NEAS[.]c9ab9154b00fcc2c4ebc8fc866f42b50[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c9ab9154b00fcc2c4ebc8fc866f42b50.exe
Size

311KB
MD5

c9ab9154b00fcc2c4ebc8fc866f42b50
SHA1

24698edfb105eb0375ded8d4131c507ab3fd87e1
SHA256

c94d198f668d1997a29d5c69df517d4df4c4a0eb85ae80e8f02f2151a358b0e5
SHA512

a4e8f438289ce2fc10ac278b3f2463c3cf23efc650a858e203aa69ed46e30a1313b6d55a1785c0f16d2093ece2a337fbf7e038f7012acfdd3595eb88595ceedc
SSDEEP

6144:URk1+P1ush+7O4qq/xg0EMeERbfeyuwondWgCTX+dGDrCWuRXtFIFg:0k1+P13gg0EFENGyuwond9CTKWuRXtF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c9ab9154b00fcc2c4ebc8fc866f42b50.exe

Files

NEAS.c9ab9154b00fcc2c4ebc8fc866f42b50.exe
.dll windows:6 windows x86

02b744722df164969fedf36fb857cf8a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc100

ord5443
ord1288
ord7510
ord11180
ord9449
ord11787
ord11726
ord4078
ord7141
ord13767
ord4724
ord2163
ord11421
ord11420
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord7091
ord1732
ord10922
ord14075
ord13181
ord11413
ord7144
ord13483
ord7584
ord13485
ord13482
ord13484
ord13481
ord888
ord6112
ord3409
ord5238
ord11172
ord7355
ord11184
ord11153
ord4622
ord4903
ord5095
ord8439
ord4881
ord5098
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9281
ord8304
ord13518
ord13480
ord322
ord1316
ord901
ord316
ord1294
ord906
ord2090
ord2052
ord2050
ord2079
ord1979
ord2040
ord3406
ord408
ord1948
ord2089
ord2087
ord1940
ord1867
ord1929
ord323
ord1297
ord310
ord2611
ord265
ord1296

msvcr100

memset
_stricmp
wcsncpy_s
strtok_s
__CxxFrameHandler3
memcpy
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_CxxThrowException

mapi32

ord15
ord13
ord140
ord21
ord23
ord11
ord44
ord45
ord17

kernel32

LoadLibraryA
SetLastError
RaiseException
MultiByteToWideChar
SystemTimeToFileTime
FileTimeToSystemTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
WerRegisterMemoryBlock
VirtualProtect
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
HeapSetInformation
GetProcessHeap
QueryPerformanceCounter
LocalAlloc
LocalFree
GetTimeZoneInformation
GetSystemTimeAsFileTime
lstrlenA
lstrcmpiA
lstrcmpA
LoadLibraryExA
GetModuleHandleW
GlobalFree
GlobalAlloc
GetModuleHandleExA
GetLastError
GetLocalTime
GlobalUnlock
GlobalLock
GlobalReAlloc
GetProcAddress
GetModuleHandleA
FreeLibrary

mso

ord1594
ord6137
ord1525
ord8953
ord491

Exports

Exports

ABORTFAE
CLOSEFILEFAE
GETDEFAULTFILEFAE
GETFORMATDESCFAE
GETFORMATSFAE
GETMAPINFOFAE
GETRECORDFAE
INITIALIZEFAE
OPENFILEFAE
OPENFILEMAPFAE
PUTMAPINFOFAE
PUTRECORDFAE
RECOGNIZEFAE
TERMINATEFAE

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 238KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

02b744722df164969fedf36fb857cf8a

Headers

DLL Characteristics

File Characteristics

Imports

mfc100

msvcr100

mapi32

kernel32

mso

Exports

Exports

Sections

.text Size: 70KB - Virtual size: 70KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 238KB - Virtual size: 240KB

.text
Size: 70KB - Virtual size: 70KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 238KB - Virtual size: 240KB