NEAS[.]d7e6bc7d9983adc4dd2820d00756c7c0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NEAS.d7e6bc7d9983adc4dd2820d00756c7c0.exe
Size 328KB
Sample231013-zjbbdabc74
SHA256 f324bb47090d388fca1015260f66f67b708e8451292cd5679791792c90d5b711
MD5 d7e6bc7d9983adc4dd2820d00756c7c0
SHA1 15fa33e71a2c20f73bc4595546b1494ec2e561b0
SHA512 42d534bd586e8ffec3ec170409667becec6206f97701497527ca1c8a35a6b251f6d9b24304d08b3460761abff6394446af11bed19c35a24affe9b165c50e7001
SSDEEP 6144:fN/F41OWGRkFtwxW6spj/JbUaeboh6EReEUHFmU8D7KTXhdic:f5FCOWGRayW6sAowXFmU8D7KTRw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d7e6bc7d9983adc4dd2820d00756c7c0.exe

File Explorer

NEAS.d7e6bc7d9983adc4dd2820d00756c7c0.exe

.dll 328KB

NEAS.d7e6bc7d9983adc4dd2820d00756c7c0.exe

IMPHASH e7125b885fcd1eea77d2881eaaa53c4d
SHA256 f324bb47090d388fca1015260f66f67b708e8451292cd5679791792c90d5b711
MD5 d7e6bc7d9983adc4dd2820d00756c7c0
SHA1 15fa33e71a2c20f73bc4595546b1494ec2e561b0
SHA512 42d534bd586e8ffec3ec170409667becec6206f97701497527ca1c8a35a6b251f6d9b24304d08b3460761abff6394446af11bed19c35a24affe9b165c50e7001
SSDEEP 6144:fN/F41OWGRkFtwxW6spj/JbUaeboh6EReEUHFmU8D7KTXhdic:f5FCOWGRayW6sAowXFmU8D7KTRw
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36972

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

FindClose ReadFile CloseHandle GetProcessHeap GetThreadErrorMode GetCurrentThread GetErrorMode GetLogicalDrives IsDebuggerPresent AreFileApisANSI SwitchToThread GetSystemDefaultUILanguage GetUserDefaultLangID TlsAlloc GetThreadUILanguage GetLargePageMinimum IsSystemResumeAutomatic GetCurrentThreadId GetACP GetCommandLineA GetOEMCP GetUserDefaultUILanguage GetEnvironmentStringsW GetCommandLineW GetSystemDefaultLangID VirtualAlloc GetLastError RaiseException InitializeCriticalSectionEx FindNextFileA MultiByteToWideChar LoadResource SizeofResource FindResourceW GetModuleHandleW GetProcAddress LoadLibraryExW GetModuleFileNameW lstrcmpiW FreeLibrary FreeEnvironmentStringsW IsValidCodePage FindFirstFileExA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers HeapReAlloc HeapSize GetFileType GetStdHandle DeleteCriticalSection GetTickCount64 SetStdHandle WriteConsoleW CreateFileW RtlUnwind DecodePointer HeapAlloc HeapFree GetModuleFileNameA GetModuleHandleExW ExitProcess TerminateProcess GetCurrentProcess TlsFree TlsSetValue TlsGetValue InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList RtlPcToFileHeader RtlUnwindEx OutputDebugStringW GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx

user32

GetClipboardSequenceNumber GetCapture InSendMessage GetClipboardViewer GetKBCodePage CreateMenu GetCursor IsProcessDPIAware GetProcessWindowStation SetProcessDPIAware GetMenuCheckMarkDimensions IsWow64Message GetForegroundWindow GetMessageTime CharNextW GetShellWindow EmptyClipboard CountClipboardFormats

gdi32

GdiFlush

advapi32

RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW

ole32

CoFreeUnusedLibraries CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoUninitialize

oleaut32

VarUI4FromStr

Name

.text

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ