NEAS[.]fef805967f72ca05f2682b5ebf196cd0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.fef805967f72ca05f2682b5ebf196cd0.exe
Size

155KB
MD5

fef805967f72ca05f2682b5ebf196cd0
SHA1

879a8edd9780db0e7e35e6fd2e6bc60637cf8542
SHA256

e0b4b5ab97e61e0668e219a366ed5251970e93c447a66a23c1b35b4d7d6e4b2f
SHA512

a2df987756c815c8d67ccf31aab10317d61975cb22d03cce5e248a58dd0ca7c71a11f9ca74442b8b02f8f9bcf79e95fe42cf726de03242433683b9e182ee76c7
SSDEEP

3072:pyHKDBfAh1zP0MAuYljmHKW+UBTCWlx5di3NjArk2G5t++K0KiwmfJwLaM:pyiBfC0MAuZHKWxT7lxbr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.fef805967f72ca05f2682b5ebf196cd0.exe

Files

NEAS.fef805967f72ca05f2682b5ebf196cd0.exe
.exe windows:5 windows x86

527472065761b2ead35025d00df2bfd2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetConsoleScreenBufferInfo
WriteConsoleOutputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorPosition
ReadConsoleInputW
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
IsValidLocale
GetStdHandle
DeviceIoControl
CreateFileW
Sleep
GetModuleFileNameW
GetLastError
CloseHandle
SetConsoleCursorInfo
GetNativeSystemInfo
EncodePointer
DecodePointer
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetProcAddress
GetModuleHandleW
ExitProcess
GetCommandLineW
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
RaiseException
HeapSize
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryW
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WriteFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
RtlUnwind
HeapReAlloc
WriteConsoleW
LCMapStringW
IsProcessorFeaturePresent
SetStdHandle
FlushFileBuffers
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
ReadFile

user32

MessageBoxW

advapi32

ControlService
QueryServiceStatusEx
StartServiceW
CreateServiceW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
DeleteService

Sections

.text
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

527472065761b2ead35025d00df2bfd2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 106KB - Virtual size: 106KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 6KB - Virtual size: 15KB

.rsrc Size: 512B - Virtual size: 448B

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 106KB - Virtual size: 106KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 6KB - Virtual size: 15KB

.rsrc
Size: 512B - Virtual size: 448B

.reloc
Size: 9KB - Virtual size: 9KB