NEAS[.]90b7d6d359138d638bbb3424e4ece5d0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.90b7d6d359138d638bbb3424e4ece5d0.exe
Size

2.6MB
MD5

90b7d6d359138d638bbb3424e4ece5d0
SHA1

f42fd295166d6a0c365b9543551f33c288aaec42
SHA256

916c37831fb9a75cbe31891bb117bc77d580d292619d6938732b649b0a5b6f27
SHA512

05c3e6b767e917515c12fde8c95f94292f883a5a488d949dc8f1bbe657e362dd6385bdf5d20deddea01979151ed8972567d7a227ca4b958971298d2b52fe6229
SSDEEP

49152:wvAjrFAwoqtSkEUP9OTUJvl51FFTbvtRwT6g8RodoRyF:frFAWtSkEUP94Yvb13tRtRomY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.90b7d6d359138d638bbb3424e4ece5d0.exe

Files

NEAS.90b7d6d359138d638bbb3424e4ece5d0.exe
.exe windows:4 windows x86

fb17b233dcba34b489f9ccd7dfe62c49

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetLocalTime
SystemTimeToFileTime
GetTempPathA
GetDiskFreeSpaceA
GetACP
GetThreadLocale
IsBadReadPtr
GetComputerNameA
IsValidLocale
GetSystemDirectoryA
GetWindowsDirectoryA
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
SetStdHandle
GetConsoleCP
HeapSize
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
HeapReAlloc
VirtualAlloc
LCMapStringW
LCMapStringA
GetSystemInfo
SetLastError
GetExitCodeThread
DuplicateHandle
GetProcessHeap
HeapAlloc
TerminateProcess
HeapFree
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
GetCurrentThreadId
GetCPInfo
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleW
VirtualFree
HeapDestroy
HeapCreate
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
LockFile
UnlockFile
IsBadStringPtrW
IsBadStringPtrA
VirtualProtect
FlushInstructionCache
GetLogicalDrives
GetDriveTypeA
DeviceIoControl
ReleaseSemaphore
OpenSemaphoreA
CreateSemaphoreA
GetFileTime
GetFileSize
SetEndOfFile
FlushFileBuffers
SetFilePointer
ReadFile
WriteFile
GetSystemTimeAsFileTime
CreateDirectoryA
SetConsoleCtrlHandler
CreateFileA
GetCurrentDirectoryA
GetTickCount
GetCurrentProcess
GetCommandLineA
SetFileTime
GetCurrentProcessId
GetVersion
GetVersionExA
WaitForMultipleObjects
SetEvent
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
TlsSetValue
LocalAlloc
LocalFree
TlsGetValue
TlsFree
ExitProcess
TlsAlloc
GetFileAttributesA
GetFullPathNameA
SetCurrentDirectoryA
FileTimeToSystemTime
GetTimeZoneInformation
GetSystemTime
CloseHandle
UnmapViewOfFile
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
Sleep
WaitForSingleObject
GetCurrentThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetLastError
GetPrivateProfileSectionA
WritePrivateProfileSectionA
AreFileApisANSI
LoadLibraryA
GetEnvironmentVariableA
FreeLibrary
GetProcAddress
OpenProcess
GetExitCodeProcess
GetProfileStringA
DeleteFileA
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetConsoleMode
IsBadWritePtr
OpenEventA

user32

GetSystemMenu
CharLowerBuffA
AppendMenuA
GetSystemMetrics
MessageBoxA
PeekMessageA
CallMsgFilterA
TranslateMessage
DispatchMessageA
DrawMenuBar
CharUpperBuffA
wsprintfA
LoadStringA

advapi32

RegOpenKeyExA
SetSecurityDescriptorDacl
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegDeleteValueA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
GetUserNameA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegFlushKey
RegCloseKey

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shell32

ShellExecuteExA

wsock32

getpeername
accept
WSAStartup
WSACleanup
__WSAFDIsSet
select
gethostname
gethostbyaddr
htons
inet_addr
gethostbyname
WSAGetLastError
ioctlsocket
connect
inet_ntoa
setsockopt
socket
listen
closesocket
shutdown
send
getsockopt
recv
recvfrom
sendto
bind

Sections

__wibu00
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu01
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu02
Size: 4KB - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu03
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fb17b233dcba34b489f9ccd7dfe62c49

Headers

File Characteristics

Imports

kernel32

user32

advapi32

version

shell32

wsock32

Sections

__wibu00 Size: 68KB - Virtual size: 68KB

__wibu01 Size: 20KB - Virtual size: 16KB

__wibu02 Size: 4KB - Virtual size: 416B

.rsrc Size: 1.3MB - Virtual size: 1.3MB

__wibu03 Size: 1.2MB - Virtual size: 1.2MB

__wibu00
Size: 68KB - Virtual size: 68KB

__wibu01
Size: 20KB - Virtual size: 16KB

__wibu02
Size: 4KB - Virtual size: 416B

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

__wibu03
Size: 1.2MB - Virtual size: 1.2MB