NEAS[.]b797fddab7c98f97a1976035719a9e00[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b797fddab7c98f97a1976035719a9e00.exe
Size

180KB
MD5

b797fddab7c98f97a1976035719a9e00
SHA1

6bf18b7b34b5f547fcbd8dbceb9cd9ebe532da9e
SHA256

d156240c10f5137a7bd2021b45673b1b1c8f83cf0bb6d862973a20bbdc553e82
SHA512

d2ec86222f7c095bdb0aeac0ee66fd3143c3adec17e6588a979aff8f84983a98449cd7ae8ed73abc2951bd99d32528fa49c55a4214b55e48c5d4642a60b2b2a7
SSDEEP

3072:AMysfToSW6v9Q2Efyt24MrFwgJFw/NtE3m7UPKl5lzaOqTbHmg:hx9QffyA4MKg7wT173l5lkPGg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b797fddab7c98f97a1976035719a9e00.exe

Files

NEAS.b797fddab7c98f97a1976035719a9e00.exe
.exe windows:4 windows x86

47b9eda854d0b5e777e46ac113ad792d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
lstrcatW
WriteFile
GetTickCount
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GlobalAlloc
LockResource
LoadResource
SizeofResource
FindResourceA
LoadLibraryExA
VirtualAlloc
WaitForSingleObject
SetEvent
CreateThread
DeleteFileW
CopyFileA
CreateDirectoryA
GetModuleFileNameW
GetModuleFileNameA
GetTempPathA
ExitProcess
lstrcmpiW
GetLocalTime
GetCommandLineW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetOEMCP
GetACP
CopyFileW
CreateFileW
GetModuleHandleA
CloseHandle
GetCurrentProcess
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
lstrcmpiA
GetSystemDefaultLCID
lstrcpyW
AddAtomW
LoadLibraryA
GetProcAddress
CreateFileA
GetLastError
CreateEventA
GetCPInfo
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapReAlloc
VirtualFree
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
HeapFree
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
GetStringTypeW

user32

wsprintfA

advapi32

RegCloseKey
RegSetValueExA
StartServiceCtrlDispatcherA
RegOpenKeyExA
RegQueryValueExA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegisterServiceCtrlHandlerA
SetServiceStatus
RegCreateKeyExA
RegQueryValueExW
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

shell32

CommandLineToArgvW

shlwapi

PathFileExistsW

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47b9eda854d0b5e777e46ac113ad792d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

shlwapi

Sections

.text Size: 20KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 140KB - Virtual size: 138KB

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 140KB - Virtual size: 138KB