NEAS[.]5f84f6edee8b7c33c3787eecabd50980[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5f84f6edee8b7c33c3787eecabd50980.exe
Size

217KB
MD5

5f84f6edee8b7c33c3787eecabd50980
SHA1

c368a3f912b87e431b1183b441fc9b814cc2a7b0
SHA256

b2c9d511cb4e2ec8744610c71f28090954a271ec0cdf259444f61e49a7cf9a1d
SHA512

55c7e11fdcc08a28be179508b3f4f2c432e75bb35915bca3006d36b03cc4eb52afb17ec8b052c30a1ac535af3d578298c9742ce98d66f8f9c6f900b988e01fe1
SSDEEP

6144:sWF+iEa7qkBt/8Un+g6GUmbeChseOtPKh:sWF+iEtkj//56GNbeisAh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5f84f6edee8b7c33c3787eecabd50980.exe

Files

NEAS.5f84f6edee8b7c33c3787eecabd50980.exe
.exe windows:5 windows x86

4e652e7c29ebaf7ef24d6e47ebade8b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetWinEventHook
LoadImageA
SetClipboardViewer
DrawEdge
SetPropA
CharUpperA
SystemParametersInfoA
EnumPropsA
IntersectRect
DrawTextW
InflateRect
GrayStringW

urlmon

CoInternetGetSecurityUrl
GetSoftwareUpdateInfo
RevokeFormatEnumerator

shell32

ShellAboutW
DragAcceptFiles
ExtractIconExA
ExtractAssociatedIconA
ShellAboutA
ExtractIconA
DragQueryFileA

ole32

CoInitializeEx
ReleaseStgMedium
CreateDataCache
OleSaveToStream
SetConvertStg
CoGetCallContext

wininet

GopherGetAttributeA
GopherOpenFileW
InternetErrorDlg
GopherGetLocatorTypeW
FtpOpenFileW

gdi32

ChoosePixelFormat
CreateBrushIndirect
ColorCorrectPalette
CreateDIBPatternBrushPt
CreateColorSpaceA
CreateCompatibleDC

ws2_32

htons
gethostbyname
getprotobyname
listen

opengl32

glClearIndex
glVertex4i
glTranslatef
glColor3usv
glClipPlane
glTexCoord4d
glNormal3dv

kernel32

WriteConsoleW
HeapSize
SetFilePointer
GetStringTypeW
MultiByteToWideChar
LCMapStringW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
HeapAlloc
LoadLibraryW
SetStdHandle
RtlUnwind
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapFree
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
CreateFileW
HeapSetInformation
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
CreateThread
GetLastError
CreateEventA
SetEvent
CloseHandle
WaitForSingleObject
GetCurrentThreadId
OpenFileMappingW
GlobalFindAtomA
GetPrivateProfileSectionNamesW
OpenJobObjectA
GetLongPathNameA
GetCommandLineA
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4e652e7c29ebaf7ef24d6e47ebade8b5

Headers

DLL Characteristics

File Characteristics

Imports

user32

urlmon

shell32

ole32

wininet

gdi32

ws2_32

opengl32

kernel32

Sections

.text Size: 29KB - Virtual size: 28KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 9KB - Virtual size: 18KB

.rsrc Size: 166KB - Virtual size: 165KB

.text
Size: 29KB - Virtual size: 28KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 9KB - Virtual size: 18KB

.rsrc
Size: 166KB - Virtual size: 165KB