NEAS[.]6d07a2939e00ed0020bf8ac7dff4f530[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6d07a2939e00ed0020bf8ac7dff4f530.exe
Size

169KB
MD5

6d07a2939e00ed0020bf8ac7dff4f530
SHA1

84cb46dd89c930bc036b6f1969b94f0028a39e21
SHA256

5e2964a30c0267cfa44ad8cf64755b65317032126ca0ed6c0c1d48f70d063611
SHA512

1349b816368c86bec7b0ef8e2388342be3e6d48e59c6279f3d5227d6569653d020e2b6029308facf8d8b7f18c1aedc75e13389b1f060a802edb3e87ff408facd
SSDEEP

3072:4ZqOOOHHHHHHkkXn3X+e+e+xRxwvCVQL3YnV7lfNuhXO9caMFHt1BWg9RkkBz:81CuGlfcVRZUmR/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6d07a2939e00ed0020bf8ac7dff4f530.exe

Files

NEAS.6d07a2939e00ed0020bf8ac7dff4f530.exe
.dll windows:6 windows x64

d0cc46dcfd92196461dfef83f55ae0b0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

factorygame-core

?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?IsEnsureAllowed@FGenericPlatformMisc@@SA_NXZ
?IsDebuggerPresent@FWindowsPlatformMisc@@SA_NXZ
?PromptForRemoteDebugging@FWindowsPlatformMisc@@SAX_N@Z
?CheckVerifyFailedImpl@FDebug@@SAXPEBD0HPEAXPEB_WZZ
?OptionallyLogFormattedEnsureMessageReturningFalseImpl@FDebug@@CA_N_NPEBD1HPEAXPEB_WZZ
?Malloc@FMemory@@SAPEAX_KI@Z
?Realloc@FMemory@@SAPEAXPEAX_KI@Z
?Free@FMemory@@SAXPEAX@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPath@Private@CoreUObject@UE@@EA
??0FString@@QEAA@AEBV0@@Z
??4FString@@QEAAAEAV0@AEBV0@@Z
??1FString@@QEAA@XZ
??0FName@@QEAA@PEB_WW4EFindName@@@Z
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
??1FLogCategoryBase@@QEAA@XZ
??1FAutomationExecutionEntry@@QEAA@XZ
??0FAutomationExecutionEntry@@QEAA@AEBU0@@Z
?GIgnoreDebugger@@3_NA
??0FString@@QEAA@XZ
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA

factorygame-coreuobject

?GetStaticStruct@@YAPEAVUScriptStruct@@P6APEAV1@XZPEAVUObject@@PEB_W@Z
?RegisterCompiledInInfo@@YAXP6APEAVUPackage@@XZPEB_WAEAU?$TRegistrationInfo@VUPackage@@UFPackageReloadVersionInfo@@@@AEBUFPackageReloadVersionInfo@@@Z
?RegisterCompiledInInfo@@YAXPEB_WPEBUFClassRegisterCompiledInInfo@@_KPEBUFStructRegisterCompiledInInfo@@2PEBUFEnumRegisterCompiledInInfo@@2@Z
?ConstructUPackage@UECodeGen_Private@@YAXAEAPEAVUPackage@@AEBUFPackageParams@1@@Z
??1ICppStructOps@UScriptStruct@@UEAA@XZ
?HasGetTypeHash@ICppStructOps@UScriptStruct@@QEBA_NXZ
?Z_Construct_UScriptStruct_FAutomationExecutionEntry@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FGuid@@YAPEAVUScriptStruct@@XZ
??0ICppStructOps@UScriptStruct@@QEAA@HH@Z
?ConstructUScriptStruct@UECodeGen_Private@@YAXAEAPEAVUScriptStruct@@AEBUFStructParams@1@@Z

factorygame-automationtest

?Z_Construct_UEnum_AutomationTest_EAutomationState@@YAPEAVUEnum@@XZ

vcruntime140

__C_specific_handler
__current_exception
__current_exception_context
__std_type_info_destroy_list
memset
memcpy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_configure_narrow_argv
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initterm_e
_initterm
_cexit
_initialize_narrow_environment
_crt_at_quick_exit

kernel32

RtlLookupFunctionEntry
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext

Exports

Exports

??$StaticStruct@UFAutomationScreenshotMetadata@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerFindWorkers@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerFindWorkersResponse@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerImageComparisonResults@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerNextNetworkCommandReply@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerPerformanceDataRequest@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerPerformanceDataResponse@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerPing@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerPong@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerRequestNextNetworkCommand@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerRequestTests@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerRequestTestsReplyComplete@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerResetTests@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerRunTests@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerRunTestsReply@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerScreenImage@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerSingleTestReply@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerStopTests@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerTelemetryData@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerTelemetryItem@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerTestDataRequest@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerTestDataResponse@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFAutomationWorkerWorkerOffline@@@@YAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationScreenshotMetadata@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerFindWorkers@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerFindWorkersResponse@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerImageComparisonResults@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerNextNetworkCommandReply@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerPerformanceDataRequest@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerPerformanceDataResponse@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerPing@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerPong@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerRequestNextNetworkCommand@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerRequestTests@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerRequestTestsReplyComplete@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerResetTests@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerRunTests@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerRunTestsReply@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerScreenImage@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerSingleTestReply@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerStopTests@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerTelemetryData@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerTelemetryItem@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerTestDataRequest@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerTestDataResponse@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FAutomationWorkerWorkerOffline@@SAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationScreenshotMetadata@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerFindWorkers@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerFindWorkersResponse@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerImageComparisonResults@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerNextNetworkCommandReply@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerPerformanceDataRequest@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerPerformanceDataResponse@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerPing@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerPong@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerRequestNextNetworkCommand@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerRequestTests@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerRequestTestsReplyComplete@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerResetTests@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerRunTests@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerRunTestsReply@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerScreenImage@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerSingleTestReply@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerStopTests@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerTelemetryData@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerTelemetryItem@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerTestDataRequest@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerTestDataResponse@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FAutomationWorkerWorkerOffline@@YAPEAVUScriptStruct@@XZ
InitializeModule

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.uedbg
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d0cc46dcfd92196461dfef83f55ae0b0

Headers

DLL Characteristics

File Characteristics

Imports

factorygame-core

factorygame-coreuobject

factorygame-automationtest

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 38KB

.uedbg Size: 18KB - Virtual size: 18KB

.rdata Size: 38KB - Virtual size: 37KB

.data Size: 2KB - Virtual size: 3KB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 59KB - Virtual size: 58KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 39KB - Virtual size: 38KB

.uedbg
Size: 18KB - Virtual size: 18KB

.rdata
Size: 38KB - Virtual size: 37KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 59KB - Virtual size: 58KB

.reloc
Size: 2KB - Virtual size: 1KB