NEAS[.]8df1bc99869ff0ca165dbca2cea8bc20[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.8df1bc99869ff0ca165dbca2cea8bc20.exe
Size

582KB
MD5

8df1bc99869ff0ca165dbca2cea8bc20
SHA1

855cd26f9dddac1afbba3a237f7389e4a20264e3
SHA256

c92ef15a64875160b85ced6b9d30ba3488aad88ad7a2e3adf590d17d782ea8c6
SHA512

9310682d4dd80ac2846c4e8c7824dbf19692788b3b2760aa0063db5c52f94fde8645a36e2a9b817562bf8824007b5e7362eeeeeac66163ed7fa5d02de64238dd
SSDEEP

12288:UHHwFBEpilI7XHgZ5KhJgeaX/uKXlNdn+ByG+Gi/l9Ko:UHHwFepiSLHgZAJ8/uQ+BLCl0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.8df1bc99869ff0ca165dbca2cea8bc20.exe

Files

NEAS.8df1bc99869ff0ca165dbca2cea8bc20.exe
.dll windows:6 windows x86

90bac6481b62589762819f837be85612

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr100

wcsrchr
vsprintf_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBDH@Z
_CxxThrowException
__CxxFrameHandler3
memset
memmove
??_V@YAXPAX@Z
memcmp
memcpy
_invalid_parameter_noinfo_noreturn
memcpy_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
__lconv_init
_except_handler4_common
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
strncpy_s
_vsnprintf_s
realloc
malloc
free
wcsncat_s
wcscpy_s
bsearch
??2@YAPAXI@Z
??_U@YAPAXI@Z
swscanf_s
wcsncpy_s
wcscmp
wcschr
??3@YAXPAX@Z

advapi32

OpenProcessToken
AddAccessAllowedAce
AddAccessDeniedAce
AllocateAndInitializeSid
CheckTokenMembership
CopySid
CreateWellKnownSid
EqualSid
FreeSid
GetLengthSid
GetSecurityDescriptorDacl
InitializeAcl
GetTokenInformation
RegGetValueW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyW
EventWrite
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
InitializeSecurityDescriptor
IsValidSid
SetSecurityDescriptorDacl
ConvertSidToStringSidA
ConvertStringSecurityDescriptorToSecurityDescriptorW
EventUnregister
EventRegister
RegSetValueExW
RegQueryInfoKeyW
RegCreateKeyExW
OpenThreadToken

kernel32

LocalAlloc
LocalFree
LoadLibraryA
GetFileType
GetTempPathW
SizeofResource
GetModuleFileNameA
GetShortPathNameA
GetCurrentThread
EncodePointer
DecodePointer
GetLastError
SetLastError
CompareStringW
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WaitForSingleObjectEx
GetCurrentThreadId
Sleep
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
ReadFile
WriteFile
CreateFileW
GetModuleFileNameW
LoadResource
FindResourceW
LocaleNameToLCID
GetUserDefaultLocaleName
IsValidLocale
GetSystemDefaultLCID
GetUserDefaultLCID
CompareStringEx
LCIDToLocaleName
GetSystemDefaultLocaleName
HeapAlloc
HeapFree
GetProcessHeap
RaiseFailFastException
DeleteFileW
SetFileAttributesW
ReleaseMutex
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount64
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileSize
GlobalMemoryStatusEx
GetSystemDirectoryW
GetVersionExW
GetProductInfo
GetModuleHandleW
GetProcAddress
GetTimeZoneInformation
GetUserGeoID
GetUserDefaultUILanguage
CreateDirectoryW
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetTickCount
GlobalFree
RaiseException
CreateMutexA
OpenMutexA
GlobalAlloc
QueryPerformanceCounter
HeapSetInformation
VirtualProtect
WerRegisterMemoryBlock
LoadLibraryExW
InterlockedExchange
InterlockedCompareExchange
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
RtlCaptureStackBackTrace
TlsGetValue
IsWow64Process
GetNativeSystemInfo

ole32

CoCreateGuid

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

msvcp100

?_Xlength_error@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xout_of_range@std@@YAXPBD@Z

Sections

.text
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 196KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 239KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90bac6481b62589762819f837be85612

Headers

DLL Characteristics

File Characteristics

Imports

msvcr100

advapi32

kernel32

ole32

version

msvcp100

Sections

.text Size: 144KB - Virtual size: 144KB

.data Size: 196KB - Virtual size: 203KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 239KB - Virtual size: 240KB

.text
Size: 144KB - Virtual size: 144KB

.data
Size: 196KB - Virtual size: 203KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 239KB - Virtual size: 240KB