NEAS[.]8d9bcda20592b21edf3e50d11fe30700[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.8d9bcda20592b21edf3e50d11fe30700.exe
Size

27KB
MD5

8d9bcda20592b21edf3e50d11fe30700
SHA1

f9e7b62ac05c0a07eba05f97fe145827ac01862d
SHA256

f6baa6a2b03f47bcce16e223fd94bc91ef60a89c23c03a59f9e3ee494a8f6ae9
SHA512

23db451336361199d5605677ce9ef315917bfc498e8c5804cde8604c1a6431d136cc3b469ba5f74bc360c9c7240163464da085de1e30a4f2677c934d4d55b161
SSDEEP

384:B+UiYY5CPAIRWqYYA1ZCEiY/4bM2jvtllJ0xS5lkvfYS3nPG6O+DLNl/+a:AUiYkCPAuk314jVll+xALWn+6OqBl/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.8d9bcda20592b21edf3e50d11fe30700.exe

Files

NEAS.8d9bcda20592b21edf3e50d11fe30700.exe
.dll windows:5 windows x86

d35b5945f2635ccb3b795abd01eeef50

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryA
FindFirstFileA
FindClose
GetPrivateProfileStringA
DeviceIoControl
FindNextFileA
OutputDebugStringA
CloseHandle
DeleteFileA
SetFilePointer
GetDriveTypeA
InterlockedDecrement
GetCurrentProcess
SetFilePointerEx
WriteFile
Sleep
ReadFile
GetLastError
GetDiskFreeSpaceA
GetDiskFreeSpaceExA
GetVersionExA
GetWindowsDirectoryA
GetLogicalDrives
SetEndOfFile
CreateFileA
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LocalFree
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
GetTickCount

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathA

ole32

CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize

oleaut32

SysFreeString
VariantInit
SysAllocString
VariantClear

msvcr100

strcat_s
malloc
strcpy_s
??3@YAXPAX@Z
strrchr
??2@YAPAXI@Z
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
atoi
free
sprintf_s
_stricmp
__CxxFrameHandler3
_CxxThrowException
memset
?terminate@@YAXXZ
toupper
?_type_info_dtor_internal_method@type_info@@QAEXXZ

Exports

Exports

CalcEagleAreaSize
ClosePhyDisk
CreateEagleFiles
CreateEagleFilesEx
CreateEmptyFile
EagleFilesMaxSize
EagleFilesMinSize
EagleFindClose
EagleRecommendFilesSize
FindEagleFile
FindFirstEagleFile
FindNextEagleFile
GetDiskLength
GetDriveLayoutInfo
GetPatitionType
GetPhyDiskIdxByLetter
GetSectorsPerFSCluster
GetSysPhyDiskIdx
GetVolFreeSpace
OpenPhyDisk
ReadWriteSector
SortPartition

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d35b5945f2635ccb3b795abd01eeef50

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

oleaut32

msvcr100

Exports

Exports

Sections

.text Size: 18KB - Virtual size: 17KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 936B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 936B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB