NEAS[.]f21025264af5322060de963a789ad3d0[.]cab

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.f21025264af5322060de963a789ad3d0.cab
Size

225KB
MD5

f21025264af5322060de963a789ad3d0
SHA1

b9f70df0d01b50df2369db4813267da237e93a68
SHA256

cd92dbbc48dd30ad67e42ef87405988f19cbffcbee7c103ea9f96866ab2faadf
SHA512

37a7f0969a890f378825c3530b0d06fa846bb26bad6581476680cd632deafff1c943b077e1eb55c5bec74a0cfe99050c27ecd5d93f87505d7441859d8c4f66b5
SSDEEP

6144:RSNkj/fQAktmwq+on37Pa+RY1M24M8kMpIPzZ73BhK:RSMmt67jhRYOG/MqPzJxhK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/jscript.dll

Files

NEAS.f21025264af5322060de963a789ad3d0.cab
.cab
jscript.dll
.dll regsvr32 windows:6 windows x86

3aef05daa2201957e4130c7ec5f3efb6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

ungetc
_isatty
_write
_lseeki64
_fileno
_read
__pioinfo
__badioinfo
free
memcpy
??3@YAXPAX@Z
realloc
_wcsdup
memset
??2@YAPAXI@Z
memmove
wcsncmp
wcschr
wcstombs
ferror
wctomb
_itoa
_snprintf
localeconv
isleadbyte
mbtowc
isxdigit
calloc
iswctype
_onexit
_lock
__dllonexit
_unlock
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
_iob
__mb_cur_max
_errno
_isnan
_ftime
fmod
atan2
pow
tan
sqrt
sin
log
exp
cos
atan
asin
acos
bsearch
_ismbblead
_wcslwr
isalpha
isdigit
_wasctime
ceil
_tzset
localtime
floor
_CIfmod
_vsnwprintf
iswxdigit
wcsstr
_CIlog
towlower
atoi
wcscspn
_statusfp
_clearfp
strrchr
_ultow
_ltow
longjmp
strtoul
_wcsicmp
_control87
_purecall
_setjmp3
_wcsnicmp
malloc

oleaut32

VariantChangeTypeEx
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
CreateTypeLi
SafeArrayRedim
LoadTypeLibEx
SysAllocString
SysAllocStringLen
VariantClear
SysFreeString
CreateTypeLib2
LoadRegTypeLi
VariantCopy
VariantCopyInd
SysStringByteLen
SysStringLen
SysAllocStringByteLen
VariantInit
SafeArrayDestroy
SafeArrayCreate
GetErrorInfo
LoadTypeLi
GetActiveObject

ole32

CreateBindCtx
MkParseDisplayName
BindMoniker
CLSIDFromString
StringFromCLSID
CLSIDFromProgID
CoGetClassObject
CoTaskMemFree
CoCreateInstance

advapi32

RegCloseKey
RegCreateKeyA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
RegSetValueA
RegQueryValueExA
RegOpenKeyA
RegQueryValueExW
RegOpenKeyExW

kernel32

FindResourceExW
LoadLibraryExW
MapViewOfFile
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
RtlUnwind
OutputDebugStringA
InterlockedCompareExchange
Sleep
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
GetNumberFormatW
GetNumberFormatA
GetTimeFormatW
GetTimeFormatA
GetDateFormatW
GetDateFormatA
GetLocaleInfoW
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
SetLastError
GetVersion
MulDiv
GetSystemTime
CloseHandle
QueryPerformanceCounter
GetCurrentProcessId
GetTickCount
GetComputerNameA
MultiByteToWideChar
LoadLibraryA
GetUserDefaultLangID
GetProcAddress
TlsSetValue
WideCharToMultiByte
GetStringTypeA
GetStringTypeW
FreeLibrary
TlsFree
TlsAlloc
GetVersionExA
LoadLibraryExA
FindResourceA
LoadResource
LockResource
SizeofResource
FreeResource
GetModuleFileNameW
GetACP
GetSystemDefaultLCID
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCurrentThreadId
InterlockedExchange
TlsGetValue
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleA
GetModuleFileNameA
InterlockedDecrement
InterlockedIncrement
CreateFileMappingW
CreateFileW
GetVersionExW
UnmapViewOfFile
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
FindResourceW
GetTimeZoneInformation
SearchPathW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 424KB - Virtual size: 422KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3aef05daa2201957e4130c7ec5f3efb6

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

oleaut32

ole32

advapi32

kernel32

Exports

Exports

Sections

.text Size: 424KB - Virtual size: 422KB

.data Size: 20KB - Virtual size: 17KB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 20KB - Virtual size: 16KB

.text
Size: 424KB - Virtual size: 422KB

.data
Size: 20KB - Virtual size: 17KB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 20KB - Virtual size: 16KB