NEAS[.]c51598262a5ba0dea43c5cad737ce220[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.c51598262a5ba0dea43c5cad737ce220.exe
Size

24KB
MD5

c51598262a5ba0dea43c5cad737ce220
SHA1

4680442038177f8aa487fac4b62450920d20a9d1
SHA256

4154f15ec867343ef699edc07b6e957783a3ec1e5ccd0e29924f1f426dca46f5
SHA512

01598697d9ae49dab54d442ab2fae1af4a8d4a34ec9bae1fbe72e87ad0213c5e76c22d476c4cd62d5184af9c67eb90b8463663b4c50a955f0a02d11caa721f4b
SSDEEP

384:kid+95ALTi2hN8E/118b2nLABN/TC/gpdOkwMnXnfeA848688ta97jkIZnPVrTAp:kidpJG8688ta97Ymndrcmho3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c51598262a5ba0dea43c5cad737ce220.exe

Files

NEAS.c51598262a5ba0dea43c5cad737ce220.exe
.dll windows:5 windows x86

d48022255857bdd26667b1fc7a8e538f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
CloseHandle
FileTimeToSystemTime
GetPrivateProfileStringA
GetSystemDirectoryA
LocalFree
CreateMutexA
GetVersionExA
OpenMutexA
FreeLibrary
GetProcAddress
LoadLibraryA
ReleaseMutex
WaitForSingleObject
OutputDebugStringA
GetCurrentDirectoryA
GetModuleFileNameA
FileTimeToLocalFileTime
GetEnvironmentVariableA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer

advapi32

CryptDestroyKey
ConvertStringSecurityDescriptorToSecurityDescriptorA
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptReleaseContext
CryptDestroyHash
CryptVerifySignatureA

crypt32

CryptImportPublicKeyInfo
CryptBinaryToStringA
CertGetNameStringA
CertCreateCertificateContext
CertFreeCertificateContext

msvcr100

__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
vsprintf_s
strcpy_s
??3@YAXPAX@Z
??2@YAPAXI@Z
atoi
_vsnprintf
__CxxFrameHandler3
memcpy
memset

Exports

Exports

LW_CardGenerateRandom
LW_CloseFile
LW_CloseKey
LW_CreateFile
LW_CreateRSAKey
LW_CryptRSAVerifyData
LW_Decrypt
LW_DeleteCertificate
LW_DeleteFile
LW_DeleteRSAKey
LW_Encrypt
LW_Finalize
LW_GetCertificateCount
LW_GetCertificateInfo
LW_GetCertificateLen
LW_GetDevSerial
LW_GetFileLen
LW_GetFreeSpaceEx
LW_GetMaxCertificateCount
LW_GetPublicKey
LW_InitKey
LW_Initialize
LW_OpenFile
LW_OpenKey
LW_PinChange
LW_PinVerify
LW_RSAPrivateKeyDecrypt
LW_RSAPublicKeyEncrypt
LW_RSASignatureData
LW_RSAVerifyData
LW_ReadCertificate
LW_ReadFile
LW_SWDecrypt
LW_SWEncrypt
LW_SWHash
LW_UnLockUserPin
LW_WaitForDevEvent
LW_WriteCertificate
LW_WriteFile

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d48022255857bdd26667b1fc7a8e538f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

crypt32

msvcr100

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 11KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1024B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 11KB - Virtual size: 11KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1024B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB