c28b8a446ff8c2de6c2e8fd084c8226894be36d6509657570
SSDEEP

3072:HT8q5JmmCFvXoTFzTYigJMya72zClRS/Ftas+ENQWzGGjlXmXH:HBJmmCFATFzTy7ChSdtasQWrJC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cc0ec6441d41ae19d1d27bd0163ab0c0.exe

Files

NEAS.cc0ec6441d41ae19d1d27bd0163ab0c0.exe
.dll windows:6 windows x64

b9651005ee20438491e01a1ecf1f05d2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

WaitForMultipleObjects
GetTickCount
GetSystemInfo
CreateFileA
GetLastError
GetQueuedCompletionStatus
PostQueuedCompletionStatus
WaitForSingleObject
SetEvent
ResetEvent
CreateIoCompletionPort
CreateEventA
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
DeviceIoControl
EnterCriticalSection
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetStringTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
LoadLibraryW
OutputDebugStringW
HeapReAlloc
HeapFree
EncodePointer
DecodePointer
CreateThread
GetCurrentThreadId
ExitThread
GetProcAddress
LoadLibraryExW
HeapAlloc
GetCommandLineA
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
SetLastError
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
Sleep
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
HeapSize
GetStdHandle
WriteFile
GetModuleFileNameW
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
CreateFileW

advapi32

RegOpenKeyExA
CreateServiceW
StartServiceA
RegCloseKey
RegSetValueExA
OpenSCManagerA
DeleteService
OpenServiceA
CloseServiceHandle

iphlpapi

NotifyAddrChange
GetAdaptersAddresses
CancelIPChangeNotify

ws2_32

WSACreateEvent
WSACleanup
WSAStartup
WSARecvFrom
WSASendTo
getsockname
shutdown
setsockopt
WSARecv
WSASend
WSAGetLastError
socket
WSAIoctl
listen
bind
WSASocketA
htons
closesocket

Exports

Exports

nf_srv_addFlowCtl
nf_srv_addRule
nf_srv_deleteFlowCtl
nf_srv_deleteRules
nf_srv_free
nf_srv_getDestinationAddress
nf_srv_getFlowCtlStat
nf_srv_getTCPConnInfo
nf_srv_getUDPConnInfo
nf_srv_getUDPRemoteAddress
nf_srv_init
nf_srv_modifyFlowCtl
nf_srv_registerDriver
nf_srv_setRules
nf_srv_setTimeout
nf_srv_tcpClose
nf_srv_tcpPostReceive
nf_srv_tcpPostSend
nf_srv_tcpSetConnectionState
nf_srv_tcpSetProxy
nf_srv_udpPostReceive
nf_srv_udpPostSend
nf_srv_udpSetConnectionState
nf_srv_udpSetProxy
nf_srv_unRegisterDriver
nf_srv_updateUDPDestinationAddress

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9651005ee20438491e01a1ecf1f05d2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

iphlpapi

ws2_32

Exports

Exports

Sections

.text Size: 93KB - Virtual size: 92KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 5KB - Virtual size: 15KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 93KB - Virtual size: 92KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 5KB - Virtual size: 15KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB