NEAS[.]94eb9684f2384ec028404e5a248cf0c0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.94eb9684f2384ec028404e5a248cf0c0.exe
Size

2.4MB
MD5

94eb9684f2384ec028404e5a248cf0c0
SHA1

9548482db5dc72582c4fa17eb58959f532fc4db5
SHA256

7dc4c3dfbb7ac7b3c5335cf35296cccb9fcadf6d5bbe12640844ec7639fb2589
SHA512

9908e0447a282ecdb3796c4be1c302b6b50ecfe83863b6a68e72de1c24cac993a155cd18fc078e916ef08c8a87a9f657e13248a4610578db13fb0fd55e232489
SSDEEP

24576:VBvveqlWtpWTQvvOMEjPNUtqqk+QimYmQWmAl6Stw2SAulOsLF+ELhgDLARJ+P8n:neq2vyjPetq6mR6peWOsLFaC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.94eb9684f2384ec028404e5a248cf0c0.exe

Files

NEAS.94eb9684f2384ec028404e5a248cf0c0.exe
.exe windows:4 windows x86

013e6da200a883fc9ca226ed9c033a10

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CopyFileA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
ReadFile
WaitForSingleObject
MoveFileExA
SetPriorityClass
GetCurrentProcess
GetCommandLineA
CreateProcessA
CreateThread
CreateSemaphoreA
DeleteFileA
GetTempPathA
GetDiskFreeSpaceExA
FindClose
FindFirstFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetCurrentProcessId
TerminateProcess
ReleaseSemaphore
CreateFileW
GetVersion
GetLocalTime
GetWindowsDirectoryA
GetVersionExA
GetShortPathNameA
SetFileAttributesA
lstrcpyA
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetStringTypeA
GetOEMCP
LocalAlloc
LocalFree
IsBadReadPtr
GetSystemInfo
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
OpenProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualAlloc
VirtualFree
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
GetACP
GetCPInfo
SetFilePointer
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsBadCodePtr
SetUnhandledExceptionFilter
lstrcatA
CreateFileA
Sleep
GetFileSize
WriteFile
lstrlenA
lstrcmpA
Module32First
VirtualProtectEx
ReadProcessMemory
Module32Next
DeviceIoControl
IsBadWritePtr
GetLastError
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetStartupInfoA
RtlUnwind
RemoveDirectoryA
CreateDirectoryA
ExitProcess
HeapFree
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
CloseHandle

user32

MessageBoxA
wsprintfA
GetWindowThreadProcessId
GetParent
GetSystemMetrics
WaitForInputIdle

advapi32

RegCloseKey
ControlService
DeleteService
CreateServiceA
StartServiceA
RegSetValueExA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExA
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid

shell32

ShellExecuteExA
SHChangeNotify
FindExecutableA

setupapi

SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

hid

HidD_GetAttributes
HidD_FreePreparsedData
HidP_GetCaps
HidD_GetFeature
HidD_SetFeature
HidD_GetHidGuid
HidD_GetPreparsedData

psapi

EnumProcessModules
GetModuleFileNameExA
GetModuleInformation

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

013e6da200a883fc9ca226ed9c033a10

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

setupapi

hid

psapi

Sections

.text Size: 60KB - Virtual size: 59KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 40KB - Virtual size: 52KB

.rsrc Size: 2.3MB - Virtual size: 2.3MB

.text
Size: 60KB - Virtual size: 59KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 40KB - Virtual size: 52KB

.rsrc
Size: 2.3MB - Virtual size: 2.3MB