NEAS[.]8516b781b21703d643c73936885701f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.8516b781b21703d643c73936885701f0.exe
Size

100KB
MD5

8516b781b21703d643c73936885701f0
SHA1

fde9db181db168ed0d5a1ec833b3a136bc332e7d
SHA256

8266849de669ef3a198b361a0983732ef671fc1ff487862f59e63a220d37056f
SHA512

b17b922c65a60a4eac3e414467c06a644a2c12678dc52fca87657bfd4166b624a625499b35362f569cf967421191020fb5eee3d623d247a0f960112a577b96ec
SSDEEP

1536:CLXB1M5UgHOuGAls2iyIepJCNuOLZ/WQEgVpIW8tsjusC2hdvSCWx:YXgUyJ5UPBWQr/IW8tsjusC2hqx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.8516b781b21703d643c73936885701f0.exe

Files

NEAS.8516b781b21703d643c73936885701f0.exe
.exe windows:4 windows x86

17e444125104162a614ec7679c857e38

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

psapi

EnumProcesses
GetModuleBaseNameW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

LoadResource
FindResourceW
CreateFileW
GetSystemDirectoryW
WaitForMultipleObjects
ResetEvent
CreateEventW
WaitForSingleObject
FreeLibrary
GetModuleFileNameW
LoadLibraryW
SetEvent
OpenProcess
CreateThread
DisconnectNamedPipe
FlushFileBuffers
LockResource
ConnectNamedPipe
CreateNamedPipeW
FindClose
FindNextFileW
lstrcpynW
lstrcmpW
FindFirstFileW
WideCharToMultiByte
GetCurrentThreadId
CreateMutexA
lstrlenW
InterlockedDecrement
lstrcatW
InterlockedIncrement
GetLocalTime
GetModuleFileNameA
GetModuleHandleW
DeleteFileA
SetFilePointer
OutputDebugStringA
CreateFileA
SetLastError
CreateDirectoryA
SizeofResource
WriteFile
DeleteCriticalSection
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetLastError
FormatMessageW
LocalFree
InterlockedExchange
InitializeCriticalSection
lstrcpyW
Sleep
GetVersion
GetCommandLineW
lstrcmpiW
GetModuleHandleA
GetProcAddress
LoadLibraryA
CloseHandle
GetStartupInfoW
ReadFile

user32

GetMessageW
CharNextW
TranslateMessage
PostThreadMessageW
DispatchMessageW
wsprintfW

advapi32

CreateServiceW
DeleteService
RegOpenKeyExA
RegQueryValueExA
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
StartServiceCtrlDispatcherW
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
DuplicateTokenEx
ImpersonateLoggedOnUser
RevertToSelf
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetServiceStatus
OpenServiceW
OpenSCManagerW
ControlService
RegDeleteKeyW
RegisterServiceCtrlHandlerW
CreateProcessAsUserW
GetTokenInformation
CloseServiceHandle

ole32

CoInitialize
CoUninitialize

oleaut32

SysAllocString
SysFreeString
SetErrorInfo
VariantInit
VariantClear
VariantChangeType
CreateErrorInfo
GetErrorInfo

msvcrt

??1type_info@@UAE@XZ
_CxxThrowException
_beginthreadex
_purecall
??3@YAXPAX@Z
wcsrchr
_except_handler3
wcscpy
wcslen
??2@YAPAXI@Z
_local_unwind2
__CxxFrameHandler
free
malloc
time
_stat
_wstat
wprintf
_wtoi
wcspbrk
_wcslwr
_vsnprintf
realloc
strrchr
sprintf
strstr
_vsnwprintf
__dllonexit
_onexit
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

msvcp60

??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??1_Lockit@std@@QAE@XZ
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
??0_Lockit@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17e444125104162a614ec7679c857e38

Headers

File Characteristics

Imports

userenv

psapi

version

kernel32

user32

advapi32

ole32

oleaut32

msvcrt

msvcp60

Sections

.text Size: 60KB - Virtual size: 58KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 16KB - Virtual size: 12KB

.text
Size: 60KB - Virtual size: 58KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 16KB - Virtual size: 12KB