NEAS[.]75244cd624481bc0ca76ff935862d1d0[.]cab

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.75244cd624481bc0ca76ff935862d1d0.cab
Size

91KB
MD5

75244cd624481bc0ca76ff935862d1d0
SHA1

5488362b32528116c5da97c9776035b0786a8106
SHA256

6c34df16efbe32dfc7f1bc45bfaaac3f63d67b80ab787b82d056195bdbb694dd
SHA512

d3432b995996eb5ea46fb18e23f611fd8e7c10e3440ed0c423dad209d651d649847824296a0e8001e671265c375136736d73f949d86e17b81f3b3983e28b9df7
SSDEEP

1536:jG+tWGbwWU3FG4r7v+2eF1tMEkplTKwv0eIWo9pClNeDIpnWMMhD1dAx5RT6gorZ:jtMGUWEFG4r7y5kGXOWDIwMM3dAx/uDZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/h323.tsp

Files

NEAS.75244cd624481bc0ca76ff935862d1d0.cab
.cab
h323.tsp
.dll windows:5 windows x86

712b2f9c3c93a83d0f364434f172bf69

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_onexit
__dllonexit
_adjust_fdiv
malloc
_initterm
_wcsupr
wcsstr
free
sprintf
_vsnprintf
swprintf
_except_handler3
strtok
memmove
realloc
_itoa
atoi
??3@YAXPAX@Z
??2@YAPAXI@Z
wcslen

ws2_32

WSASendTo
WSARecvFrom
WSACleanup
WSAStartup
bind
listen
WSAEventSelect
setsockopt
WSAConnect
WSAEnumNetworkEvents
shutdown
htons
WSASend
WSARecv
getsockname
getpeername
ntohs
inet_addr
gethostbyname
WSASocketW
WSAGetLastError
htonl
WSAIoctl
closesocket
ntohl
inet_ntoa

mswsock

AcceptEx
GetAcceptExSockaddrs

advapi32

RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegCreateKeyW
RegDeleteKeyW
RegNotifyChangeKeyValue
RegisterEventSourceW
RegCreateKeyExW
DeregisterEventSource

kernel32

GetQueuedCompletionStatus
ExitThread
GetModuleHandleW
GetModuleFileNameW
lstrcpyW
Sleep
WaitForSingleObject
GetComputerNameW
GetLocalTime
GetCurrentThreadId
WriteFile
CreateFileW
CreateEventW
GetTickCount
RegisterWaitForSingleObject
CreateTimerQueueTimer
BindIoCompletionCallback
PostQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
UnregisterWaitEx
CloseHandle
DeleteCriticalSection
InterlockedDecrement
SetEvent
DeleteTimerQueueTimer
GetACP
MultiByteToWideChar
ResetEvent
GetLastError
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
SetLastError
CreateThread
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateIoCompletionPort
lstrlenA
QueueUserWorkItem

rpcrt4

UuidCreate

user32

GetDlgItemInt
MessageBoxW
EndDialog
GetDlgItemTextW
EnableWindow
SetDlgItemTextW
WinHelpW
wsprintfW
LoadStringW
SendDlgItemMessageW
GetDlgItem
DialogBoxParamW
SetDlgItemInt

msasn1

ASN1PERDecObjectIdentifier
ASN1objectidentifier_free
ASN1PEREncUnsignedShort
ASN1PERDecUnsignedShort
ASN1PEREncOctetString_NoSize
ASN1PERDecOctetString_NoSize
ASN1octetstring_free
ASN1PEREncComplexChoice
ASN1PERDecS16Val
ASN1PERDecN16Val
ASN1PEREncOctetString_VarSize
ASN1PEREncAlignment
ASN1PERDecOctetString_VarSize
ASN1PERDecAlignment
ASN1PEREncBits
ASN1PERDecBits
ASN1PERDecU32Val
ASN1bitstring_free
ASN1EncSetError
ASN1DecSetError
ASN1PERDecSkipFragmented
ASN1PEREncInteger
ASN1PEREncChar16String
ASN1uint32_uoctets
ASN1PERDecInteger
ASN1PERDecChar16String
ASN1PERDecExtension
ASN1char16string_free
ASN1PEREncFragmented
ASN1PERDecFragmented
ASN1_CloseEncoder2
ASN1PEREncFlushFragmentedToParent
ASN1PEREncNormallySmallBits
ASN1PEREncCheckExtensions
ASN1_CreateDecoderEx
ASN1PERDecNormallySmallExtension
ASN1PEREncTableCharString
ASN1PERDecZeroTableCharStringNoAlloc
ASN1PEREncSeqOf_NoSize
ASN1PERDecSeqOf_NoSize
ASN1PERFreeSeqOf
ASN1PEREncFragmentedCharString
ASN1PERDecFragmentedZeroCharString
ASN1ztcharstring_free
ASN1PEREncCharString
ASN1PERDecZeroCharStringNoAlloc
ASN1PERDecComplexChoice
ASN1PEREncSimpleChoice
ASN1PERDecSimpleChoice
ASN1PERDecSkipNormallySmall
ASN1PEREncObjectIdentifier
ASN1PERDecBoolean
ASN1PERDecSkipNormallySmallExtensionFragmented
ASN1PEREncExtensionBitClear
ASN1PEREncBoolean
ASN1PERDecU16Val
ASN1PEREncBitVal
ASN1PERDecSimpleChoiceEx
ASN1PEREncSimpleChoiceEx
ASN1PERDecOctetString_FixedSize
ASN1PEREncOctetString_FixedSize
ASN1_CloseModule
ASN1_CreateModule
ASN1PERDecBit
ASN1_CreateEncoder
ASN1_CreateDecoder
ASN1_FreeEncoded
ASN1_CloseDecoder
ASN1_CloseEncoder
ASN1_Encode
ASN1_Decode
ASN1_FreeDecoded

Exports

Exports

TSPI_lineAddToConference
TSPI_lineAnswer
TSPI_lineBlindTransfer
TSPI_lineClose
TSPI_lineCloseCall
TSPI_lineCloseMSPInstance
TSPI_lineCompleteTransfer
TSPI_lineConditionalMediaDetection
TSPI_lineCreateMSPInstance
TSPI_lineDial
TSPI_lineDrop
TSPI_lineForward
TSPI_lineGenerateDigits
TSPI_lineGetAddressCaps
TSPI_lineGetAddressStatus
TSPI_lineGetCallAddressID
TSPI_lineGetCallInfo
TSPI_lineGetCallStatus
TSPI_lineGetDevCaps
TSPI_lineGetID
TSPI_lineGetLineDevStatus
TSPI_lineGetNumAddressIDs
TSPI_lineHold
TSPI_lineMSPIdentify
TSPI_lineMakeCall
TSPI_lineMonitorDigits
TSPI_lineNegotiateTSPIVersion
TSPI_lineOpen
TSPI_linePrepareAddToConference
TSPI_lineReceiveMSPData
TSPI_lineRedirect
TSPI_lineReleaseUserUserInfo
TSPI_lineRemoveFromConference
TSPI_lineSendUserUserInfo
TSPI_lineSetAppSpecific
TSPI_lineSetCallData
TSPI_lineSetDefaultMediaDetection
TSPI_lineSetMediaMode
TSPI_lineSetStatusMessages
TSPI_lineSetupConference
TSPI_lineSetupTransfer
TSPI_lineUnhold
TSPI_providerConfig
TSPI_providerCreateLineDevice
TSPI_providerEnumDevices
TSPI_providerGenericDialogData
TSPI_providerInit
TSPI_providerInstall
TSPI_providerRemove
TSPI_providerShutdown
TSPI_providerUIIdentify
TUISPI_providerConfig
TUISPI_providerInstall
TUISPI_providerRemove

Sections

.text
Size: 231KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

712b2f9c3c93a83d0f364434f172bf69

Headers

File Characteristics

Imports

msvcrt

ws2_32

mswsock

advapi32

kernel32

rpcrt4

user32

msasn1

Exports

Exports

Sections

.text Size: 231KB - Virtual size: 230KB

.data Size: 1KB - Virtual size: 11KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 231KB - Virtual size: 230KB

.data
Size: 1KB - Virtual size: 11KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 17KB - Virtual size: 17KB