NEAS[.]5a31ee13a2d870c3dc135b9871190740[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.5a31ee13a2d870c3dc135b9871190740.exe
Size

177KB
MD5

5a31ee13a2d870c3dc135b9871190740
SHA1

8e14d8f342f576c9e3865db9a42c915007c536ee
SHA256

bf1312bcb5a1ccc77aaf8d525d2c01b162c22db2e4311b52b8a244f69928b2b6
SHA512

c66f13204ad3ce169663fc93452887cc2f56c926582cbd720c7d321108dd57eb72f5dbd0bbd791ea7529ec381c06b42639cdb801cb05af8e24ec0fbfa8cc6d64
SSDEEP

3072:OXetU1p/i4OQmTYJOZNHbsIV2S72s4r60oAu2fDUvJRCbQRGtA:OXetU7/eQmHbL2r60oAJRb3u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5a31ee13a2d870c3dc135b9871190740.exe

Files

NEAS.5a31ee13a2d870c3dc135b9871190740.exe
.exe windows:5 windows x86

3878dd59492f5778f251ec89c9ecf6b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalAlloc
GetSystemDirectoryW
GlobalFree
Sleep
GetFileSize
MoveFileExW
OpenProcess
CopyFileW
TerminateProcess
GetModuleFileNameW
CreateFileW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetFileTime
CloseHandle
DeleteFileW
WriteConsoleW
SetStdHandle
HeapReAlloc
LoadLibraryW
HeapSize
RtlUnwind
GetConsoleMode
GetConsoleCP
SetFilePointer
EnterCriticalSection
GetLastError
MoveFileW
GetCommandLineA
HeapSetInformation
RaiseException
HeapFree
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
IsProcessorFeaturePresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetProcAddress
LCMapStringW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
MultiByteToWideChar
GetStringTypeW
LeaveCriticalSection
FlushFileBuffers

user32

RegisterWindowMessageW
wsprintfW
FindWindowW
PostMessageW

shell32

ShellExecuteW

ws2_32

WSCEnumProtocols
WSCInstallProvider
WSCUpdateProvider
WSCWriteProviderOrder
WSCDeinstallProvider
WSCGetProviderPath

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueA

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.erdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3878dd59492f5778f251ec89c9ecf6b8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ws2_32

version

Sections

.text Size: 52KB - Virtual size: 51KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 15KB - Virtual size: 14KB

.reloc Size: 6KB - Virtual size: 5KB

.erdata Size: 76KB - Virtual size: 76KB

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 15KB - Virtual size: 14KB

.reloc
Size: 6KB - Virtual size: 5KB

.erdata
Size: 76KB - Virtual size: 76KB