NEAS[.]98a733f82cbc41f2756bc10f486e9550[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.98a733f82cbc41f2756bc10f486e9550.exe
Size

416KB
MD5

98a733f82cbc41f2756bc10f486e9550
SHA1

b534be5804feaa560ff632bdf6fc50d0ea238483
SHA256

cf525fc47d0240b01ca071fd1ac1513950b7ca85ce700ee2cc021314b1a10e44
SHA512

80b5cbe5116e4a587833bc38c29a19e847cb15c27e08df4d84f079938533e5c84163236648990ff06bef5d732b2ab423a3bff9d4de9277bfab8cf71bcfc360f3
SSDEEP

6144:AdLK/qQOFwlu7B+d089axXKbdoLOfrWrj0wLqZ8zaa1Ez6CJMb44iaNlj0LRp:AdLXWlzL9axXKbd0qZWaeQPaNljsR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.98a733f82cbc41f2756bc10f486e9550.exe

Files

NEAS.98a733f82cbc41f2756bc10f486e9550.exe
.dll windows:4 windows x86

dd4fe326f4a61301b42f731a70a6effe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

CoCreateGuid
CoGetMalloc
StringFromGUID2
IIDFromString

msvcr80

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
_stricmp
_wassert
strlen
_vsnprintf
wcsncmp
wcscmp
memmove
_memicmp
_wcsicmp
towupper
malloc
free
towlower
_wcsnicmp
iswalnum
iswcntrl
iswdigit
iswpunct
iswspace
memset
memcpy
wcslen

advapi32

RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey

kernel32

InterlockedExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
RaiseException
Sleep
GetModuleHandleW
LocalAlloc
LoadLibraryExW
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryW
GetSystemDirectoryW
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
CompareStringA
CompareStringW
lstrcmpiA
GetLocaleInfoA
MultiByteToWideChar
GetLastError
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetUserDefaultLCID
GetVersionExA
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection

oleaut32

SafeArrayCreate
SafeArrayPutElement
SysStringLen
LoadRegTypeLi
CreateStdDispatch
SysAllocString
VariantClear
VariantInit
SysStringByteLen
SysReAllocStringLen
SysFreeString
VariantCopy
VariantChangeType
SysAllocStringLen
SysAllocStringByteLen
VarBstrFromCy
VarBstrFromR8
VarBstrFromR4
VarBstrFromI4
VarBstrFromI2
VarBstrFromDec
VarDateFromStr
VarCyFromStr
VarR8FromStr
VarR4FromStr
VarI4FromStr
VarI2FromStr
VarDecFromStr
VarBstrFromDate
LHashValOfNameSys
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayDestroy

user32

IsCharAlphaW
IsCharAlphaA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd4fe326f4a61301b42f731a70a6effe

Headers

DLL Characteristics

File Characteristics

Imports

ole32

msvcr80

advapi32

kernel32

oleaut32

user32

version

Exports

Exports

Sections

.text Size: 152KB - Virtual size: 151KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 244KB - Virtual size: 244KB

.text
Size: 152KB - Virtual size: 151KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 244KB - Virtual size: 244KB