NEAS[.]870c31880dc8bd0c66b4ff71c353eae0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.870c31880dc8bd0c66b4ff71c353eae0.exe
Size

2.2MB
MD5

870c31880dc8bd0c66b4ff71c353eae0
SHA1

9e01bdb667c380b4962d09f17a225f5ce9150e63
SHA256

7a607348c83398bd463eb177eec2450fda8893d6b96c6bcd0efb8e7bdae11b35
SHA512

6d6dc8ad655741bddb68abd5977b31940955741286850445244fbe306bb34543565402b4de5fe15d13d6b57b328108f5fc8b66a3c4b72e59772e19200cdac56e
SSDEEP

24576:A1FgxVXMV+P4Wbt8yOiHZB5a5VeRbFqyiRb8ZTR3tkI+fk90+ZzEVpADtjSQFrSN:A8bg+PgS5a5VKww7uO6p25dFaB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.870c31880dc8bd0c66b4ff71c353eae0.exe

Files

NEAS.870c31880dc8bd0c66b4ff71c353eae0.exe
.exe windows:5 windows x86

a9a7ab9d79fd6c149d04d29d6620f725

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

clock
_access
toupper
isalpha
setlocale
_CItan
frexp
_hypot
ldexp
_CIasin
_CIacos
ceil
_CIsqrt
_CIcos
_CIsin
_endthreadex
_beginthreadex
vsprintf
_chmod
_write
_read
_getpid
_close
??3@YAXPAX@Z
_stricmp
_exit
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_XcptFilter
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
_ltoa
_chsize
_lseek
_sopen
_strdup
__RTtypeid
realloc
rename
strerror
_utime32
fseek
_vsnprintf
??0exception@std@@QAE@XZ
memcpy
_fullpath
_strupr
strstr
_difftime32
_errno
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
_splitpath
fgets
strrchr
_CIfmod
strncat
isgraph
__RTDynamicCast
abort
strtok
malloc
free
sscanf
strpbrk
isdigit
atoi
floor
memmove
memset
getenv
_tempnam
_cwait
_unlink
fopen
fread
fclose
qsort
_purecall
strncpy
_stat32
strchr
signal
exit
atof
__iob_func
fprintf
sprintf
_CIatan2
strncmp
??_U@YAPAXI@Z
??_V@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler3
_time32
_ctime32

wsock32

gethostbyaddr
gethostbyname
ioctlsocket
gethostname
WSAStartup
WSAGetLastError
send
WSACleanup
getservbyname
ntohs
connect
inet_addr
recv
htons
socket
closesocket
shutdown
select
htonl
ntohl

mpr

WNetGetUserA
WNetGetConnectionA

bdif_execcode_nx_c9

?RequestCode@CBDIF_ExecCode@@QAEXPADHPBD@Z
?GetSizeOfCode@CBDIF_ExecCode@@QAEHXZ
??1CBDIF_ExecCode@@UAE@XZ
??0CBDIF_ExecCode@@QAE@XZ

mfc90

ord2481
ord4392
ord601
ord310
ord817
ord316
ord1603
ord820
ord2539
ord4506

kernel32

GetFileAttributesA
CreateFileA
DeviceIoControl
GetCurrentThread
GetCurrentProcess
CloseHandle
ExpandEnvironmentStringsA
GetLongPathNameA
Sleep
GetModuleFileNameA
GetLastError
CreateProcessA
CopyFileA
GetProcAddress
FreeLibrary
GetFullPathNameA
SystemTimeToFileTime
GetSystemTime
HeapAlloc
HeapCreate
TerminateProcess
HeapFree
HeapSize
WaitForSingleObject
InterlockedExchange
InterlockedCompareExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA

user32

LoadStringA
MessageBoxA

advapi32

OpenThreadToken
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
GetFileSecurityA
RegCloseKey

msvcp90

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ

bmb_nx_c9

?GetArea@BMBCapacitance@@QAENXZ
?GetResistanceName@BMBPart@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?ScanElement@BMBMapResistance@@QAEPAVBMBResistance@@PBD@Z
?GetNameCapacitance@BMBResistance@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?GetResistance@BMBResistance@@QAENXZ
?GetRatingName@BMBPart@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?ScanElement@BMBMapRating@@QAEPAVBMBRating@@PBD@Z
?GetPower@BMBRating@@QAENXZ
?GetMinPower@BMBRating@@QAENXZ
?GetMaxPower@BMBRating@@QAENXZ
?GetHeatDssp@BMBRating@@QAENXZ
?GetMinHeatDssp@BMBRating@@QAENXZ
?GetMaxHeatDssp@BMBRating@@QAENXZ
?GetRotation@BMBPart@@QAEMXZ
?GetX@BMBPart@@QAEMXZ
?GetY@BMBPart@@QAEMXZ
?GetMountSide@BMBPart@@QAEEXZ
?IsLocateLock@BMBPart@@QAE_NXZ
?IsAngleLock@BMBPart@@QAE_NXZ
?IsSideLock@BMBPart@@QAE_NXZ
?GetMapMaterial@BMBProduct@@QAEPAVBMBMapMaterial@@XZ
?ScanRecord@BMBTableLayer@@QAEPAVBMBLayer@@PBD@Z
?GetMaterialName@BMBLayer@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?ScanElement@BMBMapMaterial@@QAEPAVBMBMaterial@@PBD@Z
?GetMassDensity@BMBMaterial@@QAENXZ
?GetYoungModulus@BMBMaterial@@QAENXZ
?GetThermalConductivity@BMBMaterial@@QAENH@Z
?GetSpecificHeat@BMBMaterial@@QAENXZ
?GetSurfaceEmissivity@BMBMaterial@@QAENXZ
?GetSurfaceRoughness@BMBMaterial@@QAENXZ
?GetText@BMBComment@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetAngle@BMBComment@@QAENXZ
?GetP1@BMBComment@@QAENXZ
?GetP2@BMBComment@@QAENXZ
?GetLength@BMBComment@@QAENXZ
?GetHeight@BMBComment@@QAENXZ
?GetHeatLoadFraction@BMBCapacitance@@QAENXZ
??0BMB2DGeUnit@@QAE@XZ
?GetGeUnit@BMB2DGeometry@@QAE?AVBMB2DGeUnit@@H@Z
??1BMB2DGeUnit@@UAE@XZ
??0BMB2DArea@@QAE@XZ
?GetArea@BMBSheet@@QAEXAAVBMB2DArea@@@Z
??1BMB2DArea@@UAE@XZ
?GetBoard@BMBSheet@@QAEPAVBMBBoard@@XZ
?GetThickness@BMBBoard@@QAEMXZ
??1BMBFile@@UAE@XZ
?XMLInput@BMBFile@@UAEXPAVEMXMLAttribute@@@Z
?XMLOutput@BMBFile@@UAEXPAVEMXMLWriter@@@Z
??0BMBFile@@QAE@E@Z
?PutFilePath@BMBFile@@QAEXPBD@Z
?XMLRead@BMBFile@@QAE_NXZ
?GetPCB@BMBFile@@QAEPAVBMBProduct@@XZ
?GetSheet@BMBProduct@@QAEPAVBMBSheet@@H@Z
?GetTableLayer@BMBProduct@@QAEPAVBMBTableLayer@@XZ
?GetWorkLayerNumber@BMBSheet@@QAEFXZ
?ScanRecord@BMBTableLayer@@QAEPAVBMBLayer@@F@Z
?GetCapacitance@BMBCapacitance@@QAENXZ
?ScanElement@BMBMapCapacitance@@QAEPAVBMBCapacitance@@PBD@Z
?GetCapacitanceName@BMBPart@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetMaterialName@BMBPart@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetUserProperty@BMBPart@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetDevName@BMBPart@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetShapeName@BMBPart@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetPartName@BMBPart@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetRefName@BMBPart@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetPart@BMBSheet@@QAEPAVBMBPart@@H@Z
?CountElement@BMBSheet@@QAEHE@Z
?Count2DShape@BMBElement@@QAEHXZ
?GetType@BMBSymbol@@QAEEXZ
?GetHole@BMBSheet@@QAEPAVBMBHole@@H@Z
?GetVectorDirection@BMBBendLine@@QAEXAAU_BMB_3DVectorD_t@@@Z
?GetPointDirection@BMBBendLine@@QAEXAAU_BMB_3DVectorD_t@@@Z
?GetLayerNumber@BMBBendLine@@QAEFXZ
?GetBendLine@BMBBoard@@QAEPAVBMBBendLine@@H@Z
?CountBendLine@BMBBoard@@QAEHXZ
?GetSubArea@BMBBoard@@QAEPAVBMB2DConstraint@@H@Z
?CountSubArea@BMBBoard@@QAEHXZ
?GetMaterialName@BMBBoard@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
?GetRank@BMB2DConstraint@@QAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?GetElementColor@BMBElement@@QAEKXZ
?GetVectorSide@BMBBendLine@@QAEXAAU_BMB_3DVectorD_t@@@Z
?GetAngle@BMBBendLine@@QAENXZ
?GetRadius@BMBBendLine@@QAENXZ
?GetMapRating@BMBProduct@@QAEPAVBMBMapRating@@XZ
?GetMapResistance@BMBProduct@@QAEPAVBMBMapResistance@@XZ
?GetMapCapacitance@BMBProduct@@QAEPAVBMBMapCapacitance@@XZ
?GetWidth@BMBComment@@QAENXZ
?Get2DShape@BMBElement@@QAEPAVBMB2DGeometry@@H@Z
?GetComment@BMBSheet@@QAEPAVBMBComment@@H@Z
?GetLayerNumber@BMBComment@@QAEFXZ
?Get2DConstraint@BMBSheet@@QAEPAVBMB2DConstraint@@H@Z
?GetLayerNumber@BMBSymbol@@QAEFXZ
?CountSymbol@BMBLayer@@QAEHXZ
?GetSymbol@BMBLayer@@QAEPAVBMBSymbol@@H@Z
?GetHeight@BMB2DConstraint@@QAEMXZ
?GetStandOff@BMB2DConstraint@@QAEMXZ
?GetID@BMBElement@@QAEJXZ
?GetPointSide@BMBBendLine@@QAEXAAU_BMB_3DVectorD_t@@@Z

emxml_c9

?GetSerialID@EMXMLInterface@@UAEHXZ

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 226KB - Virtual size: 226KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 44KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 69KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a9a7ab9d79fd6c149d04d29d6620f725

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

wsock32

mpr

bdif_execcode_nx_c9

mfc90

kernel32

user32

advapi32

msvcp90

bmb_nx_c9

emxml_c9

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 226KB - Virtual size: 226KB

.data Size: 44KB - Virtual size: 149KB

.rsrc Size: 69KB - Virtual size: 72KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 226KB - Virtual size: 226KB

.data
Size: 44KB - Virtual size: 149KB

.rsrc
Size: 69KB - Virtual size: 72KB