NEAS[.]a259630dd078c090630a7e13e1c86500[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a259630dd078c090630a7e13e1c86500.exe
Size

326KB
MD5

a259630dd078c090630a7e13e1c86500
SHA1

c3b3dc922fcd6fe739f0153f7b045b2192fd0737
SHA256

21411c0c02f44160fa0a534b5a8e7d0fc2e38485e98a0223b9f82743f62eca73
SHA512

d44daf95500edd789f6e9e9082b908875cc2d5df4e2daa9b163f042c46f6e70defd0c17744cf375a158ab48f2bc58465946ca04574b0689536e66cc25f855ea4
SSDEEP

6144:XDB4PPSoWqwWKbfP5W4gQRZ66z+n4VZbd8g79pgrXNgRnVLjyzhbkidNN2Px:XDB4PPS7HzX5+QRZ66z24VZbdrpgrXN6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a259630dd078c090630a7e13e1c86500.exe

Files

NEAS.a259630dd078c090630a7e13e1c86500.exe
.exe windows:10 windows x86

e38ac1f1bfcdcc722d22cc5e0517d9b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyW
RegDeleteValueW
RegCreateKeyW
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegEnumKeyW
RegLoadKeyW
RegUnLoadKeyW
RegDeleteKeyW
RegQueryInfoKeyW
RegRenameKey
GetSecurityInfo
RegQueryValueExW
OpenProcessToken
RegSetKeySecurity
GetSecurityDescriptorControl
AdjustTokenPrivileges
LookupPrivilegeValueW
RegConnectRegistryW
RegEnumValueW
SetSecurityDescriptorGroup
LookupAccountSidW
MapGenericMask
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
IsValidSecurityDescriptor
SetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegFlushKey
GetSidSubAuthority
GetSecurityDescriptorGroup
GetSidSubAuthorityCount
SetSecurityDescriptorOwner
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegSetValueW
RegRestoreKeyW
RegSetValueExA
RegSaveKeyW
GetInheritanceSourceW
RegCloseKey

kernel32

GetModuleHandleExW
FreeLibrary
GetTimeFormatW
FileTimeToLocalFileTime
LoadLibraryW
FileTimeToSystemTime
lstrcmpW
WideCharToMultiByte
GetFileSize
DeleteFileW
MultiByteToWideChar
CreateFileW
SetFilePointer
WriteFile
SearchPathW
ReadFile
GetCurrentProcess
ExitProcess
HeapSetInformation
GetLongPathNameW
GetCommandLineW
lstrcmpiW
LocalAlloc
IsDebuggerPresent
RegisterApplicationRestart
GetDateFormatW
FormatMessageW
GlobalAlloc
GetProcAddress
GlobalLock
GetModuleHandleW
LocalReAlloc
DebugBreak
GlobalUnlock
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
CompareStringOrdinal
MulDiv
GetProcessHeap
GetCurrentProcessId
GetComputerNameW
LocalFree
CreateMutexExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
GetLastError
HeapAlloc
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
Sleep
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetModuleFileNameA

gdi32

GetStockObject
GetTextExtentPoint32W
StartPage
AbortDoc
EndDoc
DeleteDC
SetViewportOrgEx
SetAbortProc
StartDocW
EndPage
CreatePatternBrush
CreateBitmap
PatBlt
SelectClipRgn
GetObjectW
ExcludeClipRect
SelectObject
GetDeviceCaps
GetTextMetricsW
SetTextColor
SetBkColor
DeleteObject
CreateFontIndirectW
ExtTextOutW

user32

IsIconic
GetDpiForSystem
LoadMenuW
LoadImageW
UpdateWindow
DialogBoxParamW
PostQuitMessage
CheckMenuItem
GetSystemMetricsForDpi
SetCursor
InsertMenuW
EndDeferWindowPos
DrawMenuBar
GetProcessDefaultLayout
LoadIconW
TranslateMessage
TranslateAcceleratorW
GetSysColor
SetThreadDpiAwarenessContext
SetMenuDefaultItem
SetWindowPlacement
SetMenuItemInfoW
ClientToScreen
DestroyIcon
DispatchMessageW
BeginDeferWindowPos
ShowWindow
LoadStringW
LoadAcceleratorsW
GetWindowPlacement
RegisterClassExW
SetWindowTextW
ScreenToClient
DeleteMenu
CreateWindowExW
GetDpiForWindow
InsertMenuItemW
GetMenu
GetMenuItemID
PostMessageW
GetMenuItemInfoW
DeferWindowPos
GetMessageW
GetClientRect
CharNextW
SetCursorPos
CreateDialogParamW
CheckDlgButton
IntersectRect
GetMessagePos
ModifyMenuW
DrawAnimatedRects
SetForegroundWindow
FindWindowW
BringWindowToTop
GetLastActivePopup
PeekMessageW
IsDialogMessageW
GetWindow
CharUpperBuffW
IsCharAlphaNumericW
CharUpperW
GetWindowRect
GetDC
SetWindowPos
HideCaret
EndDialog
GetSystemMetrics
MessageBeep
SetCaretPos
GetSubMenu
OpenClipboard
SetTimer
CloseClipboard
EmptyClipboard
CreateCaret
SetDlgItemTextW
MapWindowPoints
SendDlgItemMessageW
MoveWindow
DestroyMenu
EnableWindow
GetWindowTextLengthW
CallWindowProcW
GetDlgItemInt
CheckRadioButton
SendMessageW
GetDlgItemTextW
IsDlgButtonChecked
SetFocus
GetClipboardData
ScrollWindowEx
LoadCursorW
DestroyCaret
SetCapture
SetClipboardData
SetWindowLongW
TrackPopupMenuEx
GetDlgItem
GetParent
GetWindowTextW
GetWindowLongW
SetScrollInfo
RegisterClipboardFormatW
DefWindowProcW
GetKeyState
DestroyWindow
IsClipboardFormatAvailable
ShowCaret
KillTimer
EnableMenuItem
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
CharLowerW
ShowCursor
RegisterClassW

msvcrt

_unlock
_lock
__CxxFrameHandler3
_acmdln
_initterm
__setusermatherr
_ismbblead
__p__fmode
_cexit
_exit
exit
__set_app_type
__getmainargs
_onexit
__p__commode
_XcptFilter
iswprint
memcpy
_except_handler4_common
_vsnwprintf
atoi
memcpy_s
_purecall
wcschr
isspace
_wcsnicmp
wcsrchr
wcsncmp
_resetstkoflw
?terminate@@YAXXZ
_controlfp
memset
__dllonexit
memmove
_amsg_exit

api-ms-win-core-path-l1-1-0

PathCchAddBackslash
PathCchCombine

shlwapi

StrChrW
StrRChrW
ord388
ord219
StrToIntW
StrChrIW
StrStrIW

comctl32

ImageList_ReplaceIcon
ord410
ord413
ImageList_SetBkColor
ord337
ord236
InitCommonControlsEx
ord384
ImageList_Create
ord4
ImageList_Destroy
ord340
ord2
ord329
ord334
ord338

comdlg32

GetOpenFileNameW
GetSaveFileNameW
ChooseFontW
PrintDlgExW

shell32

DragFinish
DragQueryFileW
SHGetStockIconInfo
ord6
ShellAboutW

authz

AuthzInitializeContextFromSid
AuthzFreeContext
AuthzFreeResourceManager
AuthzAccessCheck
AuthzInitializeResourceManager

aclui

ord2

ole32

CoTaskMemFree
CoInitializeEx
ReleaseStgMedium
CoUninitialize
CoCreateInstance
CoTaskMemAlloc

ulib

?SPrintfAppend@DSTRING@@UAAEPBGZZ
?NewBuf@DSTRING@@UAEEK@Z
?Resize@DSTRING@@UAEEK@Z
?Initialize@WSTRING@@QAEEPBGK@Z
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Strcat@WSTRING@@QAEEPBV1@@Z
??0DSTRING@@QAE@XZ
??1DSTRING@@UAE@XZ
?SPrintf@DSTRING@@UAAEPBGZZ
?Compare@OBJECT@@UBEJPBV1@@Z
??1OBJECT@@UAE@XZ
?Initialize@ARRAY@@QAEEKK@Z
??0OBJECT@@IAE@XZ
??0ARRAY@@QAE@XZ
?DebugDump@OBJECT@@UBEXE@Z

clb

ClbSetColumnWidths
ClbAddData

ntdll

RtlFreeHeap
RtlAllocateHeap
RtlCreateUnicodeString
RtlInitUnicodeString
RtlFreeUnicodeString
RtlIoDecodeMemIoResource
RtlCmDecodeMemIoResource

uxtheme

SetWindowTheme

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e38ac1f1bfcdcc722d22cc5e0517d9b6

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

api-ms-win-core-path-l1-1-0

shlwapi

comctl32

comdlg32

shell32

authz

aclui

ole32

ulib

clb

ntdll

uxtheme

Sections

.text Size: 118KB - Virtual size: 117KB

.data Size: 512B - Virtual size: 264KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 187KB - Virtual size: 186KB

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 118KB - Virtual size: 117KB

.data
Size: 512B - Virtual size: 264KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 187KB - Virtual size: 186KB

.reloc
Size: 9KB - Virtual size: 8KB