NEAS[.]ec0129a03d6c554486588d688788b890[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.ec0129a03d6c554486588d688788b890.exe
Size

220KB
MD5

ec0129a03d6c554486588d688788b890
SHA1

4c93a06a950665ca1f2077b2a63ea151ff860b03
SHA256

7a7ca8573ce420fb30c4e1d1e10c649125d8a075eb79041607b0d71efcc79b76
SHA512

c28842591946624eb10b17cff5abd7c4232528796b63d7de4e73efa71f63a9808b741fcb17cd1e972076b77cc190ab85636fbf84e2cc7ef21c262a538d83f027
SSDEEP

3072:ZzTihdr8MXwE8Hq5X0ZV5vvd22d8aroRDKxl53GGyFuubvuuuFnuym6+IZkk8itS:ZzG6q5kZV5vUYPp23uJzOAHfRhZ4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ec0129a03d6c554486588d688788b890.exe

Files

NEAS.ec0129a03d6c554486588d688788b890.exe
.dll windows:4 windows x86

17a9cb86d1aeca08be7a7c25009785e3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc80u

ord265
ord577
ord280
ord765
ord315
ord1079
ord1033
ord1087
ord1197
ord1199
ord1093
ord371
ord1908
ord1162
ord1115
ord1192
ord1168
ord1170
ord1200
ord581
ord774
ord293
ord2895
ord2261
ord870
ord1472
ord4101
ord4100
ord266
ord1058
ord4026
ord283
ord5398
ord2460
ord776
ord2121
ord2260
ord3927
ord899
ord2444
ord6167
ord6173
ord3990
ord1479
ord6111
ord282
ord6700
ord762
ord5558
ord896
ord6165
ord894
ord4074
ord5414
ord5485
ord4078
ord5705
ord2311
ord5524
ord1118
ord900
ord860
ord757
ord4032
ord4008
ord6272
ord3795
ord6274
ord4320
ord2054
ord2009
ord5579
ord3800
ord1007
ord5096
ord6215
ord5378
ord3826
ord1911
ord2925
ord5220
ord5222
ord2239
ord3942
ord4562
ord5226
ord5209
ord5562
ord3824
ord2531
ord2725
ord2829
ord4301
ord2708
ord2832
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4475
ord4255
ord3327
ord566
ord3677
ord314
ord3842
ord557
ord745
ord6751
ord5712
ord777
ord287
ord290
ord6002
ord1176
ord764

msvcr80

malloc
sprintf
__CxxFrameHandler3
rand
wcsstr
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memmove_s
_wtoi
wcstoul
wcsrchr
_vswprintf
_wcslwr
free
memcpy
??0exception@std@@QAE@XZ
_malloc_crt
atoi
_CIpow
wcstombs
fclose
fprintf
_wfopen
_swprintf
vsprintf
strchr
strstr
strncmp
tolower
strncpy
fwrite
fread
ftell
fseek
fopen
_except_handler4_common
_unlock
__clean_type_info_names_internal
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
memset
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit

kernel32

GetLocaleInfoA
GetThreadLocale
GetWindowsDirectoryW
GetACP
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
MultiByteToWideChar
GetLocalTime
CreateDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetVersion
GetProcAddress
GetCurrentThread
LocalAlloc
LocalFree
GetPrivateProfileStringW
CreateProcessW
GetCurrentProcess
GetVolumeInformationW
OutputDebugStringW
GetVersionExW
GetLastError
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetModuleFileNameW
GetFullPathNameW
GetModuleHandleW
lstrcatW
lstrlenW
WinExec
MulDiv
GetVersionExA
LoadLibraryW
lstrcpyW
WideCharToMultiByte
LoadLibraryExW
FreeLibrary
CloseHandle

user32

FillRect
MessageBoxW
GetActiveWindow
GetLastActivePopup
ReleaseDC
DialogBoxIndirectParamW
BeginPaint
EndPaint
GetDC
ExitWindowsEx
CreateIconIndirect
GetCursorPos
ScreenToClient
WinHelpW
EndDialog
GetParent
GetWindowRect
GetIconInfo
MessageBeep
MoveWindow
SetWindowPos
SetForegroundWindow
SetTimer
CreateWindowExW
SetFocus
DestroyWindow
LoadIconW
GetClientRect
KillTimer
GetSystemMenu
EnableMenuItem
GetWindowLongW
SetWindowLongW
DrawEdge
DrawStateW
GetSystemMetrics
GetSysColor
SetCursor
DestroyCursor
LoadCursorW
SendMessageW
SystemParametersInfoW
LoadStringW
DestroyIcon
CopyIcon
LoadImageW

gdi32

DeleteDC
BitBlt
SelectObject
DeleteObject
GetStockObject
TextOutW
SetTextJustification
GetDeviceCaps
GetTextExtentPoint32W
CreateFontIndirectW
GetTextMetricsW
SetBkMode
SetBkColor
SetTextColor
CreateCompatibleBitmap
CreatePen
MoveToEx
LineTo
CreateSolidBrush
CreateBitmap
StretchBlt
GetObjectW
CreateDIBSection
CreateCompatibleDC

advapi32

RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyW
RegCreateKeyW
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyW
RegEnumKeyW
RegQueryValueW

shell32

ShellExecuteW
SHGetSpecialFolderPathW

comctl32

ord17
ImageList_GetIcon
ImageList_GetImageCount

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

Exports

Exports

??0CParse@@QAE@ABV0@@Z
??0CParse@@QAE@XZ
??1CParse@@QAE@XZ
??4CParse@@QAEAAV0@ABV0@@Z
?FindDelimiter@CParse@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@HH@Z
?GetStringTillDelimiter@CParse@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AAV23@HH@Z
?SetString@CParse@@QAEHV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
EnumMailClients
GetBrandName
GetByteNumFromHex
GetCurrentPath
GetDefaultBrowserExe
GetDefaultEMailClientExe
GetDefaultMailClient
GetDefaultMailClientAndPath
GetFileString
GetHomePage
GetIPAddrFromString
GetMailPath
GetNumFromHex
GetOS
GetOsVersion
GetOsVersionString
GetParentDir
GetProcesses
GetProductName
GetRealBytes
GetStringFromBYTEArray
GetUniqueNumber
GetWebToGoDataFolder
IsAdmin
IsHex
IsNumeric
IsProcessAlive
IsSDKSupported
IsValidKey
Log
Maximum
MessageBox2
Minimum
POINTTOHEIGHT
RegAddInstalledFiles
RestartWindows
RunFireFoxBrowser
SetMessageBox2Language
SetPrivilege
ShutdownWindows
StartDefaultBrowser
StartDefaultBrowser1
StartDefaultMailClient
StartMailClient
TRACE_REL
WtgGetString
WtgMessageBoxEx
WtgTruncate
hexchtoi
wildcmp

Sections

.text
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

17a9cb86d1aeca08be7a7c25009785e3

Headers

File Characteristics

Imports

mfc80u

msvcr80

kernel32

user32

gdi32

advapi32

shell32

comctl32

msvcp80

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 152KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 13KB

.text
Size: 156KB - Virtual size: 152KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 13KB