NEAS[.]b114165f6a8cd3914ad4c9aaa3d222d0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b114165f6a8cd3914ad4c9aaa3d222d0.exe
Size

51KB
MD5

b114165f6a8cd3914ad4c9aaa3d222d0
SHA1

85bb854d3fada52521860129ebbc456c8da36e62
SHA256

2f58bb797d1e0ecb92e188c783fda716e72e05403ab43bf6a081b568816b5283
SHA512

afd84100debbe0b75696ea5582f6ae4c8c1f842d5283dff25d29dc1e5ac953468654f2c3523b4e27ef4dd14460f205b4b7cd5dbc20d351fb8e473386c82f9cfa
SSDEEP

768:15EDbAn8Wo45S0TCF1qygoX9Z9tCKNb8pwjNzi9Xr+IE6H7LYYgIwTzAFHT9+qSJ:2bAnl+F1qgtCKj+9XrzHvYXsP3SG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b114165f6a8cd3914ad4c9aaa3d222d0.exe

Files

NEAS.b114165f6a8cd3914ad4c9aaa3d222d0.exe
.dll windows:5 windows x86

ffa0a6c54f1078cbc7197222eecfb61c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

iphlpapi

GetTcpTable
SetTcpEntry

psapi

EnumProcessModules
GetModuleFileNameExA

ws2_32

gethostbyname
WSAStartup
closesocket
gethostname
inet_ntoa
send
recv
htons
inet_addr
accept
listen
bind
setsockopt
socket
connect
WSAIoctl
WSACleanup
select

advapi32

RegisterServiceCtrlHandlerA
OpenServiceA
QueryServiceStatus
StartServiceA
ControlService
DeleteService
ChangeServiceConfigA
QueryServiceConfigA
OpenSCManagerA
EnumServicesStatusA
CloseServiceHandle
SetServiceStatus
OpenEventLogA
ClearEventLogA
CloseEventLog
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey

kernel32

GetSystemDefaultLangID
GetTickCount
GlobalMemoryStatus
MultiByteToWideChar
GlobalFree
GetDriveTypeA
DeleteFileA
GetDiskFreeSpaceExA
CreateThread
TerminateThread
WaitForMultipleObjects
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DisconnectNamedPipe
WaitForSingleObject
PeekNamedPipe
CloseHandle
GetLastError
GetCurrentProcess
HeapFree
HeapAlloc
GetProcessHeap
GetVersionExA
FileTimeToSystemTime
FileTimeToLocalFileTime
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
OpenProcess
CreateProcessA
GetSystemDirectoryA
GetStartupInfoA
CreatePipe
Sleep
FindClose
WriteFile
FindFirstFileA
ReadFile
VirtualAlloc
GetFileSize
CreateFileA
GetModuleFileNameA
ExitThread
GetSystemTime
GetTempPathA
WinExec
SetFileTime
GetFileTime
GetEnvironmentVariableW
FreeLibrary
GetProcAddress
LoadLibraryA
GetComputerNameA
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
Module32Next
Module32First

user32

ExitWindowsEx

gdi32

GetDeviceCaps
CreateDCA
DeleteDC

urlmon

URLDownloadToFileA

netapi32

NetUserDel
NetApiBufferFree
NetUserEnum

msvcr100

strchr
_wcsicmp
_strnicmp
_crt_debugger_hook
_except_handler4_common
wcstombs
_snprintf
fopen
fprintf
fclose
strncmp
strncpy
malloc
free
_strupr
atoi
memcpy
memset
strncat
sprintf
printf
strstr
_stricmp

Exports

Exports

Install
InstallService
Remove
RemoveService
ServiceMain
SetNew
SetNewString

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ffa0a6c54f1078cbc7197222eecfb61c

Headers

DLL Characteristics

File Characteristics

Imports

iphlpapi

psapi

ws2_32

advapi32

kernel32

user32

gdi32

urlmon

netapi32

msvcr100

Exports

Exports

Sections

.text Size: 26KB - Virtual size: 26KB

.rdata Size: 14KB - Virtual size: 14KB

.data Size: 5KB - Virtual size: 16KB

.rsrc Size: 1024B - Virtual size: 696B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 26KB - Virtual size: 26KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 5KB - Virtual size: 16KB

.rsrc
Size: 1024B - Virtual size: 696B

.reloc
Size: 3KB - Virtual size: 3KB