NEAS[.]bf928d4ed4d45eeedfc0fa6ead53d660[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.bf928d4ed4d45eeedfc0fa6ead53d660.exe
Size

1.2MB
MD5

bf928d4ed4d45eeedfc0fa6ead53d660
SHA1

91199b6ddf34fcdc980abaf04dd239a1697d01e1
SHA256

2d6a14c155c5878a1db699386583791df89935f3308f23098dc09357937e8bb1
SHA512

548923d5f6bc76762bc257f9ae2e2e5bfc1638494e7cedad024ae4c752b922b036a1bce97090c43bf9e724e4e5dd062ab9f4946056029b5ca4687fc57404439d
SSDEEP

24576:qq44R38kt34JBWuEfLNRl3cU95bb3sqmimNBiBuv3aLo+xx86hSEPeHlxQ6ElpBk:VJsqtsqKTKLa4Hq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.bf928d4ed4d45eeedfc0fa6ead53d660.exe

Files

NEAS.bf928d4ed4d45eeedfc0fa6ead53d660.exe
.exe windows:4 windows x86

c6dfa5c35c5f19a99baa5ed7da41c6fc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
WriteFile
GetFileSize
SetEndOfFile
FileTimeToSystemTime
GetFileTime
CreateFileA
GetTempFileNameA
GetTempPathA
DeleteFileA
MoveFileA
CreateDirectoryA
GetFileAttributesA
CopyFileA
WaitForSingleObject
ReleaseSemaphore
SetEvent
ResetEvent
CreateSemaphoreA
CreateEventA
CreateThread
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalUnlock
GlobalLock
Sleep
GetModuleFileNameA
GetWindowsDirectoryA
GetCurrentProcess
GetVersionExA
GetModuleHandleA
OpenProcess
CreateProcessA
CompareFileTime
SystemTimeToFileTime
ReleaseMutex
GetLocaleInfoA
WideCharToMultiByte
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
SetFilePointer
GetNumberOfConsoleInputEvents
GetCommandLineA
GetVersion
ExitProcess
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapAlloc
HeapFree
FlushFileBuffers
InitializeCriticalSection
DeleteCriticalSection
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
VirtualAlloc
HeapReAlloc
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
SetStdHandle
CompareStringW
SetEnvironmentVariableA
CloseHandle
GetFullPathNameA
CompareStringA
GlobalReAlloc
GetLastError
GlobalFree
GlobalAlloc
PeekConsoleInputA
GetCurrentProcessId

user32

GetWindowThreadProcessId
ShowWindow
EnumWindows
GetClassNameA

advapi32

RegQueryValueExA
GetUserNameA
RegCloseKey
RegEnumValueA
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyExA

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation

wsock32

htons
closesocket
inet_ntoa
socket
recv
send
WSACleanup
WSAStartup
gethostbyname
ioctlsocket
connect
select
__WSAFDIsSet
WSAGetLastError

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 748KB - Virtual size: 744KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 420KB - Virtual size: 418KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c6dfa5c35c5f19a99baa5ed7da41c6fc

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

wsock32

version

Sections

.text Size: 748KB - Virtual size: 744KB

.rdata Size: 420KB - Virtual size: 418KB

.data Size: 24KB - Virtual size: 35KB

.crdata Size: 20KB - Virtual size: 20KB

.text
Size: 748KB - Virtual size: 744KB

.rdata
Size: 420KB - Virtual size: 418KB

.data
Size: 24KB - Virtual size: 35KB

.crdata
Size: 20KB - Virtual size: 20KB