NEAS[.]41ff4de7fbf7dfd3153ee710cfa8b990[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.41ff4de7fbf7dfd3153ee710cfa8b990.exe
Size

5KB
MD5

41ff4de7fbf7dfd3153ee710cfa8b990
SHA1

9406b9cf4860339d5e5228c3bcb84f4608f196fd
SHA256

157d3f2b145d1bb7cd35b1825e94321cda127b8dbad3ae35a6d38b78e9ece951
SHA512

389b1cfe8c2f2066fdaf3d2d81900b7f2f1a98a49e699144516add8af38090a3e2d5e5cc6a3b81a73d79c7c7b56e986882051068197113475dee54f2a6019c5a
SSDEEP

48:ilk3qxaKe167eV8NgouJmE2PR6B6eW4yzBfQi:yk3Tl14eV8ZuYXPR6BYz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.41ff4de7fbf7dfd3153ee710cfa8b990.exe

Files

NEAS.41ff4de7fbf7dfd3153ee710cfa8b990.exe
.dll regsvr32 windows:6 windows x64

bf5a5b319ee1b7ac7be47cfb9143e44e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

SleepEx
SetEvent
CreateProcessW
CloseHandle
OpenEventW
ExitProcess

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

CallNtPowerInformation
ClrCreateManagedInstance
ConstructPartialMsgVW
CorBindToRuntimeEx
CreateUri
CurrentIP
DevObjCreateDeviceInfoList
DevObjDestroyDeviceInfoList
DevObjEnumDeviceInterfaces
DevObjGetClassDevs
DevObjOpenDeviceInfo
DllRegisterServer
DpxNewJob
GenerateActionQueue
LoadLibraryShim
NetApiBufferAllocate
NetApiBufferFree
NetApiBufferReallocate
NetApiBufferSize
NetRemoteComputerSupports
NetapipBufferAllocate
NetpIsComputerNameValid
NetpIsDomainNameValid
NetpIsGroupNameValid
NetpIsRemote
NetpIsRemoteNameValid
NetpIsShareNameValid
NetpIsUncComputerNameValid
NetpIsUserNameValid
NetpwListCanonicalize
NetpwListTraverse
NetpwNameCanonicalize
NetpwNameCompare
NetpwNameValidate
NetpwPathCanonicalize
NetpwPathCompare
NetpwPathType
PowerGetActiveScheme
PrivateCoInternetCombineUri
ProcessActionQueue
SLGetWindowsInformation
WdsAbortBlackboard
WdsAbortBlackboardItemEnum
WdsCreateBlackboard
WdsDestroyBlackboard
WdsEnumFirstBlackboardItem
WdsEnumNextBlackboardItem
WdsFreeData
WdsGetBlackboardValue
WdsInitialize
WdsIsDiagnosticModeEnabled
WdsSetAssertFlags
WdsSetupLogMessageW
WdsTerminate

Sections

.text
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bf5a5b319ee1b7ac7be47cfb9143e44e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 548B

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 158B

.pdata Size: 512B - Virtual size: 36B

.text
Size: 1024B - Virtual size: 548B

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 158B

.pdata
Size: 512B - Virtual size: 36B