NEAS[.]e7758ee1bbeff544e2a7cad2c117c2b0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e7758ee1bbeff544e2a7cad2c117c2b0.exe
Size

318KB
MD5

e7758ee1bbeff544e2a7cad2c117c2b0
SHA1

83c9c38619555714876da8c18bcf30712b9246bb
SHA256

21e05bb004dc620886b2722cf6fc4804bb2aa9252b494f799b6e127d96aa179b
SHA512

3bec1b353a3afb9596e5a71c55301b680bed4541e667e7cea5d9bce39454235a9fe3058256ee006d1e4761abb2e0b0600ba0587893bb31609bd6455a071e414f
SSDEEP

6144:Jdp/XkT0rLxX9U3eJ29yKRj5I8uKEG+3gUGk5C7U83fJ2x8:JdpDCeJ29yKRj5I8uKj+QUHba

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e7758ee1bbeff544e2a7cad2c117c2b0.exe

Files

NEAS.e7758ee1bbeff544e2a7cad2c117c2b0.exe
.exe windows:5 windows x86

932cc1e5a6d7844c1e7f8d2704c705be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc

comctl32

PropertySheetW

setupapi

SetupGetLineTextA
SetupIterateCabinetA
SetupGetLineCountA
SetupInitDefaultQueueCallbackEx
SetupInstallFromInfSectionA
SetupCopyErrorA
SetupPromptForDiskA
SetupTerminateFileLog
SetupQueryFileLogA
SetupInitializeFileLogA
SetupQueueCopyA
SetupGetSourceInfoA
SetupGetSourceFileLocationA
SetupInstallFilesFromInfSectionA
SetupFindNextLine
SetupGetStringFieldA
SetupFindFirstLineA
SetupSetDirectoryIdA
SetupCloseInfFile
SetupOpenInfFileA
SetupScanFileQueueA
SetupGetIntField
SetupGetTargetPathA
SetupCloseFileQueue
SetupCommitFileQueueA
SetupOpenFileQueue
SetupDecompressOrCopyFileA
SetupDefaultQueueCallbackA
SetupDefaultQueueCallbackW

user32

wvsprintfW
LoadStringA
LoadStringW
MessageBoxA
PostQuitMessage
DestroyWindow
SendMessageA
SetDlgItemTextA
ShowWindow
EnableWindow
GetDlgItem
DispatchMessageA
TranslateMessage
GetMessageA
CreateDialogParamA
SetForegroundWindow
PostThreadMessageA
SendDlgItemMessageA
SetWindowTextW
GetWindowTextA
EnumChildWindows
SetWindowLongA
PostMessageA
SetDlgItemTextW
GetWindowLongA
LoadBitmapA
GetDlgItemTextA
IsDlgButtonChecked
MessageBoxW
CheckDlgButton
ReleaseDC
GetDC
SystemParametersInfoA
SetFocus
EndDialog
DialogBoxParamA
SetWindowTextA
GetDesktopWindow

ntdll

NtQuerySystemTime
_stricmp
strchr
RtlUnwind
_aulldiv
wcscat
vsprintf
memmove
strncmp
RtlUnicodeStringToAnsiString
_strupr
_alldiv
_strcmpi
strtoul
_snprintf
strstr
_allmul
memchr
strrchr
RtlTimeToTimeFields
_strnicmp
wcslen
swprintf
wcscpy
_itoa
_strlwr
strncpy
_chkstk
NtClose
NtAdjustPrivilegesToken
NtOpenProcessToken
NtShutdownSystem
NtQueryInformationProcess
RtlCharToInteger
sprintf

mpr

WNetGetUniversalNameA
WNetGetUserA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeA

ole32

CoInitialize
CoCreateInstance

msvcrt

_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
isdigit
__p__commode
strcspn
ctime
rename
_tempnam
remove
_lseek
_close
_write
_read
_open
_errno
__p__fmode
__set_app_type
_controlfp
atoi
malloc
_wcsdup
_strdup
calloc
free
getenv

advapi32

QueryServiceStatus
RegFlushKey
EnumDependentServicesA
InitializeAcl
AddAccessAllowedAce
SetFileSecurityA
GetFileSecurityA
GetServiceDisplayNameA
RegOpenKeyA
RegDeleteValueA
OpenSCManagerA
OpenServiceA
StartServiceA
ControlService
CloseServiceHandle
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
FreeSid
RegSetKeySecurity
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA
SetFileSecurityW
GetAclInformation
AddAce
CopySid
GetLengthSid
SetSecurityInfo
GetSecurityDescriptorDacl
SetSecurityDescriptorControl
GetSecurityInfo
AdjustTokenPrivileges
RegUnLoadKeyA
RegLoadKeyA
OpenProcessToken
DeregisterEventSource
ReportEventA
RegisterEventSourceA
GetTokenInformation
SetNamedSecurityInfoA
GetNamedSecurityInfoA
InitiateSystemShutdownA
RegQueryValueExW
RegOpenKeyExW
RegSaveKeyA

kernel32

GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetModuleHandleA
ExitThread
FormatMessageW
ReadFile
GetTickCount
CreateEventA
CreateThread
SetThreadPriority
WaitForSingleObject
SetEvent
RemoveDirectoryA
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableA
SetFilePointer
SetFileTime
WriteFile
VirtualFree
DeviceIoControl
GetPrivateProfileStringA
CopyFileA
GetCurrentProcess
SetEnvironmentVariableA
GetSystemDirectoryA
GetModuleFileNameA
VirtualAlloc
InitializeCriticalSection
GetVersionExA
lstrcmpiA
LocalAlloc
LocalFree
CreateFileA
GetFileSize
GetFileAttributesExA
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateMutexA
GetVolumeInformationW
CreateFileMappingA
MapViewOfFile
Sleep
DeleteFileA
GetThreadLocale
GetLocaleInfoA
GetWindowsDirectoryW
GetDriveTypeA
FindFirstFileA
FindNextFileA
FindClose
MultiByteToWideChar
UnmapViewOfFile
CloseHandle
LoadLibraryA
GetProcAddress
ExpandEnvironmentStringsA
FormatMessageA
SetLastError
GetFileAttributesA
GetLastError
CreateDirectoryA
GetSystemDirectoryW
GetDiskFreeSpaceExA
GetDiskFreeSpaceA
GetComputerNameA
ReleaseSemaphore
InterlockedDecrement
GetCurrentThread
GetExitCodeThread
SetEndOfFile
CreateSemaphoreA
FlushViewOfFile
GetFileTime
GetExitCodeProcess
CreateProcessA
FlushFileBuffers
MoveFileExA
LoadResource
FindResourceA
MapViewOfFileEx
WideCharToMultiByte
OpenEventA
WriteProcessMemory
VirtualAllocEx
CreateRemoteThread
OpenProcess
LoadLibraryW
lstrcmpiW
GetDriveTypeW
lstrcpynW
lstrcpyW
SearchPathW
ExpandEnvironmentStringsW
GetVersionExW
GetStartupInfoA
GetFullPathNameA
GetWindowsDirectoryA
ExitProcess
TerminateThread
SetCurrentDirectoryA
GetSystemInfo
MoveFileA
GetTempFileNameA
lstrlenA
FreeLibrary
GetTempPathA
SetFileAttributesA

gdi32

GetDIBits
GetDeviceCaps
DeleteObject
SetLayout
StretchBlt
BitBlt
SelectObject
CreateCompatibleDC
CreateFontIndirectA

psapi

GetModuleFileNameExA

Sections

.text
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

932cc1e5a6d7844c1e7f8d2704c705be

Headers

DLL Characteristics

File Characteristics

Imports

shell32

comctl32

setupapi

user32

ntdll

mpr

version

ole32

msvcrt

advapi32

kernel32

gdi32

psapi

Sections

.text Size: 173KB - Virtual size: 172KB

.data Size: 1KB - Virtual size: 171KB

.rsrc Size: 142KB - Virtual size: 142KB

.text
Size: 173KB - Virtual size: 172KB

.data
Size: 1KB - Virtual size: 171KB

.rsrc
Size: 142KB - Virtual size: 142KB