NEAS[.]2ec9f738c302650a415efeea03b43f80[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2ec9f738c302650a415efeea03b43f80.exe
Size

516KB
MD5

2ec9f738c302650a415efeea03b43f80
SHA1

fd499522ace353ec359e6c8a29be3c228f778fd1
SHA256

9113b1bdc90c8d0fd3c8651302c8878914d9eab13bb58fbf7c36c956203c1265
SHA512

914f6fd1510577bad346a2c4b5fb6442dee296ab0427d1840838fb9a244c0210366ffedf752aa315168926f12a07b46cd4cdbe28d5bc479e878cbeb90e3510ff
SSDEEP

6144:YQe8bChUMKXET+A/mhWtu+LtK3KZEayaL3x/6q8y/M6zgVQ:3pbChUMzT+zE8+LpEayaL3h/98

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2ec9f738c302650a415efeea03b43f80.exe

Files

NEAS.2ec9f738c302650a415efeea03b43f80.exe
.exe windows:4 windows x86

d5befff3fb5d9424e6340023d46e15d2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

sierrapt

SP_SetVisitHostDlgHelpCallback
SP_SetProxyDlgHelpCallback
SP_SetSelectDlgHelpCallback
SP_SetDownloadDlgHelpCallback
SP_SetPatchDescriptionExe
SP_SetCustomResourceDll
SP_SetOptionalPatchDlgHelpCallback
SP_SetPatchDescriptionTimeout
SP_SetPatchTimeout
SP_SetLanguageDll
SP_SetExtraConfig
SP_AddDirectoryServer
SP_ClearDirectoryServers
SP_SetCurrentVersion
SP_SetPatchTypes
SP_SetPatchFolder
SP_SetDisplayName
SP_SetProductName
SP_SetParentWindow
SP_SetDebug
SP_GetPatchFile
SP_DownloadPatch
SP_CheckForPatch
SP_SelectOptionalPatch
SP_CheckMessageOfTheDay
SP_ConfigureProxy
SP_SetVersionTimeout
SP_SetMotdTimeout
SP_MessageBox

kernel32

GlobalFindAtomA
GlobalAddAtomA
GlobalDeleteAtom
lstrcpyA
lstrcmpiA
lstrcatA
GetVersion
SetLastError
MulDiv
GlobalGetAtomNameA
lstrlenA
GlobalAlloc
GlobalLock
GetProcAddress
GlobalFlags
LocalAlloc
TlsAlloc
GlobalHandle
TlsFree
GetCurrentThread
lstrcpynA
LocalReAlloc
TlsGetValue
GetProcessVersion
GetCPInfo
GetOEMCP
SetErrorMode
GetCurrentProcess
GlobalReAlloc
FlushFileBuffers
SetEndOfFile
GetFullPathNameA
LocalFileTimeToFileTime
SystemTimeToFileTime
TlsSetValue
WinExec
FileTimeToLocalFileTime
RtlUnwind
GetFileType
GetStartupInfoA
ExitProcess
GetTimeZoneInformation
GetSystemTime
GetLocalTime
IsBadReadPtr
RaiseException
HeapAlloc
HeapFree
TerminateProcess
HeapReAlloc
HeapSize
GetACP
LCMapStringA
LCMapStringW
SetStdHandle
SetHandleCount
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalUnlock
GlobalFree
GetModuleHandleA
GetDiskFreeSpaceA
GetSystemTimeAsFileTime
SetEvent
EnterCriticalSection
GetCurrentThreadId
MultiByteToWideChar
LeaveCriticalSection
WideCharToMultiByte
Sleep
lstrcmpA
GetExitCodeProcess
CreateProcessA
GetModuleFileNameA
GetCurrentDirectoryA
LocalFree
GetLastError
FormatMessageA
WriteFile
SizeofResource
LockResource
GetCommandLineA
LoadLibraryA
SetCurrentDirectoryA
SetFileTime
GetDriveTypeA
FindFirstFileA
FindClose
CreateFileA
CloseHandle
GetVersionExA
DeleteFileA
DeleteCriticalSection
GetTickCount
LoadResource
FindResourceA
InterlockedIncrement
GetTempPathA
GetPrivateProfileStringA
WritePrivateProfileStringA
FreeLibrary
InterlockedDecrement
InitializeCriticalSection
FileTimeToSystemTime
ReadFile
SetFilePointer
GetProfileStringA

user32

AdjustWindowRectEx
SetFocus
MapWindowPoints
SendDlgItemMessageA
UpdateWindow
SetDlgItemTextA
IsDialogMessageA
SetWindowTextA
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
GetMenuCheckMarkDimensions
ClientToScreen
GetDC
BeginPaint
GrayStringA
PostQuitMessage
SetCursor
GetCursorPos
ValidateRect
GetMessageA
DestroyMenu
GetClassNameA
GetSysColorBrush
CopyRect
TabbedTextOutA
EndPaint
OffsetRect
SetWindowsHookExA
SystemParametersInfoA
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
IsWindowEnabled
DestroyWindow
CreateWindowExA
GetKeyState
WaitForInputIdle
DrawIcon
GetSystemMenu
AppendMenuA
GetDlgItem
DestroyIcon
FindWindowA
GetLastActivePopup
IsIconic
SetForegroundWindow
IsWindowVisible
PeekMessageA
TranslateMessage
DispatchMessageA
DrawTextA
GetWindowLongA
SetWindowLongA
GetSysColor
ScreenToClient
KillTimer
ReleaseCapture
SetTimer
SetCapture
PtInRect
PostMessageA
GetFocus
GetWindowRect
ShowWindow
IsWindow
GetSystemMetrics
InvalidateRect
GetClientRect
GetWindowDC
GetParent
ReleaseDC
LoadStringA
LoadIconA
LoadCursorA
LoadBitmapA
wsprintfA
EnableWindow
SendMessageA
GetTopWindow
MessageBoxA
GetCapture
WinHelpA
RegisterClassA
GetMenu
CallNextHookEx
GetMenuItemID
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
GetMenuItemCount
GetSubMenu
GetWindowTextLengthA
DefWindowProcA
GetWindowTextA
GetDlgCtrlID
RegisterWindowMessageA
IntersectRect
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
GetWindow
GetClassInfoA
SetWindowPos
ExcludeUpdateRgn
UnregisterClassA
HideCaret
ShowCaret
IsWindowUnicode
DrawFocusRect
DefDlgProcA
InflateRect
CharNextA

gdi32

CreateDIBitmap
BitBlt
CreateCompatibleDC
GetTextMetricsA
PatBlt
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
SetPixel
Rectangle
CreateSolidBrush
DeleteObject
CreatePatternBrush
LineTo
MoveToEx
SelectObject
SetTextColor
SetBkMode
GetClipBox
SetBkColor
GetObjectA
CreateBitmap
DeleteDC
SaveDC
RestoreDC
GetStockObject
SetMapMode
OffsetViewportOrgEx
SetViewportExtEx
SetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
SetWindowExtEx
IntersectClipRect
GetTextExtentPointA
CreatePen

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA

comctl32

ord17

wsock32

closesocket
shutdown
send
recv
getsockopt
WSAGetLastError
select
__WSAFDIsSet
ioctlsocket
connect
htons
socket
inet_ntoa
setsockopt
gethostbyname

Sections

.text
Size: 256KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 16KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 152KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gda
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d5befff3fb5d9424e6340023d46e15d2

Headers

File Characteristics

Imports

version

sierrapt

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

wsock32

Sections

.text Size: 256KB - Virtual size: 254KB

.rdata Size: 44KB - Virtual size: 40KB

.data Size: 16KB - Virtual size: 40KB

.rsrc Size: 152KB - Virtual size: 168KB

.gda Size: 40KB - Virtual size: 37KB

.text
Size: 256KB - Virtual size: 254KB

.rdata
Size: 44KB - Virtual size: 40KB

.data
Size: 16KB - Virtual size: 40KB

.rsrc
Size: 152KB - Virtual size: 168KB

.gda
Size: 40KB - Virtual size: 37KB