NEAS[.]57a636a06b7ab4e4ecae4406b3efb6a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.57a636a06b7ab4e4ecae4406b3efb6a0.exe
Size

577KB
MD5

57a636a06b7ab4e4ecae4406b3efb6a0
SHA1

71d502a402c6cce4a5ef4e332e466fb7bbaa998e
SHA256

22ef221ff30704660d3f315aa02b37609c05278e928e0ff4533e5ff938929e8b
SHA512

673868fd7ca653f21aec8a177f11c87e430f66543b5fa821cf4c8846f9ee5e365dde0d9c0d6db194f6e0533f1bb262c6af6cd80ed9ee62ebdea6ecacf6274ccb
SSDEEP

12288:Xhxqi2eCB8A1b0k20EsqTt8DzYhVdr4Gh58SJBa:Rj2ew8A+5SqrLhqSJB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.57a636a06b7ab4e4ecae4406b3efb6a0.exe

Files

NEAS.57a636a06b7ab4e4ecae4406b3efb6a0.exe
.dll regsvr32 windows:6 windows x86

ede47f715d14052027725b8aebadbe1b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr100

?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
vswprintf_s
calloc
_vsnwprintf_s
_wtol
??_V@YAXPAX@Z
??2@YAPAXI@Z
memcpy_s
wcscat_s
wcscpy_s
wcsncpy_s
wcsstr
free
malloc
_recalloc
??_U@YAPAXI@Z
__CxxFrameHandler3
memset
iswspace
memcpy
realloc
memcmp
memmove
wcschr
wcscspn
??3@YAXPAX@Z

kernel32

GetCurrentProcessId
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
HeapFree
HeapAlloc
WerRegisterMemoryBlock
VirtualProtect
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryA
HeapSetInformation
GetProcessHeap
QueryPerformanceCounter
GetModuleFileNameA
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DisableThreadLibraryCalls
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
lstrcmpiW
lstrlenW
FindResourceW
MultiByteToWideChar
WaitForSingleObject
GetCurrentThreadId
GetSystemDefaultLCID
SetEvent
WaitForMultipleObjects
Sleep
CompareStringW
WideCharToMultiByte
GetUserDefaultLCID
InitializeCriticalSection

ole32

CoCreateGuid
CoTaskMemFree
CoTaskMemRealloc
StringFromCLSID
CoGetMalloc
CoCreateInstance
CoTaskMemAlloc
StringFromGUID2

oleaut32

VariantClear
VariantCopy
VariantInit
VarCmp
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VarSu
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetElement
VarBstrCmp
SetErrorInfo
GetErrorInfo
CreateErrorInfo
VariantChangeTypeEx
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
SysFreeString
VarAdd

advapi32

RegOpenKeyExA
RegCreateKeyExW
RegDeleteKeyW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW

mfc100u

ord3413
ord2068
ord2062
ord2064

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 281KB - Virtual size: 280KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ede47f715d14052027725b8aebadbe1b

Headers

DLL Characteristics

File Characteristics

Imports

msvcr100

kernel32

ole32

oleaut32

advapi32

mfc100u

Exports

Exports

Sections

.text Size: 281KB - Virtual size: 280KB

.data Size: 10KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 280KB - Virtual size: 280KB

.text
Size: 281KB - Virtual size: 280KB

.data
Size: 10KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 280KB - Virtual size: 280KB