NEAS[.]c41c6106acb70dedf0442f52762f4920[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c41c6106acb70dedf0442f52762f4920.exe
Size

345KB
MD5

c41c6106acb70dedf0442f52762f4920
SHA1

65bb7e6e0c6c079a41be2d0d49f855c5ca967931
SHA256

dba64a834fed477c85068a328317327eeeb2fff2f1137334a697817d055db80e
SHA512

c9f782f4ac7c6c1b5ced19a28cd4cdfe1ac7b7d5ae373538ba846b2e22308f79bfb880ce8fcf74c00c885589c859581c800bf2abfca1c47693362c63f788cba9
SSDEEP

6144:H6LKgZXSiq0dj4VsPKVkEhSsPQEAl4xwfki0tiF0bKEtE6h3G:HSq0clVJ0sPQEAlZV0tTbr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c41c6106acb70dedf0442f52762f4920.exe

Files

NEAS.c41c6106acb70dedf0442f52762f4920.exe
.exe windows:6 windows x86

759486ab43cb52df3577d6a2b8b7ceca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

ImageNtHeader
MiniDumpWriteDump

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW
UuidFromStringW

iphlpapi

GetExtendedTcpTable

ws2_32

ntohs

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

StrCmpIW
PathFindExtensionW
PathFindFileNameW

kernel32

CreateFileW
GetFileAttributesW
GetCurrentThreadId
GetVersionExW
ReleaseMutex
SuspendThread
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
CreateEventW
GetExitCodeThread
Sleep
FormatMessageW
GetLastError
SetEvent
DeleteFileW
CloseHandle
K32GetModuleBaseNameA
GetSystemInfo
K32GetModuleInformation
CreateThread
GetProcAddress
VirtualAllocEx
GetFileSize
ExitProcess
ReadProcessMemory
GetComputerNameW
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
SleepEx
CreateRemoteThread
QueryFullProcessImageNameW
K32EnumProcessModules
VirtualFreeEx
K32GetMappedFileNameW
DebugBreak
MoveFileW
CreateMutexW
OpenThread
LoadLibraryExW
FlushFileBuffers
GetExitCodeProcess
RaiseException
WaitForSingleObject
LeaveCriticalSection
Thread32Next
InitializeCriticalSectionAndSpinCount
K32GetModuleFileNameExW
GetModuleFileNameW
VirtualAlloc
WriteFile
GetCurrentProcess
FindNextFileW
VirtualFree
EnterCriticalSection
WriteProcessMemory
FindFirstFileW
SetConsoleCtrlHandler
ReadFile
CreateDirectoryW
FindClose
VirtualProtect
LoadLibraryExA
HeapAlloc
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
QueryPerformanceCounter
GetPrivateProfileStringW
ExpandEnvironmentStringsW
SetLastError
GetSystemTimeAsFileTime
GetProcessHeap
InitializeSListHead
SetFilePointer
Thread32First
CompareStringW
HeapReAlloc
GetEnvironmentVariableW
SetEnvironmentVariableW
lstrlenW
VirtualQuery

advapi32

LookupPrivilegeValueW
RegisterServiceCtrlHandlerExW
AdjustTokenPrivileges
RegCloseKey
CloseServiceHandle
OpenSCManagerW
SetServiceStatus
OpenProcessToken
StartServiceW
RegOpenKeyExW
StartServiceCtrlDispatcherW
OpenServiceW
QueryServiceStatusEx
RegQueryValueExW
EventRegister
EventUnregister
EventWriteString

vcruntime140

__std_exception_copy
__CxxFrameHandler3
wcsrchr
__std_exception_destroy
wcschr
memset
_CxxThrowException
_except_handler4_common
memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf
__stdio_common_vswscanf
__acrt_iob_func
_set_fmode
__p__commode
__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcsnlen
_wcsicmp
_stricmp
_wcsnicmp
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv
_cexit
_crt_atexit
_seh_filter_exe
_exit
_register_onexit_function
_initialize_onexit_table
_initialize_wide_environment
_get_initial_wide_environment
_controlfp_s
_errno
terminate
_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
__p___wargv
_c_exit
_set_app_type
exit
__p___argc

api-ms-win-crt-time-l1-1-0

_time64
_wstrdate_s
_gmtime64_s
_wstrtime_s

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s
_wremove
_wsplitpath_s

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 222KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

759486ab43cb52df3577d6a2b8b7ceca

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

rpcrt4

iphlpapi

ws2_32

version

shlwapi

kernel32

advapi32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 57KB - Virtual size: 57KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 19KB - Virtual size: 148KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 222KB - Virtual size: 224KB

.text
Size: 57KB - Virtual size: 57KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 19KB - Virtual size: 148KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 222KB - Virtual size: 224KB