NEAS[.]a03acc17278eea02d26dac64dc4b8a40[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a03acc17278eea02d26dac64dc4b8a40.exe
Size

10.0MB
MD5

a03acc17278eea02d26dac64dc4b8a40
SHA1

a0d255f2060679daff20cebc99fc03cce9208ab4
SHA256

370ab85a757493e0387a957bed9cd291cad6779072fc6d94d6b542bbd1f4d2cf
SHA512

de5973b5be37d4d275ef18f75dcef1e26efe32669c1637b820d8dab3c48cbf61cb8d08eaca3edd36f504dd6d26c481a05e56d3fa717799f0806e49461c4b6463
SSDEEP

196608:4GU2R4Y7pBhT8p7UtHJjTyt3pHWf8KFByPbF/WOxA2VHwCqHgG:zU2RD7lCUTjT2HWfHO1WIAcDG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a03acc17278eea02d26dac64dc4b8a40.exe

Files

NEAS.a03acc17278eea02d26dac64dc4b8a40.exe
.exe windows:6 windows x86

444ecd90027fb8888fe4080b008fd252

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryW
SetLastError
GetCurrentProcessId
GetTickCount
FindFirstFileW
GetModuleHandleA
VirtualAlloc
VirtualFree
FindNextFileW
FindClose
GetFileInformationByHandle
SetFileTime
SetFilePointer
SetEndOfFile
ReadFile
GetFileSize
GetStdHandle
MoveFileExW
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetCurrentThreadId
Sleep
CreateEventW
WaitForSingleObject
SetEvent
WaitNamedPipeW
DisconnectNamedPipe
GetTempPathA
GetTempPathW
WriteFile
SetFileAttributesW
RemoveDirectoryW
GetLogicalDriveStringsW
GetFileAttributesW
GetDriveTypeW
DeleteFileW
CreateFileW
CreateFileA
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FreeResource
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
lstrcpyW
lstrcmpiW
OpenProcess
TerminateProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetLastError
RaiseException
CloseHandle
DecodePointer
OutputDebugStringW
OutputDebugStringA
GetModuleHandleW
CreateDirectoryW
WriteConsoleW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
GetStringTypeW
FormatMessageW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetACP
GlobalUnlock
GlobalLock
lstrlenW
ExitProcess
MulDiv
LocalFileTimeToFileTime
SystemTimeToFileTime
LocalFree
GetVersionExW
GlobalAlloc
GetLocalTime
lstrcpynW
IsDebuggerPresent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
ResumeThread
GetModuleHandleExW
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle

user32

GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
SetWindowRgn
MessageBoxW
UpdateWindow
IsWindowEnabled
UpdateLayeredWindow
MoveWindow
GetUpdateRect
CharPrevW
DrawTextW
FillRect
ReleaseCapture
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
SetCursor
InflateRect
UnionRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowRgn
GetDC
OffsetRect
SetCapture
GetKeyState
GetFocus
GetActiveWindow
ShowWindow
wsprintfW
PostMessageW
PostQuitMessage
SetTimer
KillTimer
CharUpperW
SetFocus
CharNextW
IsZoomed
LoadCursorW
IsIconic
IsWindowVisible
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetRect

advapi32

RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW

shell32

SHGetPathFromIDListW
CommandLineToArgvW
DragQueryFileW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteA
ShellExecuteW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
DoDragDrop
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantInit

gdiplus

GdipSetInterpolationMode
GdipFillPath
GdipDrawPath
GdipSetSmoothingMode
GdipAlloc
GdipFree
GdipCreatePath
GdipDeletePath
GdipStartPathFigure
GdipClosePathFigure
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdipSetLinePresetBlend
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdipAddPathLineI
GdipAddPathArcI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateLineBrushI
GdiplusStartup
GdiplusShutdown
GdipAddPathLine
GdipAddPathArc
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipSetTextRenderingHint
GdipImageSelectActiveFrame
GdipDrawRectangleI
GdipFillRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize

shlwapi

PathFileExistsW
PathRemoveBackslashW
PathRemoveFileSpecW
SHDeleteKeyW
PathIsRootW

ws2_32

gethostname
WSAStartup
gethostbyname

gdi32

Rectangle
RestoreDC
SaveDC
SelectObject
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
CreateRectRgn
PtInRegion
CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
RemoveFontMemResourceEx
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GdiFlush
CreatePatternBrush
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateSolidBrush
BitBlt
CreateCompatibleBitmap

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 942KB - Virtual size: 941KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 218KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51.7MB - Virtual size: 51.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

444ecd90027fb8888fe4080b008fd252

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

gdiplus

shlwapi

ws2_32

gdi32

comctl32

imm32

Sections

.text Size: 942KB - Virtual size: 941KB

.rdata Size: 218KB - Virtual size: 218KB

.data Size: 17KB - Virtual size: 25KB

.rsrc Size: 51.7MB - Virtual size: 51.7MB

.reloc Size: 54KB - Virtual size: 54KB

.text
Size: 942KB - Virtual size: 941KB

.rdata
Size: 218KB - Virtual size: 218KB

.data
Size: 17KB - Virtual size: 25KB

.rsrc
Size: 51.7MB - Virtual size: 51.7MB

.reloc
Size: 54KB - Virtual size: 54KB