NEAS[.]acfed0d0f89d0acc7291cf9d9f187290[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.acfed0d0f89d0acc7291cf9d9f187290.exe
Size

592KB
MD5

acfed0d0f89d0acc7291cf9d9f187290
SHA1

6b508afe2736e509ddc6e258f3b965dd8ae16887
SHA256

846bfc38c0dff51c7da77c96c915206a9f66fd55d1f5f9408df6f1e7a5ace49c
SHA512

ab11692f02e08f129a5dd01ad167c76e6b10ba7b7b03f76c8a89835399fb9469720603f284b750f0ec76f45eb0a6aa225272d2ae106bc1c940536b485ec8aebb
SSDEEP

12288:zaBy+oaGYm69Qd0yWi+V5Bf3SBTs4PwLiG:+By+oad99QduCBTP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.acfed0d0f89d0acc7291cf9d9f187290.exe

Files

NEAS.acfed0d0f89d0acc7291cf9d9f187290.exe
.exe windows:4 windows x86

9367a7ee4c66d371de71211b2df66607

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

d3dx9_42

D3DXMatrixOrthoOffCenterLH
D3DXCreateSprite
D3DXMatrixScaling
D3DXMatrixLookAtLH
D3DXMatrixTranslation
D3DXMatrixMultiply
D3DXCreateFontW
D3DXMatrixOrthoOffCenterRH
D3DXMatrixRotationZ
D3DXCreateTextureFromFileW
D3DXCreateEffectFromFileW

winmm

timeGetTime

comctl32

ord17

kernel32

CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InterlockedExchange
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
WideCharToMultiByte
LCMapStringA
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapSize
VirtualAlloc
VirtualFree
HeapCreate
CreateMutexA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
DeviceIoControl
GetVersionExW
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
GetCommandLineW
SetThreadExecutionState
GetLastError
GetModuleFileNameW
lstrlenW
HeapFree
HeapAlloc
GetProcessHeap
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
CloseHandle
GetCurrentProcess
GetVersionExA
GetFileAttributesW
ExpandEnvironmentStringsW
WriteFile
CreateDirectoryW
ReadFile
CreateFileW
OutputDebugStringA
WaitForSingleObject
ReleaseMutex
HeapReAlloc
RtlUnwind
GetStartupInfoW
GetModuleHandleA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapDestroy
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
GetModuleHandleW

user32

GetMonitorInfoW
EnumDisplaySettingsW
PostMessageW
SystemParametersInfoA
SetDlgItemTextW
LoadIconW
SetWindowTextW
EndDialog
EnableWindow
GetDlgItem
CheckDlgButton
IsDlgButtonChecked
DialogBoxIndirectParamW
DestroyAcceleratorTable
GetWindowLongW
SetWindowLongW
SetMenu
GetWindowPlacement
GetMenu
SetWindowPlacement
SetWindowPos
IsIconic
AdjustWindowRect
IsZoomed
IsWindowVisible
PeekMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
SendMessageW
PostQuitMessage
ShowWindow
GetSystemMetrics
MessageBoxW
GetClientRect
SetCursor
GetClassLongW
GetWindowRect
ClipCursor
SystemParametersInfoW
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetIconInfo
LoadCursorW
RegisterClassW
GetDC
SetRect
CreateWindowExW
ScreenToClient
DestroyMenu
DestroyWindow
UnregisterClassW
DefWindowProcW
GetCursorPos
ReleaseDC

gdi32

GetStockObject
CreateCompatibleDC
SelectObject
GetDIBits
DeleteObject
GetObjectW
DeleteDC

advapi32

RegCreateKeyA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA

shell32

ShellExecuteW
ExtractIconW
CommandLineToArgvW
SHGetFolderPathW

fmodex

?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
FMOD_System_Create
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PAVSound@2@_NPAPAVChannel@2@@Z
?setMode@Sound@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?getVersion@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?close@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ

hid

HidD_GetHidGuid
HidD_GetFeature
HidD_SetFeature
HidD_GetAttributes

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA

Sections

.text
Size: 184KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 336KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9367a7ee4c66d371de71211b2df66607

Headers

File Characteristics

Imports

d3dx9_42

winmm

comctl32

kernel32

user32

gdi32

advapi32

shell32

fmodex

hid

setupapi

Sections

.text Size: 184KB - Virtual size: 182KB

.rdata Size: 336KB - Virtual size: 332KB

.data Size: 12KB - Virtual size: 118KB

.rsrc Size: 56KB - Virtual size: 55KB

.text
Size: 184KB - Virtual size: 182KB

.rdata
Size: 336KB - Virtual size: 332KB

.data
Size: 12KB - Virtual size: 118KB

.rsrc
Size: 56KB - Virtual size: 55KB