NEAS[.]bb8c18b7d50769164a53433c34049e48_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.bb8c18b7d50769164a53433c34049e48_JC.exe
Size

4.2MB
MD5

bb8c18b7d50769164a53433c34049e48
SHA1

bce670133d8162ba3ff93e90115d79abe56edf6b
SHA256

dd9ae773bc1e34bc3200be092aff4f4b12a9818085d50a140faf02698cf86789
SHA512

d003c070cb35edfaf2edcca132006a646596ad25e75bf3b88fd32d71f0446bb37214e27e7586286f26893e023d184f3d7ce8735b32d085982166e8c9a33faf09
SSDEEP

98304:qHlbcEUJKvcohkiqmShJ1FfWlMvyXviJyd+rfz8Zd2NpFK0ID7My:sbcovbkiqNFqeoaI+Pf/k0c7My

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.bb8c18b7d50769164a53433c34049e48_JC.exe

Files

NEAS.bb8c18b7d50769164a53433c34049e48_JC.exe
.exe windows:4 windows x86

d89ee40f244955663a0627e5d5b2d277

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatW
GetFileSizeEx
DeleteFileW
SetEnvironmentVariableW
GetCurrentDirectoryW
VirtualFree
GetModuleHandleW
WriteConsoleW
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDriveStringsW
QueryPerformanceFrequency
WinExec
WriteProcessMemory
CreateMutexA
ReleaseMutex
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ExpandEnvironmentStringsW
GetCurrentThreadId
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFullPathNameW
FormatMessageA
DeviceIoControl
DefineDosDeviceW
WaitNamedPipeW
FlushFileBuffers
GlobalMemoryStatus
VirtualAlloc
GlobalMemoryStatusEx
LockResource
LoadResource
SizeofResource
FindResourceW
SleepEx
RemoveDirectoryW
MoveFileW
GetProcessTimes
SetEndOfFile
SetCurrentDirectoryW
FormatMessageW
SetConsoleWindowInfo
GetLargestConsoleWindowSize
SetFilePointerEx
QueryDosDeviceW
LoadLibraryExW
OpenThread
SetSystemPowerState
FileTimeToSystemTime
SystemTimeToFileTime
LoadLibraryA
GetFileAttributesExW
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiA
lstrcpyA
lstrcpynA
SetLocalTime
SetEnvironmentVariableA
GlobalAddAtomA
GetLogicalDrives
VirtualProtect
SetConsoleScreenBufferSize
AllocConsole
CreateMutexW
SetEvent
GetFileSize
MultiByteToWideChar
LCMapStringA
LCMapStringW
VirtualQueryEx
GetThreadContext
SetThreadContext
VirtualProtectEx
EnumResourceNamesW
FileTimeToLocalFileTime
WaitForMultipleObjects
ResetEvent
GetLongPathNameW
GetShortPathNameW
GetVolumeInformationW
SetVolumeLabelW
CreateHardLinkW
SetFileAttributesW
SetFileTime
LocalFileTimeToFileTime
GetTimeZoneInformation
TerminateThread
GlobalDeleteAtom
Beep
InterlockedExchange
GetACP
RaiseException
FindFirstFileW
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
IsBadWritePtr
HeapCreate
HeapDestroy
GetSystemInfo
VirtualQuery
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
SetStdHandle
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
GetVersionExA
RtlUnwind
CompareStringA
CompareStringW
WideCharToMultiByte
GetVersionExW
LocalFree
HeapReAlloc
lstrcpyW
lstrcmpA
SetErrorMode
GetStdHandle
GetCommandLineW
GetVersion
ReadProcessMemory
CreatePipe
DuplicateHandle
SetFilePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateNamedPipeA
SetNamedPipeHandleState
CreateEventW
GetProcessId
WriteFile
ConnectNamedPipe
ReadFile
GetOverlappedResult
LoadLibraryW
IsBadCodePtr
GetModuleFileNameW
CreateJobObjectW
AssignProcessToJobObject
ResumeThread
GetExitCodeProcess
TerminateJobObject
ExitProcess
GetModuleHandleA
GetProcAddress
CreateDirectoryW
FindNextFileW
CreateFileW
OpenProcess
GetProcessAffinityMask
GetProcessHeap
HeapFree
SearchPathW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetEnvironmentVariableW
SetLastError
CreateFileMappingA
OpenFileMappingA
TerminateProcess
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
CreateProcessW
WaitForSingleObject
GetEnvironmentVariableA
GetLocaleInfoA
GetCurrentProcess
SetProcessWorkingSetSize
CreateThread
Sleep
GetLastError
GetCurrentProcessId
HeapAlloc
lstrlenA
lstrcpynW
lstrcmpW
lstrcmpiW
FindClose
CloseHandle
LeaveCriticalSection
EnterCriticalSection
MulDiv
GetTickCount
GetStartupInfoW
FreeLibrary
GetTempPathW
lstrlenW

user32

AttachThreadInput
GetWindowThreadProcessId
IsDialogMessageW
GetSysColor
DestroyIcon
LoadCursorW
SetCursor
RegisterWindowMessageW
UpdateWindow
SetScrollPos
GetScrollInfo
GetWindowDC
IsIconic
OpenDesktopW
SetThreadDesktop
SwitchDesktop
CloseDesktop
GetMessageW
RegisterClassExW
DefWindowProcW
LoadMenuW
LockWorkStation
DialogBoxParamW
DialogBoxIndirectParamW
GetDlgItemTextW
GetWindowTextLengthW
GetWindowTextW
RedrawWindow
CallWindowProcW
GetKeyState
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetMenuStringW
ModifyMenuW
GetForegroundWindow
RegisterHotKey
EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
GetDesktopWindow
SetParent
BeginPaint
EndPaint
SetLayeredWindowAttributes
InvalidateRect
EndDialog
CharToOemA
UnhookWindowsHookEx
SetWindowsHookExW
GetAsyncKeyState
PostQuitMessage
CallNextHookEx
GetKeyboardState
keybd_event
RegisterDeviceNotificationW
IsWindow
SendMessageTimeoutW
CharUpperW
LoadStringW
GetCursorPos
CreatePopupMenu
TrackPopupMenu
DestroyMenu
wsprintfA
MsgWaitForMultipleObjects
AppendMenuW
MessageBoxA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EnumChildWindows
FindWindowExW
FindWindowW
MessageBoxW
GetClassNameW
FindWindowA
GetLastInputInfo
PeekMessageW
TranslateMessage
DrawIconEx
OffsetRect
SetCapture
ReleaseCapture
ShowCursor
ScreenToClient
DrawIcon
SetScrollInfo
ScrollWindow
LoadBitmapW
SetWindowRgn
CharUpperA
CopyImage
DestroyCursor
CreateIconFromResource
LoadStringA
GetClipboardData
SetCursorPos
IsWindowVisible
GetWindowInfo
CreateIconFromResourceEx
CreateDialogParamW
IsWindowEnabled
GetActiveWindow
EnumWindows
PtInRect
UnregisterHotKey
LoadImageW
DispatchMessageW
SystemParametersInfoW
GetSystemMenu
EnableMenuItem
ClientToScreen
GetClientRect
wsprintfW
DrawTextW
SetWindowTextW
GetSystemMetrics
ShowScrollBar
EnableWindow
SetFocus
MoveWindow
SetActiveWindow
SetForegroundWindow
BringWindowToTop
CreateWindowExW
GetDlgCtrlID
GetParent
LoadIconW
ReleaseDC
GetDC
SetDlgItemTextW
DestroyWindow
GetDlgItem
SetWindowPos
ShowWindow
SetWindowLongW
GetWindowLongW
GetWindowRect
KillTimer
SetTimer
SendMessageW
PostMessageW
FillRect

gdi32

Polyline
GetTextMetricsW
Rectangle
GetBkColor
CreateBitmap
CreateCompatibleBitmap
CreatePen
Ellipse
CreateEllipticRgn
CreateFontW
GetObjectW
CreateRectRgn
GetPixel
CombineRgn
DeleteDC
CreateCompatibleDC
BitBlt
SetBkColor
ExtTextOutW
GetDeviceCaps
AddFontResourceW
CreateSolidBrush
SetBkMode
SetTextColor
GetStockObject
DeleteObject
SelectObject

advapi32

OpenProcessToken
RegSaveKeyW
RegLoadKeyW
RegUnLoadKeyW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoW
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptReleaseContext
CryptDestroyHash
RegSetValueExA
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
AbortSystemShutdownW
StartServiceW
OpenServiceW
CreateServiceW
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
SetServiceStatus
FreeSid
CreateRestrictedToken
AllocateAndInitializeSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
SetSecurityInfo
SetEntriesInAclW
GetSecurityInfo
AdjustTokenPrivileges
LookupPrivilegeValueW
RegDeleteKeyW
InitiateSystemShutdownW

shell32

SHGetPathFromIDListW
SHChangeNotify
DragQueryFileW
SHBrowseForFolderW
Shell_NotifyIconW
SHGetSpecialFolderPathW
DragAcceptFiles
SHFileOperationW
ShellExecuteExW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

setupapi

SetupDiClassNameFromGuidA
SetupDiGetDeviceInstanceIdW
SetupDiClassNameFromGuidW
SetupDiChangeState
SetupDiSetClassInstallParamsW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiOpenClassRegKey
CM_Reenumerate_DevNode
CM_Get_Parent
CM_Get_DevNode_Status
CM_Request_Device_EjectW
CM_Query_And_Remove_SubTreeW
CM_Locate_DevNodeW

shlwapi

StrCmpNIW
StrChrW
StrRChrW
StrStrW
StrCpyNW
StrToIntExW
StrStrIW
wnsprintfW
StrCmpNW
StrCmpNIA
StrPBrkW

Exports

Exports

LoadEnvi
MemoryCopy
WndProc1
WndProc2
WndProc3
_WndProc1P@16
_WndProc2p@16
_WndProc3p@16

Sections

.text
Size: 484KB - Virtual size: 483KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

flag_dat
Size: 512B - Virtual size: 19B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d89ee40f244955663a0627e5d5b2d277

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

version

setupapi

shlwapi

Exports

Exports

Sections

.text Size: 484KB - Virtual size: 483KB

.rdata Size: 80KB - Virtual size: 79KB

.data Size: 7KB - Virtual size: 17KB

flag_dat Size: 512B - Virtual size: 19B

.rsrc Size: 3.5MB - Virtual size: 3.5MB

.text
Size: 484KB - Virtual size: 483KB

.rdata
Size: 80KB - Virtual size: 79KB

.data
Size: 7KB - Virtual size: 17KB

flag_dat
Size: 512B - Virtual size: 19B

.rsrc
Size: 3.5MB - Virtual size: 3.5MB