NEAS[.]c5a8eb127381968de9971219f918c110[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c5a8eb127381968de9971219f918c110.exe
Size

1.0MB
MD5

c5a8eb127381968de9971219f918c110
SHA1

c4f729a5625945f76615177c7b32a71d9b89be79
SHA256

236cce76b6cd3d6839216ec8f602e5c5e812ea65c68bc2c614f2648eee2d477a
SHA512

db36ba1f2d605a12ad6ea83d571ea59df2a4a45e0ec548c61430e96cd1ed1cf33d5a1f954ff1f956776fddcd098ddd629bbe272711126f03a9f1fde7dcc50e02
SSDEEP

12288:VKqn6VnMmjZ1XqMu3DGa52Stmd/c53JgLXIbR1kQ4+Syz31Vaf2:c+6NMm7azBmdh7Il6gb1Af

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c5a8eb127381968de9971219f918c110.exe

Files

NEAS.c5a8eb127381968de9971219f918c110.exe
.exe windows:6 windows x86

8aab5f7dc3c83d4e7212782dc79e2563

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegEnumValueW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegSetValueExA
CredGetSessionTypes
CredWriteW
CredReadW
CredUnmarshalCredentialW
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
CredWriteDomainCredentialsW
CredReadDomainCredentialsW
GetUserNameA
CredDeleteW
CredFree

kernel32

GetUserDefaultUILanguage
GetSystemDefaultUILanguage
UnmapViewOfFile
GetLocaleInfoW
CreateFileMappingW
MapViewOfFile
FindResourceExW
RaiseException
GetTimeFormatW
GetDateFormatW
InitializeCriticalSection
DeleteCriticalSection
HeapSetInformation
Sleep
ExpandEnvironmentStringsW
CreateProcessW
VerSetConditionMask
VerifyVersionInfoW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
FindClose
GetTempPathW
SetFilePointer
GetACP
SetLastError
GetFullPathNameW
GetFileAttributesW
lstrcmpW
CompareStringW
LocalAlloc
LocalFree
GetCurrentDirectoryW
GetVersionExW
CreateDirectoryW
FormatMessageW
SearchPathW
GetStartupInfoA
DebugBreak
lstrlenW
GetLocalTime
TlsAlloc
TlsFree
LockResource
SystemTimeToFileTime
WriteFile
GetSystemDirectoryW
GetSystemTime
LoadLibraryA
ExpandEnvironmentStringsA
DeviceIoControl
HeapAlloc
GetProcessHeap
HeapFree
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
GetVersion
WideCharToMultiByte
InterlockedExchange
GetCurrentProcessId
GetCommandLineW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
SetEvent
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
CreateEventW
CreateThread
GetModuleFileNameW
lstrcmpiW
GetModuleHandleW
GetProcAddress
LoadLibraryW
WaitForSingleObject
GetCurrentProcess
TerminateProcess
GetVersionExA
InterlockedCompareExchange
DeleteFileW
CreateFileW
GetFileSize
ReadFile
LeaveCriticalSection
CloseHandle
GetLastError
EnterCriticalSection

gdi32

DeleteObject
SetRectRgn
GetDCOrgEx
GetClipBox
CombineRgn
EqualRgn
RealizePalette
SelectPalette
GetObjectW
GetStockObject
GetDeviceCaps
SelectObject
CreateCompatibleDC
UpdateColors
DeleteDC
BitBlt
CreateFontIndirectW
TranslateCharsetInfo
SetMapMode
SetBkMode
SetTextColor
StretchBlt
CreateCompatibleBitmap
GetDIBColorTable
CreatePalette
CreateRectRgnIndirect
CreateRectRgn

user32

SetDlgItemTextW
GetDlgItem
SetFocus
SendMessageW
GetMessageW
TranslateMessage
SetWindowTextW
DispatchMessageW
CharUpperW
PostThreadMessageW
CharNextW
LoadIconW
GetClassInfoExW
UnregisterClassW
SetRect
AdjustWindowRect
IsZoomed
LoadCursorW
SetCursor
AppendMenuW
OffsetRect
IntersectRect
SystemParametersInfoA
IsWindow
EnableWindow
ShowWindow
CopyRect
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
CreateWindowExW
RegisterClassExW
DefWindowProcW
SetForegroundWindow
DestroyWindow
IsChild
TranslateAcceleratorW
IsDialogMessageW
LoadAcceleratorsW
DialogBoxParamW
CreateDialogParamW
MessageBoxW
GetWindowLongW
SetWindowLongW
IsDlgButtonChecked
AllowSetForegroundWindow
KillTimer
CheckDlgButton
EndDialog
PostMessageW
SetTimer
PtInRect
IsRectEmpty
SystemParametersInfoW
GetClassInfoW
DefDlgProcW
RegisterClassW
MonitorFromWindow
GetMonitorInfoW
LoadStringW
UnregisterClassA
EqualRect
InsertMenuW
CreateMenu
ModifyMenuW
GetSystemMenu
SetWindowPos
GetClientRect
UpdateWindow
InvalidateRect
IsWindowVisible
SetWindowPlacement
LockWindowUpdate
MoveWindow
AdjustWindowRectEx
EnableMenuItem
PostQuitMessage
CharLowerW
FillRect
CheckRadioButton
GetCursorPos
GetWindowDC
DrawIconEx
GetFocus
MapDialogRect
ScreenToClient
GetWindow
DrawTextW
EnumDisplayMonitors
GetDesktopWindow
CreateDialogIndirectParamW
GetDlgItemTextW
MapWindowPoints
BeginPaint
DrawIcon
EndPaint
SendDlgItemMessageW
GetDC
ReleaseDC
DestroyIcon
GetMenu
LoadImageW
IsWindowEnabled
RedrawWindow
ShowWindowAsync

msvcrt

_errno
_wcslwr
iswdigit
_wtol
wcstok
calloc
wcschr
_wcsnicmp
__getmainargs
_cexit
_exit
wcsrchr
srand
time
iswspace
toupper
_wtoi
wcspbrk
towupper
towlower
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
memcpy
_vsnprintf
wcsncmp
wcsstr
memmove
_wcsicmp
_vsnwprintf
_purecall
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
bsearch
ungetc
_fileno
_read
__pioinfo
__set_app_type
wcstombs
iswctype
wctomb
localeconv
isxdigit
isleadbyte
__mb_cur_max
mbtowc
isdigit
??2@YAPAXI@Z
memset
??_U@YAPAXI@Z
free
malloc
??_V@YAXPAX@Z
??3@YAXPAX@Z
_controlfp
_CIpow
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
realloc
__badioinfo

ole32

CoRevokeClassObject
CLSIDFromString
StringFromGUID2
CoTaskMemFree
CoRegisterClassObject
CoUninitialize
CoInitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance

oleaut32

RegisterTypeLi
SysStringLen
SysFreeString
LoadTypeLi
UnRegisterTypeLi
VarUI4FromStr
SafeArrayGetVartype
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SysStringByteLen
VariantClear
SysAllocStringLen
SafeArrayCreate
VariantInit
SysAllocStringByteLen
SysAllocString

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ExtractIconW
ShellExecuteExW
SHAddToRecentDocs
SHGetDesktopFolder

comctl32

ImageList_ReplaceIcon
ImageList_LoadImageW
InitCommonControlsEx
ImageList_Create
ImageList_Destroy
ord17

comdlg32

GetFileTitleW
GetSaveFileNameW
GetOpenFileNameW

shlwapi

PathFindExtensionW
PathAppendW
PathFindFileNameW
SHStrDupW
PathStripPathW
PathRemoveFileSpecW

crypt32

CertGetCertificateContextProperty
CertFreeCertificateContext
CertFreeCertificateChain
CryptBinaryToStringW
CryptStringToBinaryW
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CryptMsgClose
CertOpenStore
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSignMessage
CertCloseStore
CryptVerifyDetachedMessageSignature
CryptUnprotectData
CryptProtectData
CryptDecodeObject
CertFindExtension
CertGetEnhancedKeyUsage
CertGetCertificateChain

credui

CredUIParseUserNameW
CredUIPromptForCredentialsW

secur32

LsaConnectUntrusted
GetUserNameExW
FreeContextBuffer
QuerySecurityPackageInfoW
LsaLookupAuthenticationPackage
LsaDeregisterLogonProcess

cryptui

CryptUIDlgViewCertificateW

ntdll

RtlInitString
NtOpenFile
RtlInitUnicodeString
RtlInitializeCriticalSection
RtlUnwind

cfgmgr32

CM_Get_Parent
CM_Get_Child
CM_Get_DevNode_Registry_PropertyW
CM_Get_Sibling

winhttp

WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSendRequest
WinHttpQueryOption
WinHttpCloseHandle

winmm

timeKillEvent
timeSetEvent
timeGetTime

netapi32

NetGetJoinInformation
NetApiBufferFree

Sections

.text
Size: 399KB - Virtual size: 399KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 593KB - Virtual size: 593KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8aab5f7dc3c83d4e7212782dc79e2563

Headers

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ole32

oleaut32

shell32

comctl32

comdlg32

shlwapi

crypt32

credui

secur32

cryptui

ntdll

cfgmgr32

winhttp

winmm

netapi32

Sections

.text Size: 399KB - Virtual size: 399KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 593KB - Virtual size: 593KB

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 399KB - Virtual size: 399KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 593KB - Virtual size: 593KB

.reloc
Size: 28KB - Virtual size: 27KB