NEAS[.]c3ff73777ed55854fe65c2dcb77edeb0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c3ff73777ed55854fe65c2dcb77edeb0.exe
Size

80KB
MD5

c3ff73777ed55854fe65c2dcb77edeb0
SHA1

93181547d7450abb6266f31b2fc1df51d2cdd2c9
SHA256

764f7ad2fe06a88c4d81be779aabf01dd9a5433912a55220356933c661e3b7f7
SHA512

001abd0fbc2951675e49e4b175d8eec5fa80159b2e3204dd10cd55adc48a0c9229f99a024333b04388960cbea35b1687ee48f195aed4d6512bee6ad7be219c71
SSDEEP

1536:E7n9/HMmmyn7dOfAgnOZICS4AX7knbs11R:E7nRHMm/nRDENx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c3ff73777ed55854fe65c2dcb77edeb0.exe

Files

NEAS.c3ff73777ed55854fe65c2dcb77edeb0.exe
.dll windows:4 windows x86

667235ff62c6b467f2d63e583462e309

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FlushInstructionCache
GetCurrentProcess
lstrlenW
CloseHandle
CreateMutexW
WaitForSingleObject
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
DisableThreadLibraryCalls
GetTickCount
GetFileAttributesW
SetErrorMode
VirtualProtect
CreateFileW
FreeLibrary
GetProcAddress
LoadLibraryW
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrcmpW
lstrcmpiW
CopyFileW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
GetLastError
FormatMessageW
DeleteFileW
LocalFree

user32

GetClientRect
DefWindowProcW
MoveWindow
LoadBitmapW
FindWindowW
EnumWindows
GetWindowTextW
GetSystemMetrics
CharNextW
SendMessageW
RedrawWindow
InvalidateRect
DestroyWindow
IsWindow
EnumChildWindows
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
CreateWindowExW
CallWindowProcW
GetWindowLongW
SetWindowLongW
MessageBoxW

gdi32

DeleteObject
GetObjectW

ole32

CLSIDFromProgID
CoCreateInstance

oleaut32

SysAllocString
SysFreeString

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy

msvcrt

realloc
_vsnwprintf
_waccess
iswspace
_wsplitpath
wcsrchr
_snwprintf
memset
??2@YAPAXI@Z
_purecall
memcpy
memcmp
??3@YAXPAX@Z
free
malloc
_initterm
_adjust_fdiv
memmove

Exports

Exports

WbxClientAgent_AuthModule
WbxClientAgent_GetAgentWnd
WbxClientAgent_RegisterServiceClient
WbxClientAgent_UnRegisterServiceClient
Wbx_MI_AdvanceSlide
Wbx_MI_Annotate
Wbx_MI_BackUpSlide
Wbx_MI_ClosePanel
Wbx_MI_CreateWhiteBoardA
Wbx_MI_CreateWhiteBoardW
Wbx_MI_DeleteViewTab
Wbx_MI_EndMeeting
Wbx_MI_ExitAppShare
Wbx_MI_GetParticipantCount
Wbx_MI_GetParticipantIDByIndex
Wbx_MI_GetParticipantMailA
Wbx_MI_GetParticipantMailW
Wbx_MI_GetParticipantNameA
Wbx_MI_GetParticipantNameW
Wbx_MI_GetParticipantRole
Wbx_MI_GetPollCount
Wbx_MI_GetPollNameA
Wbx_MI_GetPollNameW
Wbx_MI_GetSDKVersionA
Wbx_MI_GetSDKVersionW
Wbx_MI_GetSlideCount
Wbx_MI_GetSlideTitleA
Wbx_MI_GetSlideTitleW
Wbx_MI_GoToFirstSlide
Wbx_MI_GoToLastSlide
Wbx_MI_HideAnnotationPanel
Wbx_MI_HideTray
Wbx_MI_IsPresentationAvailable
Wbx_MI_LoadSharedDocViewTabA
Wbx_MI_LoadSharedDocViewTabW
Wbx_MI_ManageSharedApp
Wbx_MI_MinimizePanel
Wbx_MI_MoveAnnotationPanel
Wbx_MI_MovePanel
Wbx_MI_MoveTray
Wbx_MI_PauseAppShare
Wbx_MI_PutMeetingDataA
Wbx_MI_PutMeetingDataW
Wbx_MI_PutNotesDataA
Wbx_MI_PutNotesDataW
Wbx_MI_QueuePresentationToSlide
Wbx_MI_RegisterClientSDKA
Wbx_MI_RegisterClientSDKW
Wbx_MI_SaveDocViewA
Wbx_MI_SaveDocViewW
Wbx_MI_SelectView
Wbx_MI_SetActivePoll
Wbx_MI_SetAnnotationMode
Wbx_MI_SetBrowserPanelTitleA
Wbx_MI_SetBrowserPanelTitleW
Wbx_MI_SetBrowserPanelURLA
Wbx_MI_SetBrowserPanelURLW
Wbx_MI_SetMainFrameMinimumWidth
Wbx_MI_SetMainFrameSplitterPos
Wbx_MI_SetMeetingEndPromptFlag
Wbx_MI_SetParticipantRole
Wbx_MI_SetPollResultDataFormat
Wbx_MI_SetViewFullScreen
Wbx_MI_SetViewTabTitleA
Wbx_MI_SetViewTabTitleW
Wbx_MI_ShowAnnotationPanel
Wbx_MI_ShowAttendeesFullScreenInAppShare
Wbx_MI_ShowMeetingManager
Wbx_MI_ShowPanel
Wbx_MI_ShowTray
Wbx_MI_StartNBR
Wbx_MI_StopNBR
Wbx_MI_SyncAttendeeViews
Wbx_MI_UnRegisterClientSDK

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

667235ff62c6b467f2d63e583462e309

Headers

File Characteristics

Imports

kernel32

user32

gdi32

ole32

oleaut32

comctl32

msvcrt

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 42KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 44KB - Virtual size: 42KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 2KB