NEAS[.]53d7a55b0e82013f56dc7168efe0cdd0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.53d7a55b0e82013f56dc7168efe0cdd0.exe
Size

1.1MB
MD5

53d7a55b0e82013f56dc7168efe0cdd0
SHA1

466b5bec3209f19dc47b751ee14024927a29d127
SHA256

77dd2a54ad5be671fdaf6aa0d32389e24310e22e4e7d3db089dc66a75eed566f
SHA512

7079cb7b5f16208ad5bdef8ba30fefb306c60cdd2fc9058eb3d46ffa683930e7f1cbcd0c7e52fb59f0c2f1389e2b01ab0ecd80d95dc2a3f2bef195033c5f518b
SSDEEP

24576:YEebQ/nru+abitvwmLHgZuJ8t09T6I5EDWJjwBlTkef:YEO+aWdwmLHLJ8E6Iu6jTef

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.53d7a55b0e82013f56dc7168efe0cdd0.exe

Files

NEAS.53d7a55b0e82013f56dc7168efe0cdd0.exe
.dll windows:6 windows x86

df744b1cb2105de385ec066d19204503

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wintrust

WinVerifyTrust

advapi32

ConvertSidToStringSidA
SetSecurityDescriptorDacl
RegCloseKey
RegCreateKeyExW
OpenProcessToken
AllocateAndInitializeSid
CreateWellKnownSid
EqualSid
FreeSid
GetTokenInformation
IsValidSid
OpenThreadToken
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
EventRegister
EventUnregister
EventWrite
RegQueryInfoKeyW
RegGetValueW
RegEnumKeyW
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorDacl
GetLengthSid
CopySid
CheckTokenMembership
AddAccessDeniedAce
AddAccessAllowedAce
ConvertStringSecurityDescriptorToSecurityDescriptorW

kernel32

CopyFileW
SetLastError
WaitForSingleObjectEx
GetCommandLineW
SetCurrentDirectoryW
GlobalFree
GetCurrentThreadId
GetFullPathNameW
GetSystemDirectoryW
MultiByteToWideChar
VerSetConditionMask
WriteFile
VerifyVersionInfoW
GetUserDefaultLCID
GetDiskFreeSpaceExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalAlloc
LocalAlloc
LocalFree
SetFilePointerEx
GetFileType
GetTempPathW
EnterCriticalSection
LeaveCriticalSection
GetSystemTime
GetTickCount
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
ReleaseMutex
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount64
RaiseFailFastException
GetFileSize
GlobalMemoryStatusEx
GetNativeSystemInfo
GetProductInfo
GetUserGeoID
GetUserDefaultUILanguage
GetSystemDefaultLCID
TerminateProcess
LCIDToLocaleName
CreateMutexA
OpenMutexA
ReadFile
GetACP
IsValidLocale
RaiseException
RtlCaptureStackBackTrace
HeapAlloc
HeapFree
GetProcessHeap
DecodePointer
GetCommandLineA
EncodePointer
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
HeapSize
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCPInfo
GetOEMCP
IsValidCodePage
GetStringTypeW
LCMapStringW
InterlockedExchange
LoadLibraryW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW
lstrcmpW
InitializeCriticalSection
SetFileAttributesW
RemoveDirectoryW
GetFileAttributesExW
FindNextFileW
FindFirstFileW
DeleteFileW
CreateDirectoryW
GetCurrentThread
GetCurrentProcessId
CloseHandle
ExpandEnvironmentStringsW
WideCharToMultiByte
FormatMessageW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetVersionExW
SetErrorMode
FindFirstFileExW
FindClose
CompareStringEx
IsWow64Process
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
CreateFileW
LoadLibraryA
LoadResource
SizeofResource
FindResourceW
GetShortPathNameA
LocaleNameToLCID
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
CompareStringW

ole32

CoCreateInstance
CoCreateGuid
CoUninitialize
CoInitializeEx

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

gdi32

DeleteObject
CreateSolidBrush
DeleteDC
GetDeviceCaps
CreateDCA

Exports

Exports

WinMain

Sections

.text
Size: 409KB - Virtual size: 408KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 212KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 308KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df744b1cb2105de385ec066d19204503

Headers

DLL Characteristics

File Characteristics

Imports

version

wintrust

advapi32

kernel32

ole32

oleaut32

gdi32

Exports

Exports

Sections

.text Size: 409KB - Virtual size: 408KB

.data Size: 212KB - Virtual size: 242KB

.rsrc Size: 164KB - Virtual size: 163KB

.reloc Size: 308KB - Virtual size: 308KB

.text
Size: 409KB - Virtual size: 408KB

.data
Size: 212KB - Virtual size: 242KB

.rsrc
Size: 164KB - Virtual size: 163KB

.reloc
Size: 308KB - Virtual size: 308KB