NEAS[.]d2c9f265d0b2d8c9de6433ea053ad880[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.d2c9f265d0b2d8c9de6433ea053ad880.exe
Size

680KB
MD5

d2c9f265d0b2d8c9de6433ea053ad880
SHA1

97ff4482b8c4686107f93a3143d023b0e1ad7e88
SHA256

7e51472d53cee3dc5234ab9df4e30c91dbdda657632ce33c5a2eac71c0189bb5
SHA512

e0a659e24681b793ce9b8f4d26b53d6e4c28d2fcabe5f8a8336a12c45a54c77f0d74246c0a97bd95c23a37275b84e2a21b829e54c5eecccf5029e2baa19b5e48
SSDEEP

12288:dQjxAYRkxCDh9clrMUweu368hS4jZyFoTWyNQUK2T:diRkxCDh9LUweunhJl5QUK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d2c9f265d0b2d8c9de6433ea053ad880.exe

Files

NEAS.d2c9f265d0b2d8c9de6433ea053ad880.exe
.dll windows:6 windows x64

820cd32ba870c58cbb2d96a0fe9aa0ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
GetTickCount
ResetWriteWatch
SwitchToFiber
ConvertThreadToFiber
CreateFiber
Sleep
FreeLibraryAndExitThread
VirtualProtect
GetModuleFileNameA
OutputDebugStringA
ExitProcess
GetModuleHandleW
QueryPerformanceCounter
HeapCreate
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetProcAddress
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
EnterCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter

user32

SetWindowLongPtrW
MessageBoxA
GetAsyncKeyState
CallWindowProcW
FindWindowW

msvcp140

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_BADOFF@std@@3_JB

winmm

timeGetTime

vcruntime140

memcmp
memcpy
__std_terminate
__CxxFrameHandler3
__std_type_info_destroy_list
_CxxThrowException
memmove
memset
__std_exception_destroy
__std_exception_copy
__C_specific_handler
__vcrt_InitializeCriticalSectionEx

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vsnprintf_s
fopen_s
fclose
__stdio_common_vfprintf_s
__stdio_common_vsprintf_s

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
free

api-ms-win-crt-runtime-l1-1-0

_initterm
terminate
_cexit
_initterm_e
_crt_atexit
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll

api-ms-win-crt-time-l1-1-0

_time64
_localtime64_s

api-ms-win-crt-string-l1-1-0

strcpy_s
strcat_s

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

cosf
sinf

Sections

.text
Size: 468KB - Virtual size: 468KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 90KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

820cd32ba870c58cbb2d96a0fe9aa0ea

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

msvcp140

winmm

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 468KB - Virtual size: 468KB

.rdata Size: 109KB - Virtual size: 109KB

.data Size: 90KB - Virtual size: 99KB

.pdata Size: 9KB - Virtual size: 8KB

.gfids Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 324B

.text
Size: 468KB - Virtual size: 468KB

.rdata
Size: 109KB - Virtual size: 109KB

.data
Size: 90KB - Virtual size: 99KB

.pdata
Size: 9KB - Virtual size: 8KB

.gfids
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 324B