NEAS[.]50652f3f07341d9c76cdef1e93120100[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.50652f3f07341d9c76cdef1e93120100.exe
Size

502KB
MD5

50652f3f07341d9c76cdef1e93120100
SHA1

4b0bfe499f0963362309890ecb687ad889d30d43
SHA256

a3092dedf3eff2cf9b1f70a204b3ea7fad1249f8797fbdada824522cb35bf83b
SHA512

5dadce88fb528b5565962da328ad3295d7fb3f770d51c1dd32e7e9f206d2386bb5cc98419d66d3b59cfa797752ad15cde4e4749542de5a1b9b27dfe2ed8fa016
SSDEEP

6144:kP7DttDVvOhhtaUD7DwkE3uMpRdOsVpu2kZji8MFdfU0teO9zyRrjNq7AqqDLuWR:g7DtgDwkw4nk80teO9zyRVUlqnuWK7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.50652f3f07341d9c76cdef1e93120100.exe

Files

NEAS.50652f3f07341d9c76cdef1e93120100.exe
.dll windows:5 windows x64

df7dd9b30cec51b6e70b6c47c5f1b174

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

hid

HidD_GetPreparsedData
HidP_GetCaps
HidD_FreePreparsedData
HidD_GetHidGuid

kernel32

GetVersion
GetTickCount
TerminateThread
MapViewOfFile
OpenFileMappingA
LocalFree
CreateMutexA
CreateFileMappingA
GetCurrentProcessId
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
DeviceIoControl
GetVersionExA
HeapFree
HeapAlloc
GetProcessHeap
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualQueryEx
GetCurrentProcess
GetSystemDirectoryA
CreateFileW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
SetStdHandle
GetConsoleOutputCP
WriteConsoleA
HeapReAlloc
InitializeCriticalSectionAndSpinCount
HeapSize
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeFormatA
GetDateFormatA
UnmapViewOfFile
CreateEventA
ReadFile
CancelIo
WriteFile
GetOverlappedResult
CreateFileA
CloseHandle
OpenEventA
SetEvent
CreateThread
Sleep
WaitForSingleObject
ReleaseMutex
GetLastError
SetLastError
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetFilePointer
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetEndOfFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
DeleteCriticalSection
GetStartupInfoA
SetHandleCount
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
LoadLibraryW
ExitProcess
GetModuleHandleW
HeapDestroy
WriteConsoleW
GetFileType
GetStdHandle
DebugBreak
GetModuleFileNameW
ExitThread
GetCurrentThreadId
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
FlsSetValue
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate

user32

PostMessageA
FindWindowA
SetWindowsHookExA
RegisterDeviceNotificationA
GetMessageA
DispatchMessageA
TranslateMessage
UpdateWindow
ShowWindow
CallNextHookEx
CreateWindowExA
RegisterClassA
LoadCursorA
LoadStringA
DefWindowProcA
DestroyWindow
LoadIconA

gdi32

GetStockObject

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
OpenSCManagerA
OpenServiceA
QueryServiceStatus
StartServiceA

winscard

SCardEndTransaction
SCardBeginTransaction
SCardReleaseContext
SCardEstablishContext
SCardDisconnect
SCardStatusA
SCardConnectA
SCardListReadersA
SCardReconnect
SCardTransmit
SCardControl
SCardGetStatusChangeA
SCardGetAttrib

setupapi

CM_Get_Parent
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstanceIdA
CM_Locate_DevNodeA
SetupDiDestroyDeviceInfoList
CM_Get_Device_IDA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces

shlwapi

StrStrIA

Exports

Exports

HKBeginTransaction
HKConnectDev
HKDisconnectDev
HKEndTransaction
HKGetATR
HKGetDevState
HKGetSerialNum
HKListReaders
HKRefreshReaders
HKReset
HKSetDevChgFunc
HKSetDevChgFuncParam
HKTransDeviceName2KeyName
HKTransmit
HKWaitForDevEvent
HSGetConfigValueInt
HSGetConfigValueString
HSSetConfigValueInt
HSSetConfigValueString
HT_DaemonToKillUnsafeRemoveDlg
HT_GetCapabilities
HYC_ActiveMF
HYC_ChangePin
HYC_ClearSM1Key
HYC_ClearSM1KeyEEPROM
HYC_ClearSSF33Key
HYC_ClearSSF33KeyEEprom
HYC_CreateDF
HYC_CreateEF
HYC_CreateMF
HYC_DelDF
HYC_DelEF
HYC_DelMF
HYC_ECC384Dec
HYC_ECC384Enc
HYC_ECC384ExchangeKey
HYC_ECC384ImportTempKey
HYC_ECC384ImportWstEncPriKey
HYC_ECC384PriKeyGetPubKey
HYC_ECC384Singnature
HYC_ECC384VerifySignature
HYC_Ecc384EncExportWstSCBKey
HYC_GenECC384Key
HYC_GenECC384TempKey
HYC_GenRSA
HYC_GenRandom
HYC_GenSM2Key
HYC_GenSM2TempKey
HYC_GetDevInfo
HYC_GetDevSafeState
HYC_GetECCKeyModulLen
HYC_GetEFSize
HYC_GetPinCacheFlag
HYC_GetPinRetryNum
HYC_GetRSAKeyModulLen
HYC_GetSM1KeyEEPROM
HYC_GetSOPinRetryNum
HYC_GetSSF33KeyEEprom
HYC_GetSymSupport
HYC_GetTimepiece
HYC_GetUserPinRetryNum
HYC_GetVerifyPinMode
HYC_LCDDownloadMatrix
HYC_LCDSingDada
HYC_PriKeyDoRaw
HYC_RSAEncExportSM1Key
HYC_RSAPubKeyDoRaw
HYC_ReadDSN
HYC_ReadEF
HYC_ReadPCODE
HYC_ReadRSAPubKey
HYC_ReadReservedSection
HYC_ResetUserPin
HYC_SCB2ImportEncKey
HYC_SM1Dec
HYC_SM1Enc
HYC_SM1ExportRSAKey
HYC_SM1GenKey
HYC_SM1GenKeyEEPROM
HYC_SM1GenKeyRSAEncExport
HYC_SM1GenKeySM2EncExport
HYC_SM1ImportKey
HYC_SM1ImportRSAKey
HYC_SM2CalculateE
HYC_SM2CalculateZ
HYC_SM2Dec
HYC_SM2Enc
HYC_SM2EncExportSM1Key
HYC_SM2ExchangeKey
HYC_SM2ExportEncSessionKey
HYC_SM2ImportEncKey
HYC_SM2ImportEncSessionKey
HYC_SM2ImportTempKey
HYC_SM2Singnature
HYC_SM2VerifySignature
HYC_SM3Digest
HYC_SSF33Dec
HYC_SSF33Enc
HYC_SSF33GenKey
HYC_SSF33GenKeyEEprom
HYC_SSF33GenKeyEncExport
HYC_SSF33ImportEncKey
HYC_SSF33ImportKey
HYC_SelDF
HYC_SelEF
HYC_SelMF
HYC_SetPinCacheFlag
HYC_SetSOPinRetryNum
HYC_SetUserPinRetryNum
HYC_UnLockUserDev
HYC_VerifyPin
HYC_WriteDSN
HYC_WriteEF
HYC_WriteKey
HYC_WritePCODE
HYC_WriteRSAPriKey
HYC_WriteRSAPubKey
HYC_WriteReservedSection
HYC_WstHash
HYC_WstHashUpdata
HYC_WstSCBDec
HYC_WstSCBEnc
HYC_WstSCBGenKey
HYC_WstSCBGenKeyWstEccEncExport
HYC_WstSCBImportECC384EncKey
HYC_WstSCBImportKey

Sections

.text
Size: 374KB - Virtual size: 373KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df7dd9b30cec51b6e70b6c47c5f1b174

Headers

File Characteristics

Imports

hid

kernel32

user32

gdi32

advapi32

winscard

setupapi

shlwapi

Exports

Exports

Sections

.text Size: 374KB - Virtual size: 373KB

.rdata Size: 94KB - Virtual size: 94KB

.data Size: 11KB - Virtual size: 37KB

.pdata Size: 16KB - Virtual size: 16KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 374KB - Virtual size: 373KB

.rdata
Size: 94KB - Virtual size: 94KB

.data
Size: 11KB - Virtual size: 37KB

.pdata
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB