NEAS[.]dc3ae3ab501e02b3e129eceaf931ed70[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.dc3ae3ab501e02b3e129eceaf931ed70.exe
Size

705KB
MD5

dc3ae3ab501e02b3e129eceaf931ed70
SHA1

199abeda3c8a05f3054b1c91bb1f69027de53939
SHA256

746eaf8ac0fa2c554ae71b0e4c76a09e390f1381d67d3c58f7e27784a9fb1115
SHA512

6f0f29b7d412def9b272be0129ea4f15940b001538ffab495daf596a1d3eea56caf717badf719442cd400d2aba970719c26e9401199df9bb6ef6e04923b7c1cb
SSDEEP

12288:Zkycq/u9AAi4TnCf2KbCGrriUmiwFJxU72+:aycq/u9AAifTrri4wF6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.dc3ae3ab501e02b3e129eceaf931ed70.exe

Files

NEAS.dc3ae3ab501e02b3e129eceaf931ed70.exe
.exe windows:6 windows x64

364ce282a93e03a146321d365523e1d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCommandLineW
TlsGetValue
UnregisterWait
TlsFree
TlsAlloc
LocalAlloc
ExpandEnvironmentStringsW
SetFileAttributesW
LocalFree
DeleteFileW
DeleteCriticalSection
FindNextFileW
IsDebuggerPresent
LockResource
FindClose
GetModuleFileNameW
GetExitCodeProcess
FormatMessageW
GetCurrentThread
CreateDirectoryW
LoadLibraryExW
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
GetThreadContext
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetFullPathNameW
FreeLibrary
SetEvent
WaitForSingleObjectEx
OutputDebugStringW
QueryFullProcessImageNameW
CreateEventA
CreateFileW
GetLastError
GetProcAddress
ResetEvent
GetLocalTime
LoadLibraryA
QueueUserWorkItem
CloseHandle
DebugBreak
GetSystemWindowsDirectoryA

ole32

CoCreateInstance
StringFromGUID2
CoGetObjectContext
CoInitializeEx
CoUninitialize

msvcrt

__CxxFrameHandler3
??1type_info@@UEAA@XZ
_wfopen
memcpy
_CxxThrowException
memset
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_purecall
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
free
_callnewh
malloc
wcschr
_wstrdate
_waccess
_wstrtime
_wcsicmp
_vsnwprintf
fwprintf
fflush
fopen
fprintf
fclose
wcsrchr
_local_unwind

msdtctm

ord4

ntdll

RtlReportException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

version

VerQueryValueW

user32

GetWindowRect
GetThreadDesktop
CloseWindowStation
DialogBoxParamW
GetProcessWindowStation
OpenDesktopW
GetClientRect
SetProcessWindowStation
EndDialog
GetDesktopWindow
SetWindowPos
SetThreadDesktop
SetDlgItemTextW
OpenWindowStationW
MapWindowPoints
LoadStringW
CloseDesktop

advapi32

RegOpenKeyExW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExA
DeregisterEventSource
RegQueryValueExW
RegQueryValueExA

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

364ce282a93e03a146321d365523e1d1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

msvcrt

msdtctm

ntdll

version

user32

advapi32

Sections

.text Size: 39KB - Virtual size: 38KB

.data Size: 1KB - Virtual size: 10KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 94KB - Virtual size: 94KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 39KB - Virtual size: 38KB

.data
Size: 1KB - Virtual size: 10KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 94KB - Virtual size: 94KB

.reloc
Size: 568KB - Virtual size: 572KB