NEAS[.]89ab5f2b640f7916bd40044262e03e80[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.89ab5f2b640f7916bd40044262e03e80.exe
Size

336KB
MD5

89ab5f2b640f7916bd40044262e03e80
SHA1

450ee1a3627cad4c60521196052b84d057b1368a
SHA256

2a84d75a7c760c18df4b554935781b6918b3469c73e433bd219b13ab5697c3db
SHA512

454bfd4d1f9d757ef2b76b26cf3008ac904d06aa4bd23f4a4f272a48a451700b982290d9ca90d16f6ac31baefd613e786c7237560391852d01b4dc4e039402d4
SSDEEP

6144:PtJHLLEYZoRN7OUD4W1xbSyHMSbTTsxVum7ZUtPwMLD4McbN61zxeoysnpmGAwYH:VJ/xZaUWSyvT9Z3WNQxoDnN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.89ab5f2b640f7916bd40044262e03e80.exe

Files

NEAS.89ab5f2b640f7916bd40044262e03e80.exe
.dll windows:6 windows x86

88e8d06c7644a9db60528381f2155f8e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc100

ord5443
ord1288
ord7510
ord11180
ord9449
ord11787
ord11726
ord4078
ord13767
ord4724
ord2163
ord11421
ord11420
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord7091
ord1732
ord10922
ord14075
ord13181
ord11413
ord7144
ord13483
ord13480
ord7584
ord13482
ord13484
ord13481
ord888
ord6112
ord3409
ord5238
ord11172
ord7355
ord11184
ord11153
ord4622
ord4903
ord5095
ord8439
ord4881
ord5098
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9281
ord8304
ord13518
ord322
ord13485
ord1929
ord1316
ord901
ord316
ord1294
ord906
ord2090
ord2052
ord2050
ord2079
ord1979
ord2040
ord3406
ord408
ord1948
ord2089
ord2087
ord1940
ord1867
ord323
ord1297
ord310
ord2611
ord265
ord1296

msvcr100

memset
_stricmp
wcsncpy_s
strtok_s
__CxxFrameHandler3
memcpy
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_CxxThrowException

mapi32

ord15
ord13
ord140
ord21
ord23
ord11
ord44
ord45
ord17

kernel32

LoadLibraryA
SetLastError
RaiseException
MultiByteToWideChar
SystemTimeToFileTime
FileTimeToSystemTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
WerRegisterMemoryBlock
VirtualProtect
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
HeapSetInformation
GetProcessHeap
QueryPerformanceCounter
LocalAlloc
LocalFree
GetTimeZoneInformation
GetSystemTimeAsFileTime
lstrlenA
lstrcmpiA
lstrcmpA
LoadLibraryExA
GetModuleHandleW
GlobalFree
GlobalAlloc
GetModuleHandleExA
GetLastError
GetLocalTime
GlobalUnlock
GlobalLock
GlobalReAlloc
GetProcAddress
GetModuleHandleA
FreeLibrary

mso

ord1594
ord6137
ord1525
ord8953
ord491

Exports

Exports

ABORTFAE
CLOSEFILEFAE
GETDEFAULTFILEFAE
GETFORMATDESCFAE
GETFORMATSFAE
GETMAPINFOFAE
GETRECORDFAE
INITIALIZEFAE
OPENFILEFAE
OPENFILEMAPFAE
PUTMAPINFOFAE
PUTRECORDFAE
RECOGNIZEFAE
TERMINATEFAE

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 256KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

88e8d06c7644a9db60528381f2155f8e

Headers

DLL Characteristics

File Characteristics

Imports

mfc100

msvcr100

mapi32

kernel32

mso

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 76KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 256KB - Virtual size: 260KB

.text
Size: 76KB - Virtual size: 76KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 256KB - Virtual size: 260KB