NEAS[.]f9a77af2b95ac4bec4097d29c0925030[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f9a77af2b95ac4bec4097d29c0925030.exe
Size

335KB
MD5

f9a77af2b95ac4bec4097d29c0925030
SHA1

f1915d9afdf37415b7becb9f939392c1fc08dee9
SHA256

6320d48752bd48a02181d354bb30474fe6bddec69bd5657da7c02574d0ecb78a
SHA512

f8a5807b0f965bb29293331c208cb42e1d98aa39999a365c58d4337f3c5af8d8b2c855ccb3c6ece4c5ca2949b61c96daf73fa82eedac82ec297a942bbc6cefec
SSDEEP

6144:86LKgZXSiq2dj4Vsm2pkM6/FCOr+d6MPEXQ8Qg5692mF3EzKE3jZCa3:8Sq2cz2K9r+d6QeGJuK6jZCa3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f9a77af2b95ac4bec4097d29c0925030.exe

Files

NEAS.f9a77af2b95ac4bec4097d29c0925030.exe
.exe windows:6 windows x86

759486ab43cb52df3577d6a2b8b7ceca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

ImageNtHeader
MiniDumpWriteDump

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW
UuidFromStringW

iphlpapi

GetExtendedTcpTable

ws2_32

ntohs

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

StrCmpIW
PathFindExtensionW
PathFindFileNameW

kernel32

CreateFileW
GetFileAttributesW
GetCurrentThreadId
GetVersionExW
ReleaseMutex
SuspendThread
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
CreateEventW
GetExitCodeThread
Sleep
FormatMessageW
GetLastError
SetEvent
DeleteFileW
CloseHandle
K32GetModuleBaseNameA
GetSystemInfo
K32GetModuleInformation
CreateThread
GetProcAddress
VirtualAllocEx
GetFileSize
ExitProcess
ReadProcessMemory
GetComputerNameW
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
SleepEx
CreateRemoteThread
QueryFullProcessImageNameW
K32EnumProcessModules
VirtualFreeEx
K32GetMappedFileNameW
DebugBreak
MoveFileW
CreateMutexW
OpenThread
LoadLibraryExW
FlushFileBuffers
GetExitCodeProcess
RaiseException
WaitForSingleObject
LeaveCriticalSection
Thread32Next
InitializeCriticalSectionAndSpinCount
K32GetModuleFileNameExW
GetModuleFileNameW
VirtualAlloc
WriteFile
GetCurrentProcess
FindNextFileW
VirtualFree
EnterCriticalSection
WriteProcessMemory
FindFirstFileW
SetConsoleCtrlHandler
ReadFile
CreateDirectoryW
FindClose
VirtualProtect
LoadLibraryExA
HeapAlloc
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
QueryPerformanceCounter
GetPrivateProfileStringW
ExpandEnvironmentStringsW
SetLastError
GetSystemTimeAsFileTime
GetProcessHeap
InitializeSListHead
SetFilePointer
Thread32First
CompareStringW
HeapReAlloc
GetEnvironmentVariableW
SetEnvironmentVariableW
lstrlenW
VirtualQuery

advapi32

LookupPrivilegeValueW
RegisterServiceCtrlHandlerExW
AdjustTokenPrivileges
RegCloseKey
CloseServiceHandle
OpenSCManagerW
SetServiceStatus
OpenProcessToken
StartServiceW
RegOpenKeyExW
StartServiceCtrlDispatcherW
OpenServiceW
QueryServiceStatusEx
RegQueryValueExW
EventRegister
EventUnregister
EventWriteString

vcruntime140

__std_exception_copy
__CxxFrameHandler3
wcsrchr
__std_exception_destroy
wcschr
memset
_CxxThrowException
_except_handler4_common
memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf
__stdio_common_vswscanf
__acrt_iob_func
_set_fmode
__p__commode
__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcsnlen
_wcsicmp
_stricmp
_wcsnicmp
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv
_cexit
_crt_atexit
_seh_filter_exe
_exit
_register_onexit_function
_initialize_onexit_table
_initialize_wide_environment
_get_initial_wide_environment
_controlfp_s
_errno
terminate
_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
__p___wargv
_c_exit
_set_app_type
exit
__p___argc

api-ms-win-crt-time-l1-1-0

_time64
_wstrdate_s
_gmtime64_s
_wstrtime_s

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s
_wremove
_wsplitpath_s

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

759486ab43cb52df3577d6a2b8b7ceca

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

rpcrt4

iphlpapi

ws2_32

version

shlwapi

kernel32

advapi32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 57KB - Virtual size: 57KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 19KB - Virtual size: 148KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 212KB - Virtual size: 212KB

.text
Size: 57KB - Virtual size: 57KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 19KB - Virtual size: 148KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 212KB - Virtual size: 212KB