NEAS[.]cf1fcd52146579ac25159711d3795800[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cf1fcd52146579ac25159711d3795800.exe
Size

28KB
MD5

cf1fcd52146579ac25159711d3795800
SHA1

c42971522723605d99f75ffd69cf21848a77186b
SHA256

f800177e47a23b901c65b7e2a367c220996e78a2b9ec64505e3d81e9fd8a81eb
SHA512

70e25dc53c41df072ad550bca036dd69d1244c5ee37e21df8e7d21b091272f238cc4b8cfd1755909954cadf445843438acbf0a2762dd023d9a17a32b08008e7b
SSDEEP

384:8fT1jhfLGG677puuypDE9xep0TyA1tgsx:8fTGGI/7GATtlx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cf1fcd52146579ac25159711d3795800.exe

Files

NEAS.cf1fcd52146579ac25159711d3795800.exe
.exe windows:4 windows x86

a4dbf4a69092d8693bc39eac83eab378

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetLastError
CreateFileMappingA
CreateThread
OutputDebugStringA
GetModuleHandleA
GetStartupInfoA

user32

wsprintfA

msvcrt

_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strlen
_onexit
__dllonexit
isalpha
strcpy
sprintf
strstr
??3@YAXPAX@Z
atol
__CxxFrameHandler
memset
memcmp
memcpy
??2@YAPAXI@Z

msvcp60

??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

ws2_32

recv
closesocket
shutdown
ioctlsocket
__WSAFDIsSet
accept
listen
bind
htonl
htons
select
socket
WSAStartup
gethostbyname
inet_addr
WSAGetLastError
connect
WSASocketA
send
setsockopt

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a4dbf4a69092d8693bc39eac83eab378

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

msvcp60

ws2_32

Sections

.text Size: 12KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 2KB

.text
Size: 12KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 2KB