NEAS[.]9179961fdb167533625c4032d6498050[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9179961fdb167533625c4032d6498050.exe
Size

100KB
MD5

9179961fdb167533625c4032d6498050
SHA1

3c98cd21e8730a8c39d9b5c639d22b5e4d4d0c79
SHA256

5162501d8b4bec90d716a095548b976c35a2a222a2230384011e30dd0241739d
SHA512

d2d6cbbf87657d649e05430bcff38b30f4c25df31150231b103914c3b1e1470775f70718fd0c0972afd6c2120a6e2b353a5ab83ecfde366f4c896032c4fb565d
SSDEEP

1536:vc7pGtGa6mkozmmuUQj66LO9esIXq9eFHUAf9HeIMTWmg9Ppki6EPAyVF:vcsEak0r6LO9caMFHt1BWg9RkkBz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9179961fdb167533625c4032d6498050.exe

Files

NEAS.9179961fdb167533625c4032d6498050.exe
.dll windows:6 windows x64

0d835f2732c06566e75c5777ee645f60

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

factorygame-core

?DeltaTime@FApp@@0NA
?GIgnoreDebugger@@3_NA
?Exec_Dev@FExec@@MEAA_NPEAVUWorld@@PEB_WAEAVFOutputDevice@@@Z
?Exec_Editor@FExec@@MEAA_NPEAVUWorld@@PEB_WAEAVFOutputDevice@@@Z
?Init@FRunnable@@UEAA_NXZ
?Stop@FRunnable@@UEAAXXZ
?Exit@FRunnable@@UEAAXXZ
?Free@FMemory@@SAXPEAX@Z
?IsRelative@FPaths@@SA_NAEBVFString@@@Z
?ProjectSavedDir@FPaths@@SAAEBVFString@@XZ
??1FAutoConsoleVariableRef@@UEAA@XZ
??0FAutoConsoleVariableRef@@QEAA@PEB_WAEAH0I@Z
?BasicLog@Private@Logging@UE@@YAXAEBUFLogCategoryBase@@PEBUFStaticBasicLogRecord@123@ZZ
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
??1FString@@QEAA@XZ
?ConcatFF@FString@@CA?AV1@AEBV1@0@Z
??4FString@@QEAAAEAV0@PEB_W@Z
??0FString@@QEAA@PEB_W@Z
??4FString@@QEAAAEAV0@AEBV0@@Z
??4FString@@QEAAAEAV0@$$QEAV0@@Z
??0FString@@QEAA@AEBV0@@Z
??0FString@@QEAA@XZ
?OnInvalidArrayNum@UE4Array_Private@@YAXPEB_W_K@Z
?QuantizeSize@FMemory@@SA_K_KI@Z
?Realloc@FMemory@@SAPEAXPEAX_KI@Z
?Malloc@FMemory@@SAPEAX_KI@Z
?OptionallyLogFormattedEnsureMessageReturningFalseImpl@FDebug@@CA_N_NPEBD1HPEAXPEB_WZZ
?CheckVerifyFailedImpl@FDebug@@SAXPEBD0HPEAXPEB_WZZ
?PromptForRemoteDebugging@FWindowsPlatformMisc@@SAX_N@Z
?IsDebuggerPresent@FWindowsPlatformMisc@@SA_NXZ
?IsEnsureAllowed@FGenericPlatformMisc@@SA_NXZ
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPath@Private@CoreUObject@UE@@EA
?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
??1FLogCategoryBase@@QEAA@XZ
??0FLogCategoryBase@@QEAA@AEBVFName@@W4Type@ELogVerbosity@@1@Z
??0FName@@QEAA@PEBDW4EFindName@@@Z
??0FName@@QEAA@PEB_WW4EFindName@@@Z
?ConvertRelativePathToFull@FPaths@@SA?AVFString@@AEBV2@@Z

factorygame-coreuobject

?GetReferencerPropertyName@FGCObject@@UEBA_NPEAVUObject@@AEAVFString@@@Z

factorygame-engine

?GetSoundAssetCompressionType@USoundWave@@QEBA?AW4ESoundAssetCompressionType@@XZ
?CreateSoundAssetDecoder@Audio@@YAPEAVICompressedAudioInfo@@AEBVFName@@@Z
?LoadVorbisLibraries@@YAXXZ
?LogAudio@@3UFLogCategoryLogAudio@@A
?Precache@FAudioDevice@@UEAAXPEAVUSoundWave@@_N11@Z
?StopAllSounds@FAudioDevice@@UEAAX_N@Z
??0FVorbisAudioInfo@@QEAA@XZ

factorygame-binkaudiodecoder

??0FBinkAudioInfo@@QEAA@XZ

factorygame-audiomixercore

?Run@IAudioMixerPlatformInterface@Audio@@UEAAIXZ
?GetIndexForDevice@IAudioMixerPlatformInterface@Audio@@UEAAHAEBVFString@@@Z
?RegisterDeviceChangedListener@IAudioMixerDeviceChangedListener@Audio@@UEAAXXZ
?UnregisterDeviceChangedListener@IAudioMixerDeviceChangedListener@Audio@@UEAAXXZ
?OnDefaultCaptureDeviceChanged@IAudioMixerDeviceChangedListener@Audio@@UEAAXW4EAudioDeviceRole@2@AEBVFString@@@Z
?OnDefaultRenderDeviceChanged@IAudioMixerDeviceChangedListener@Audio@@UEAAXW4EAudioDeviceRole@2@AEBVFString@@@Z
?OnDeviceAdded@IAudioMixerDeviceChangedListener@Audio@@UEAAXAEBVFString@@_N@Z
?OnDeviceRemoved@IAudioMixerDeviceChangedListener@Audio@@UEAAXAEBVFString@@_N@Z
?OnDeviceStateChanged@IAudioMixerDeviceChangedListener@Audio@@UEAAXAEBVFString@@W4EAudioDeviceState@2@_N@Z
?OnFormatChanged@IAudioMixerDeviceChangedListener@Audio@@UEAAXAEBVFString@@AEBUFFormatChangedData@12@@Z
?OnSessionDisconnect@IAudioMixerDeviceChangedListener@Audio@@UEAAXW4EDisconnectReason@12@@Z
?GetDeviceId@IAudioMixerDeviceChangedListener@Audio@@UEBA?AVFString@@XZ
?BeginGeneratingAudio@IAudioMixerPlatformInterface@Audio@@IEAAXXZ
?ReadNextBuffer@IAudioMixerPlatformInterface@Audio@@QEAAXXZ
??0IAudioMixerPlatformInterface@Audio@@QEAA@XZ
??1IAudioMixerPlatformInterface@Audio@@UEAA@XZ
?GetNumSamples@FOutputBuffer@Audio@@QEBAHXZ
?PopBufferData@FOutputBuffer@Audio@@QEBA?AV?$TArrayView@$$CBEH@@AEAH@Z
?MixNextBuffer@FOutputBuffer@Audio@@QEAA_NXZ
?GetPlatformSettings@FAudioPlatformSettings@@SA?AU1@PEB_W@Z
?Tick@IAudioMixerPlatformInterface@Audio@@UEAAXXZ

factorygame-signalprocessing

??0FAudioFileWriter@Audio@@QEAA@AEBVFString@@AEBUFSoundQualityInfo@@@Z
??1FAudioFileWriter@Audio@@QEAA@XZ
?PushAudio@FAudioFileWriter@Audio@@QEAA_NPEBMH_N@Z
??0FPatchInput@Audio@@QEAA@XZ

factorygame-audiomixer

?GetMagnitudesForFrequencies@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@AEBV?$TArray@MV?$TSizedDefaultAllocator@$0CA@@@@@AEAV4@@Z
?StartAudioBus@FMixerDevice@Audio@@UEAAXIH_N@Z
?StopAudioBus@FMixerDevice@Audio@@UEAAXI@Z
?IsAudioBusActive@FMixerDevice@Audio@@UEBA_NI@Z
?AddPatchForAudioBus@FMixerDevice@Audio@@UEAA?AV?$TSharedPtr@UFPatchOutput@Audio@@$00@@IM@Z
?AddPatchForAudioBus_GameThread@FMixerDevice@Audio@@UEAA?AV?$TSharedPtr@UFPatchOutput@Audio@@$00@@IM@Z
?AddPatchInputForAudioBus@FMixerDevice@Audio@@UEAAXAEBVFPatchInput@2@IM@Z
?AddPatchInputForAudioBus_GameThread@FMixerDevice@Audio@@UEAAXAEBVFPatchInput@2@IM@Z
?InitSoundEffectPresets@FMixerDevice@Audio@@UEAAXXZ
?GetRuntimeFormat@FMixerDevice@Audio@@UEBA?AVFName@@PEBVUSoundWave@@@Z
?HasCompressedAudioInfoClass@FMixerDevice@Audio@@UEAA_NPEAVUSoundWave@@@Z
?SupportsRealtimeDecompression@FMixerDevice@Audio@@UEBA_NXZ
?DisablePCMAudioCaching@FMixerDevice@Audio@@UEBA_NXZ
?CreateCompressedAudioInfo@FMixerDevice@Audio@@UEBAPEAVICompressedAudioInfo@@AEBV?$TSharedPtr@VFSoundWaveProxy@@$00@@@Z
?CreateCompressedAudioInfo@FMixerDevice@Audio@@UEBAPEAVICompressedAudioInfo@@PEBVUSoundWave@@@Z
?ValidateAPICall@FMixerDevice@Audio@@UEAA_NPEB_WI@Z
?SuspendContext@FMixerDevice@Audio@@UEAAXXZ
?ResumeContext@FMixerDevice@Audio@@UEAAXXZ
?IsExernalBackgroundSoundActive@FMixerDevice@Audio@@UEAA_NXZ
?GetAudioTime@FMixerDevice@Audio@@UEBANXZ
?EnableDebugAudioOutput@FMixerDevice@Audio@@UEAAXXZ
?GetNumActiveSources@FMixerDevice@Audio@@UEBAHXZ
?IsNonRealtime@FMixerDevice@Audio@@UEBA_NXZ
?UpdateSourceEffectChain@FMixerDevice@Audio@@UEAAXIAEBV?$TArray@UFSourceEffectChainEntry@@V?$TSizedDefaultAllocator@$0CA@@@@@_N@Z
?GetCurrentSourceEffectChain@FMixerDevice@Audio@@UEAA_NIAEAV?$TArray@UFSourceEffectChainEntry@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?UpdateSubmixProperties@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmixBase@@@Z
?StartRecording@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@M@Z
?StopRecording@FMixerDevice@Audio@@UEAAAEAV?$TArray@MV?$TAlignedHeapAllocator@$0BA@@@@@PEAVUSoundSubmix@@AEAM1@Z
?StartEnvelopeFollowing@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@@Z
?StopEnvelopeFollowing@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@@Z
?SetSubmixWetDryLevel@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@MMM@Z
?SetSubmixAutoDisable@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@_N@Z
?SetSubmixAutoDisableTime@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@M@Z
?UpdateSubmixModulationSettings@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@AEBV?$TSet@U?$TObjectPtr@VUSoundModulatorBase@@@@U?$DefaultKeyFuncs@U?$TObjectPtr@VUSoundModulatorBase@@@@$0A@@@VFDefaultSetAllocator@@@@11@Z
?SetSubmixModulationBaseLevels@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@MMM@Z
?SetSubmixOutputVolume@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@M@Z
?SetSubmixWetLevel@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@M@Z
?SetSubmixDryLevel@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@M@Z
?SetSubmixEffectChainOverride@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@AEBV?$TArray@V?$TSharedPtr@VFSoundEffectSubmix@@$00@@V?$TSizedDefaultAllocator@$0CA@@@@@M@Z
?ClearSubmixEffectChainOverride@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@M@Z
?Exec@FMixerDevice@Audio@@UEAA_NPEAVUWorld@@PEB_WAEAVFOutputDevice@@@Z
?GetAudioDeviceList@FMixerDevice@Audio@@UEBAXAEAV?$TArray@VFString@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?UpdateGameThread@FMixerDevice@Audio@@UEAAXXZ
?CountBytes@FMixerDevice@Audio@@UEAAXAEAVFArchive@@@Z
?FadeOut@FMixerDevice@Audio@@UEAAXXZ
?FadeIn@FMixerDevice@Audio@@UEAAXXZ
?FlushExtended@FMixerDevice@Audio@@UEAAXPEAVUWorld@@_N@Z
?FlushAudioRenderingCommands@FMixerDevice@Audio@@UEAAX_N@Z
?InitDefaultAudioBuses@FMixerDevice@Audio@@UEAAXXZ
?ShutdownDefaultAudioBuses@FMixerDevice@Audio@@UEAAXXZ
?AddEnvelopeFollowerDelegate@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@AEBVFOnSubmixEnvelopeBP@@@Z
?StartSpectrumAnalysis@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@AEBUFSoundSpectrumAnalyzerSettings@@@Z
?StopSpectrumAnalysis@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@@Z
?GetPhasesForFrequencies@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@AEBV?$TArray@MV?$TSizedDefaultAllocator@$0CA@@@@@AEAV4@@Z
?AddSpectralAnalysisDelegate@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@AEBUFSoundSpectrumAnalyzerDelegateSettings@@AEBVFOnSubmixSpectralAnalysisBP@@@Z
?RemoveSpectralAnalysisDelegate@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@AEBVFOnSubmixSpectralAnalysisBP@@@Z
?OnListenerUpdated@FMixerDevice@Audio@@MEAAXAEBV?$TArray@UFListener@@V?$TSizedDefaultAllocator@$0CA@@@@@@Z
?GetPlatformSettings@FMixerDevice@Audio@@UEBA?AUFAudioPlatformSettings@@XZ
?InitializeHardware@FMixerDevice@Audio@@UEAA_NXZ
?TeardownHardware@FMixerDevice@Audio@@UEAAXXZ
?UpdateHardwareTiming@FMixerDevice@Audio@@UEAAXXZ
?UpdateHardware@FMixerDevice@Audio@@UEAAXXZ
?CreateEffectsManager@FMixerDevice@Audio@@UEAAPEAVFAudioEffectsManager@@XZ
?CreateSoundSource@FMixerDevice@Audio@@UEAAPEAVFSoundSource@@XZ
?UpdateDeviceDeltaTime@FMixerDevice@Audio@@UEAAXXZ
?PauseRecording@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@@Z
?ResumeRecording@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmix@@@Z
?AddReferencedObjects@FMixerDevice@Audio@@UEAAXAEAVFReferenceCollector@@@Z
?GetReferencerName@FMixerDevice@Audio@@UEBA?AVFString@@XZ
??1FMixerDevice@Audio@@UEAA@XZ
?AddPatchForSubmix@FMixerDevice@Audio@@UEAA?AV?$TSharedPtr@UFPatchOutput@Audio@@$00@@IM@Z
??0FMixerDevice@Audio@@QEAA@PEAVIAudioMixerPlatformInterface@1@@Z
?UnregisterSubmixBufferListener@FMixerDevice@Audio@@UEAAXPEAVISubmixBufferListener@@PEAVUSoundSubmix@@@Z
?RegisterSubmixBufferListener@FMixerDevice@Audio@@UEAAXPEAVISubmixBufferListener@@PEAVUSoundSubmix@@@Z
?InitSoundSubmixes@FMixerDevice@Audio@@MEAAXXZ
?RegisterSoundSubmix@FMixerDevice@Audio@@UEAAXPEAVUSoundSubmixBase@@_N@Z
?UnregisterSoundSubmix@FMixerDevice@Audio@@UEAAXPEBVUSoundSubmixBase@@@Z

vcruntime140

__current_exception
__current_exception_context
memset
__std_type_info_destroy_list
memcpy
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initterm_e
_initterm
_cexit
_initialize_onexit_table
_crt_at_quick_exit
_initialize_narrow_environment

kernel32

InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext

Exports

Exports

?RenderAudio@FMixerPlatformNonRealtime@Audio@@QEAAXN@Z
InitializeModule

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.uedbg
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d835f2732c06566e75c5777ee645f60

Headers

DLL Characteristics

File Characteristics

Imports

factorygame-core

factorygame-coreuobject

factorygame-engine

factorygame-binkaudiodecoder

factorygame-audiomixercore

factorygame-signalprocessing

factorygame-audiomixer

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 15KB - Virtual size: 15KB

.uedbg Size: 512B - Virtual size: 388B

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 512B - Virtual size: 720B

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 59KB - Virtual size: 58KB

.reloc Size: 512B - Virtual size: 464B

.text
Size: 15KB - Virtual size: 15KB

.uedbg
Size: 512B - Virtual size: 388B

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 512B - Virtual size: 720B

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 59KB - Virtual size: 58KB

.reloc
Size: 512B - Virtual size: 464B