NEAS[.]2d62d1f7ae49d8962372d36da3b915a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2d62d1f7ae49d8962372d36da3b915a0.exe
Size

2.7MB
MD5

2d62d1f7ae49d8962372d36da3b915a0
SHA1

31775f7d3e09caae02d30b8c6f5c7a58278715c1
SHA256

41bc9c7f38c2f7820e7711370752ec595f34e3ffd73240318a4ea108601cff56
SHA512

8ebf0432d50fa0b503feebf843675502ee666b4b01cc862bcfb2fcad5274524f9bf893f4c64ca2ab721946d058654b3de5eeacde7a208a77705a29d7f1b44a08
SSDEEP

49152:t6ChnNWBXeTQAd8p5VvuYJCV4fFEmZfNGpo7waygUNB:t6ChnNWBlM8NJjimZfNGuc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2d62d1f7ae49d8962372d36da3b915a0.exe

Files

NEAS.2d62d1f7ae49d8962372d36da3b915a0.exe
.exe windows:4 windows x86

0e74aae528bab873fa4745dd8ac43294

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

usp10

ScriptIsComplex
ScriptStringAnalyse
ScriptStringFree
ScriptStringOut
ScriptString_pSize
ScriptString_pcOutChars

libcairo-2

cairo_arc
cairo_create
cairo_destroy
cairo_fill
cairo_fill_preserve
cairo_line_to
cairo_move_to
cairo_paint
cairo_ps_surface_create
cairo_ps_surface_set_eps
cairo_recording_surface_create
cairo_recording_surface_ink_extents
cairo_rectangle
cairo_restore
cairo_save
cairo_scale
cairo_select_font_face
cairo_set_dash
cairo_set_font_size
cairo_set_line_width
cairo_set_source_rgb
cairo_set_source_surface
cairo_show_text
cairo_status
cairo_status_to_string
cairo_stroke
cairo_surface_destroy
cairo_surface_status
cairo_surface_write_to_png
cairo_svg_surface_create
cairo_text_extents
cairo_translate
cairo_win32_printing_surface_create
cairo_win32_surface_create

libgdk-win32-2.0-0

gdk_cairo_set_source_pixbuf

libgdk_pixbuf-2.0-0

IID_IDispatch
IID_IEnumVARIANT
gdk_pixbuf_get_width
gdk_pixbuf_new_from_file_at_scale_utf8

libgio-2.0-0

g_file_get_type
g_file_load_contents_async
g_file_load_contents_finish
g_file_new_for_uri

libglib-2.0-0

g_array_append_vals
g_array_free
g_array_insert_vals
g_array_new
g_array_remove_index_fast
g_array_set_size
g_array_sized_new
g_array_sort
g_ascii_strcasecmp
g_ascii_strdown
g_ascii_strncasecmp
g_ascii_strtod
g_ascii_strup
g_ascii_table
g_ascii_tolower
g_ascii_toupper
g_blow_chunks
g_build_filename
g_convert
g_convert_with_fallback
g_date_free
g_date_get_day
g_date_get_month
g_date_get_year
g_date_new
g_date_set_time_t
g_dir_close
g_dir_open_utf8
g_dir_read_name_utf8
g_error_free
g_file_get_contents_utf8
g_file_set_contents
g_file_test_utf8
g_fopen
g_free
g_get_home_dir
g_get_tmp_dir
g_hash_table_destroy
g_hash_table_insert
g_hash_table_lookup
g_hash_table_new
g_hash_table_new_full
g_log
g_malloc
g_malloc0
g_malloc0_n
g_malloc_n
g_mem_set_vtable
g_memdup
g_path_get_basename
g_path_get_dirname
g_pattern_match_string
g_pattern_spec_free
g_pattern_spec_new
g_ptr_array_add
g_ptr_array_free
g_ptr_array_new
g_ptr_array_new_with_free_func
g_ptr_array_remove_fast
g_ptr_array_remove_index
g_ptr_array_set_size
g_ptr_array_sort
g_queue_free
g_queue_is_empty
g_queue_new
g_queue_pop_tail
g_queue_push_tail
g_random_double
g_random_int_range
g_realloc
g_realloc_n
g_rename
g_return_if_fail_warning
g_slist_prepend
g_snprintf
g_str_equal
g_str_has_suffix
g_str_hash
g_strcasecmp
g_strchomp
g_strchug
g_strdup
g_strdup_printf
g_strdup_vprintf
g_strfreev
g_string_append
g_string_append_len
g_string_append_printf
g_string_append_unichar
g_string_assign
g_string_erase
g_string_free
g_string_insert
g_string_insert_c
g_string_new
g_string_printf
g_string_sized_new
g_string_truncate
g_strjoin
g_strlcpy
g_strndup
g_strrstr_len
g_strsplit
g_timer_destroy
g_timer_elapsed
g_timer_new
g_timer_start
g_unichar_isupper
g_unichar_iszerowidth
g_unichar_to_utf8
g_unichar_toupper
g_unicode_canonical_decomposition
g_unlink
g_utf16_to_utf8
g_utf8_casefold
g_utf8_collate_key_for_filename
g_utf8_get_char
g_utf8_normalize
g_utf8_skip
g_utf8_strchr
g_utf8_strdown
g_utf8_to_utf16
g_utf8_validate
g_win32_error_message

libgobject-2.0-0

g_object_unref
g_signal_connect_data
g_type_check_instance_cast

libgtk-win32-2.0-0

gtk_box_get_type
gtk_box_pack_end
gtk_dialog_get_type
gtk_dialog_run
gtk_init_abi_check
gtk_label_get_type
gtk_label_new
gtk_label_set_markup
gtk_message_dialog_get_message_area
gtk_message_dialog_get_type
gtk_message_dialog_new_with_markup
gtk_widget_destroy
gtk_widget_get_type
gtk_widget_show
gtk_widget_show_all
gtk_window_get_type
gtk_window_set_title

advapi32

CryptAcquireContextW
CryptGenRandom
GetUserNameW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

comctl32

CreateMappedBitmap
CreateStatusWindowA
CreateToolbarEx
InitCommonControlsEx

comdlg32

ChooseColorA
ChooseFontW
GetOpenFileNameA
GetOpenFileNameW
GetSaveFileNameA
GetSaveFileNameW
PrintDlgA

gdi32

AbortDoc
AddFontResourceA
BitBlt
CloseEnhMetaFile
CreateCompatibleBitmap
CreateCompatibleDC
CreateEnhMetaFileW
CreateFontA
CreateFontIndirectA
CreatePen
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
EndDoc
EndPage
EnumFontFamiliesExA
Escape
ExtTextOutA
ExtTextOutW
GetDeviceCaps
GetObjectA
GetStockObject
GetTextColor
GetTextExtentExPointA
GetTextExtentExPointW
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextMetricsA
LineTo
MoveToEx
RemoveFontResourceA
SelectObject
SetBkColor
SetBkMode
SetTextAlign
SetTextColor
StartDocA
StartPage
TextOutA
TextOutW

kernel32

CloseHandle
CreateDirectoryW
CreateFileW
CreatePipe
CreateProcessA
CreateProcessW
CreateSemaphoreW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileW
FindNextFileW
FindResourceA
FlushFileBuffers
FreeLibrary
GetComputerNameW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLogicalDrives
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetProcessTimes
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetTickCount
GetTimeZoneInformation
GetUserDefaultLangID
GetVersion
GetVersionExW
GetVolumeInformationW
GlobalAlloc
GlobalLock
GlobalMemoryStatus
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
IsBadReadPtr
IsBadWritePtr
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LoadResource
LocalFileTimeToFileTime
LockFile
LockFileEx
MoveFileW
MulDiv
MultiByteToWideChar
OutputDebugStringA
PeekNamedPipe
QueryPerformanceCounter
ReadFile
RemoveDirectoryW
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetErrorMode
SetFileAttributesW
SetFilePointer
SetFileTime
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
_lclose
_lopen

msvcrt

__dllonexit
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_errno
_fmode
_initterm
_iob
_lock
_onexit
_setmode
_stat
time
_unlock
calloc
exit
fclose
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getc
getenv
isxdigit
localeconv
log10
malloc
memchr
memcmp
memcpy
memmove
memset
printf
rand
realloc
setlocale
signal
sprintf
srand
sscanf
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strrchr
strspn
strstr
strtok
abort
atof
atoi
atol
system
toupper
vfprintf
vsprintf
wcslen
wcsncpy
_vsnprintf
_write
_strlwr
_read
_open
_mkdir
_lseek
_getpid
_close
_chdir

odbc32

SQLAllocConnect
SQLAllocEnv
SQLAllocStmt
SQLDisconnect
SQLDriverConnectW
SQLDrivers
SQLExecDirectW
SQLFreeConnect
SQLFreeEnv
SQLFreeStmt
SQLTransact

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
OleInitialize
OleUninitialize

oleaut32

GetActiveObject
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPutElement
SysAllocStringLen
SysFreeString
SysStringLen
VarCyFromR8
VarDecFromR8
VarR8FromCy
VarR8FromDec
VariantClear
VariantInit

libwinpthread-1

pthread_getspecific
pthread_key_create
pthread_mutex_lock
pthread_mutex_unlock
pthread_once
pthread_setspecific

shell32

DragFinish
DragQueryFileW
FindExecutableA
ShellExecuteA

user32

ActivateKeyboardLayout
AdjustWindowRect
AdjustWindowRectEx
AppendMenuA
AppendMenuW
BeginDeferWindowPos
BeginPaint
CallMsgFilterA
CallNextHookEx
CallWindowProcA
CascadeWindows
CharUpperA
CheckDlgButton
CheckMenuItem
CheckRadioButton
ClientToScreen
CloseClipboard
CountClipboardFormats
CreateDialogIndirectParamA
CreateDialogIndirectParamW
CreateMenu
CreatePopupMenu
CreateWindowExA
CreateWindowExW
DefWindowProcA
DeferWindowPos
DeleteMenu
DestroyMenu
DestroyWindow
DialogBoxIndirectParamA
DispatchMessageA
DispatchMessageW
DragDetect
DrawMenuBar
DrawTextA
EmptyClipboard
EnableMenuItem
EnableWindow
EndDeferWindowPos
EndDialog
EndPaint
EqualRect
FillRect
FindWindowA
FindWindowExA
FrameRect
GetActiveWindow
GetAsyncKeyState
GetCapture
GetCaretPos
GetClassInfoA
GetClassNameA
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetDesktopWindow
GetDlgItem
GetDlgItemInt
GetDlgItemTextA
GetFocus
GetKeyState
GetKeyboardState
GetMenu
GetMenuItemCount
GetMenuItemInfoA
GetMessageA
GetMessageW
GetParent
GetPropA
GetScrollPos
GetSubMenu
GetSysColor
GetSysColorBrush
GetSystemMetrics
GetUpdateRect
GetWindowLongA
GetWindowRect
GetWindowTextA
GetWindowTextW
InsertMenuItemA
InvalidateRect
IsClipboardFormatAvailable
IsDialogMessageA
IsDialogMessageW
IsDlgButtonChecked
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
LoadBitmapA
LoadCursorA
LoadIconA
LoadImageA
LoadKeyboardLayoutA
LoadMenuIndirectA
MapDialogRect
MessageBeep
MessageBoxA
MessageBoxIndirectA
MessageBoxIndirectW
MessageBoxW
MoveWindow
OffsetRect
OpenClipboard
PeekMessageA
PeekMessageW
PostMessageA
PostQuitMessage
RegisterClassA
RegisterClipboardFormatA
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropA
ScreenToClient
ScrollWindow
ScrollWindowEx
SendDlgItemMessageA
SendMessageA
SendMessageW
SetActiveWindow
SetCapture
SetClassLongA
SetClipboardData
SetCursor
SetDlgItemTextA
SetFocus
SetForegroundWindow
SetKeyboardState
SetMenu
SetMenuDefaultItem
SetMenuItemInfoA
SetPropA
SetRectEmpty
SetScrollInfo
SetScrollPos
SetScrollRange
SetSysColors
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
SetWindowTextW
SetWindowsHookExA
ShowWindow
TileWindows
ToAscii
TrackPopupMenu
TranslateMessage
UnionRect
UpdateWindow
ValidateRect
keybd_event
wsprintfW

ws2_32

WSACleanup
WSAGetLastError
WSAIoctl
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getpeername
getsockname
getsockopt
htonl
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 484KB - Virtual size: 483KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0e74aae528bab873fa4745dd8ac43294

Headers

File Characteristics

Imports

usp10

libcairo-2

libgdk-win32-2.0-0

libgdk_pixbuf-2.0-0

libgio-2.0-0

libglib-2.0-0

libgobject-2.0-0

libgtk-win32-2.0-0

advapi32

comctl32

comdlg32

gdi32

kernel32

msvcrt

odbc32

ole32

oleaut32

libwinpthread-1

shell32

user32

ws2_32

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.data Size: 90KB - Virtual size: 89KB

.rdata Size: 484KB - Virtual size: 483KB

.bss Size: - Virtual size: 14KB

.idata Size: 20KB - Virtual size: 20KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 32B

.rsrc Size: 32KB - Virtual size: 31KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 90KB - Virtual size: 89KB

.rdata
Size: 484KB - Virtual size: 483KB

.bss
Size: - Virtual size: 14KB

.idata
Size: 20KB - Virtual size: 20KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 32B

.rsrc
Size: 32KB - Virtual size: 31KB