NEAS[.]ab62e0ba3b3c89e89c7bf2edd20194f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ab62e0ba3b3c89e89c7bf2edd20194f0.exe
Size

436KB
MD5

ab62e0ba3b3c89e89c7bf2edd20194f0
SHA1

061b2fa2493ef3fb480b0c073b9ee100a368047d
SHA256

78dc1fb12f906c966ca0ee0944e16729d534f67a358cce1f7744ae808ff36b5c
SHA512

739b11fcbf641df41e4833d823c2760910fd706c0492eceb9f1d50623de69576b3343cae0ac231c56462df3a15cd52b15875f12aa1e3d05d456e2437f2476eea
SSDEEP

12288:wJDSkxplirG5pvxpW/7RDO3ed+KJeV+KdFe0I:wJDSkxGREVhFe0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ab62e0ba3b3c89e89c7bf2edd20194f0.exe

Files

NEAS.ab62e0ba3b3c89e89c7bf2edd20194f0.exe
.dll windows:4 windows x86

dd4fe326f4a61301b42f731a70a6effe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

CoCreateGuid
CoGetMalloc
StringFromGUID2
IIDFromString

msvcr80

__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
_stricmp
_wassert
strlen
_vsnprintf
wcsncmp
wcscmp
memmove
_memicmp
_wcsicmp
towupper
malloc
free
towlower
_wcsnicmp
iswalnum
iswcntrl
iswdigit
iswpunct
iswspace
memset
memcpy
wcslen

advapi32

RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCloseKey

kernel32

InterlockedExchange
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
VirtualProtect
RaiseException
Sleep
GetModuleHandleW
LocalAlloc
LoadLibraryExW
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryW
GetSystemDirectoryW
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
CompareStringA
CompareStringW
lstrcmpiA
GetLocaleInfoA
MultiByteToWideChar
GetLastError
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetUserDefaultLCID
GetVersionExA
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection

oleaut32

SafeArrayCreate
SafeArrayPutElement
SysStringLen
LoadRegTypeLi
CreateStdDispatch
SysAllocString
VariantClear
VariantInit
SysStringByteLen
SysReAllocStringLen
SysFreeString
VariantCopy
VariantChangeType
SysAllocStringLen
SysAllocStringByteLen
VarBstrFromCy
VarBstrFromR8
VarBstrFromR4
VarBstrFromI4
VarBstrFromI2
VarBstrFromDec
VarDateFromStr
VarCyFromStr
VarR8FromStr
VarR4FromStr
VarI4FromStr
VarI2FromStr
VarDecFromStr
VarBstrFromDate
LHashValOfNameSys
SafeArrayUnaccessData
SafeArrayGetElemsize
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayDestroy

user32

IsCharAlphaW
IsCharAlphaA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd4fe326f4a61301b42f731a70a6effe

Headers

DLL Characteristics

File Characteristics

Imports

ole32

msvcr80

advapi32

kernel32

oleaut32

user32

version

Exports

Exports

Sections

.text Size: 152KB - Virtual size: 151KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 264KB - Virtual size: 264KB

.text
Size: 152KB - Virtual size: 151KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 264KB - Virtual size: 264KB