NEAS[.]e5fa9f39c128e6078d99b8a9513f6800[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.e5fa9f39c128e6078d99b8a9513f6800.exe
Size

956KB
MD5

e5fa9f39c128e6078d99b8a9513f6800
SHA1

3b77c5087bd99a625015306f6bbfe7b4179377f3
SHA256

8cbe77797a91fef4a32d14feec51ed4bcf45e658f8144cfedbd64bc69c0ce540
SHA512

17e6312e13a5c40bebb5aaba5c4df9218fac7986efbb7b495b11656b1c15c98a434eacd93a9b762fc83338b9f3399a29db0636046a1ccc4d2b5a499d23fdcb74
SSDEEP

12288:Z2SJUDbhSiPXo380LkU11XxtWE0WLu/ZQnYCzAK6Xt/YcFbYJQ+T1jqrb:Z2dDboiQZNrXb6Czz6tYzJQ+8b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e5fa9f39c128e6078d99b8a9513f6800.exe

Files

NEAS.e5fa9f39c128e6078d99b8a9513f6800.exe
.exe windows:4 windows x86

3f235af829c234a7b8db7380d1667d1b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetCommandLineW
ReleaseSemaphore
CreateSemaphoreW
InterlockedExchange
TryEnterCriticalSection
GetTickCount
GetACP
GetLocaleInfoA
GetThreadLocale
FreeLibrary
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
SetEvent
LeaveCriticalSection
EnterCriticalSection
CreateEventW
CreateThread
GetCurrentThreadId
GetModuleHandleW
Sleep
GetModuleFileNameW
lstrlenA
MultiByteToWideChar
WaitForSingleObject
CloseHandle
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
GetVersionExA
lstrlenW
GetConsoleMode
GetConsoleCP
SetFilePointer
WideCharToMultiByte
GetOEMCP
GetCPInfo
LoadLibraryA
HeapSize
VirtualAlloc
GetCurrentProcessId
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
RtlUnwind
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitThread
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter

user32

LoadStringW
CharUpperW
TranslateMessage
DispatchMessageW
GetMessageW
PostThreadMessageW
MessageBoxW
CharNextW
PostQuitMessage
DefWindowProcW
UnregisterClassA
CreateDialogParamW

advapi32

RegisterServiceCtrlHandlerW
ControlService
DeleteService
CreateServiceW
RegEnumKeyExW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
StartServiceCtrlDispatcherW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoRegisterClassObject
CoTaskMemFree
CoUninitialize
CoInitialize
StringFromGUID2
CoCreateInstance
CoRevokeClassObject
CoInitializeEx

oleaut32

LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen

Sections

.text
Size: 632KB - Virtual size: 631KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 208KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f235af829c234a7b8db7380d1667d1b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

Sections

.text Size: 632KB - Virtual size: 631KB

.rdata Size: 208KB - Virtual size: 204KB

.data Size: 8KB - Virtual size: 37KB

.rsrc Size: 104KB - Virtual size: 100KB

.text
Size: 632KB - Virtual size: 631KB

.rdata
Size: 208KB - Virtual size: 204KB

.data
Size: 8KB - Virtual size: 37KB

.rsrc
Size: 104KB - Virtual size: 100KB