NEAS[.]adf92df530ed910989db4ce5967d26e0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.adf92df530ed910989db4ce5967d26e0.exe
Size

212KB
MD5

adf92df530ed910989db4ce5967d26e0
SHA1

5bc79145ebe606ce604e87d52c429918224dec9f
SHA256

56256a7b3cc3a80ff0821ccb4a77569ee20f9a1d09c0107bddaa4fdb96268dda
SHA512

8002d5af7315260b5ffbb6dd13d505a43b0d5f5c97664c56c9359497cbb160bf1be06ecd99526b497fd55a900eadf54415163b6c0910b3b75a17887754b9c3cb
SSDEEP

3072:MXBr7cvgcvrg0aGNSW0Q8tWBFWmse8kdSZ1vQolP6H:Ycvgcvrg05T8QBAmv8kd2W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.adf92df530ed910989db4ce5967d26e0.exe

Files

NEAS.adf92df530ed910989db4ce5967d26e0.exe
.dll windows:4 windows x86

55c6ab936a08268bb75a451a8dd9762b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
DeviceIoControl
CreateFileA
GetVolumeInformationA
GetWindowsDirectoryA
lstrcpynA
InitializeCriticalSection
CreateSemaphoreA
lstrlenA
SetFileAttributesA
GetFileAttributesA
GetVersionExA
lstrcpyA
GetComputerNameA
LeaveCriticalSection
EnterCriticalSection
TerminateThread
CreateThread
ReleaseSemaphore
WaitForSingleObject
ResumeThread
LocalFree
FormatMessageA
lstrcatA
WriteFile
SetFilePointer
GetLocalTime
GetModuleFileNameA
GetTickCount
GetFileSize
ReadFile
FindClose
FindFirstFileA
GetPrivateProfileStringA
GetSystemTime
GetProcAddress
GetLogicalDriveStringsA
GetDriveTypeA
FreeLibrary
LoadLibraryA
ResetEvent
CreateEventA
GetLastError
Sleep
SetEnvironmentVariableA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
FlushFileBuffers
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
HeapFree
HeapAlloc
GetTimeZoneInformation
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetModuleHandleA
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
DeleteCriticalSection
RtlUnwind
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree

user32

MessageBoxA
wsprintfA
PostMessageA
KillTimer
SetTimer
SendMessageA

ws2_32

socket
connect
WSAStartup
gethostname
gethostbyname
WSAGetLastError
closesocket
inet_ntoa
recv
send
WSACleanup
listen
getpeername
accept
htons
bind

netapi32

Netbios

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA

Exports

Exports

AddConnectEx
AddConnectNew
AutoDisConnect
ByteArrayToHexString
ByteArrayToString
CalEx
CalExByFile
CalPub
CalPubByFile
CloseSocketByHandle
ComPareBigLong
ComPareTime
ConnectServer
ConnectServerEx
ConvertStringToTimer
ConvertStringToTimerReal
ConvertStringToTimerRealEx
ConvertTimerToString
ConvertTimerToStringReal
DelConnectEx
DisconnectServer
DwordToString
EdcByFile
EdccBin
FileExistsInServer
FindPort
FindPort_2
GetAllowClientCount
GetAlreadyTimes
GetAppPath
GetAuthFromFile
GetAuthFromFile_Pub
GetClientCount
GetConCountByFunNum
GetConCountByIpFun
GetConnectComputerInfo
GetConnectComputerInfoByFunNum
GetConnectLastError
GetEventHwnd
GetFunCount
GetFunNum
GetIDVersion
GetIP
GetInfoHwnd
GetInfoMode
GetIpCountByFunNum
GetLeaveTimer
GetLimitTimes
GetLocalIP
GetLongID
GetMacAddressEx
GetMachineCount
GetNetBoisID
GetPRIME
GetRSAKey
GetRestrictMode
GetRetVar
GetRunTimer
GetServerPath
GetSetCount
GetSetCountByFile
GetSetCountEx
GetStringLenByByte
GetSystemDateTime
GetSystemTimeByLong
GetTimeAlreadyTimes
GetTimeLimitTimes
GetTimerFromAuth
HexStringToByteArray
HexStringToByteArray_2
HexToInt
IniStartServer
MakeAuthCode
MakeEncFile
MakeEncFileByPublic
MakeTimerAuth
MakeTimerAuth_2
NewDisconnectServer
ReBOOT
ReSet
ReSet_2
ReadKeyFormEpm
ReadPubTimeAuthFromEprom
ReadTimeAuthFromEprom
RemoteAuth
SendString
SetCallBackFun
SetDiskMethod
SetEventHwnd
SetFileNotReadOnly
SetInfoHwnd
SetInfoMode
SetReadPassword
SetRestrictMode
SetVfpKeyPath
SetVfpOverCount
SetWritePassword
StartServer
StopServer
StringToByteArray
StringToDword
TranfserVar
VfpCalExByFile
VfpCalPubByFile
WriteEncKey
WriteHostKey
WriteIniSetting
WriteLimitTimes
WriteNetAuthToEpm
WriteNetAuthToEpmEx
WritePubTimeAuthToEprom
WriteTimeAuthToEprom
WriteTimeLimitTimes
WriteYinZhi
YGetVersionEx
YTRSAUpdateData
YTRSAUpdateData_2
YT_3DES_1
YT_3DES_2
YT_3DES_3
YT_IniKey
YT_RSA_1
YT_RSA_2
Yt3DesByKeyArray
YtMd5
YtMd5ByFile
YtMd5ByFile_2
YtMd5ByFile_3
YtMd5_2
YtMd5_3
YtReadEx
YtReadFloat
YtReadLong
YtReadSting
YtReadString
YtTranfser
YtWriteEx
YtWriteFloat
YtWriteLong
YtWriteString
YtWriteUpdateDate
_Decrypt@16
_Decrypt_2@16
_Decrypt_3@12
_Encrypt@12
_Encrypt_2@16
_Encrypt_3@12
_GetLenByString@4
_GetLogicID@4
_GetNeedLen@4
_GetUID@4
_getHardDriveID@4
_static_free@0
_static_ini@4

Sections

.text
Size: 160KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

55c6ab936a08268bb75a451a8dd9762b

Headers

File Characteristics

Imports

kernel32

user32

ws2_32

netapi32

setupapi

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 158KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 24KB - Virtual size: 48KB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 160KB - Virtual size: 158KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 24KB - Virtual size: 48KB

.reloc
Size: 12KB - Virtual size: 11KB