NEAS[.]c647c3823c62a262f3cb5522a517d170[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.c647c3823c62a262f3cb5522a517d170.exe
Size

870KB
MD5

c647c3823c62a262f3cb5522a517d170
SHA1

ca04241e202c7e0790f3affc7db698876b7794da
SHA256

21aa2a027ac4d3d4dfc2357a2c7309e7cc896ad92821f31ee0eeb5fabffc0c86
SHA512

365b17a460ca06e50d89f46c536db0594794c80b0d8474ded885429346085cf1e48ff42d55f49c0c41d4de9ecb9aaad65e84cea5822733360935288da17de112
SSDEEP

24576:7nWPwnzJKbO8jVgO/KekufVCr88XhN5dRMS4ih37:7n8wVKK8jVgsvVdeTz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c647c3823c62a262f3cb5522a517d170.exe

Files

NEAS.c647c3823c62a262f3cb5522a517d170.exe
.dll windows:4 windows x86

d5be9b382768101abc9fa5a606ffeca7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
WriteFile
VirtualQuery
GetCurrentThreadId
GetModuleHandleA
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
OutputDebugStringA
RaiseException
GetWindowsDirectoryA
GetPrivateProfileStringA
CreateDirectoryA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleHandleW
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
GetProcAddress
GetEnvironmentVariableA
SetEnvironmentVariableA
LoadLibraryExA
LoadLibraryA
FreeLibrary
CreateFileA
GetLastError
FormatMessageA
LocalFree
SetFilePointer
ReadFile
CloseHandle
GlobalAlloc
CopyFileA
DeleteFileA
GetTempFileNameA
GetModuleFileNameA
GlobalLock
GlobalFree
GlobalUnlock
GetTempPathA
IsDebuggerPresent

user32

IntersectRect
SubtractRect

psom

ord101
ord111
ord109
ord112
ord102
ord110
ord105
ord108
ord201
ord200
ord100
ord113

ximage3b

ord401
ord107
ord402
ord609
ord606
ord501
ord503
ord742
ord744
ord730
ord718
ord601
ord608
ord605
ord800
ord101
ord102
ord103
ord104
ord105
ord100
ord505
ord604
ord607
ord602
ord600
ord508
ord745
ord108
ord724
ord304
ord300
ord801
ord302
ord305
ord523
ord512
ord513
ord511
ord510
ord517
ord514
ord521
ord713
ord731
ord732
ord743
ord500
ord506
ord509
ord303
ord715
ord714
ord200
ord717
ord741
ord705
ord704
ord700
ord716
ord707
ord709
ord701
ord733
ord703
ord502
ord507
ord400
ord740
ord719
ord739
ord720
ord721
ord722
ord106
ord737
ord723
ord725
ord301
ord727
ord734
ord735
ord726

gdi32

GetDeviceCaps
DeleteObject
SetDIBits
CreateCompatibleBitmap
RestoreDC
RealizePalette
SelectPalette
CreatePalette
SetMapMode
SaveDC
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
GetMapMode
SetBkColor
SetBkMode
CreateBitmap
DPtoLP
GetObjectA
SetDIBitsToDevice

oleaut32

SysAllocString
SysFreeString

msvcp80

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?_Xran@_String_base@std@@SAXXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

msvcr80

clock
free
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__clean_type_info_names_internal
_crt_debugger_hook
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_itoa_s
__RTtypeid
??8type_info@@QBE_NABV0@@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
strncmp
fseek
ftell
isspace
fprintf
_fileno
_filelength
fread
fflush
fwrite
fgets
atoi
_mbsicmp
_mbscmp
_mbstok
??0exception@std@@QAE@ABQBD@Z
_findfirst64i32
_findnext64i32
_findclose
strtok
_stricmp
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_splitpath_s
__RTDynamicCast
fopen
fclose
strchr
wcscpy_s
memcpy
strtoul
memmove
strcpy_s
sprintf_s
strcat_s
memmove_s
??2@YAPAXI@Z
_invalid_parameter_noinfo
memset
remove
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??_V@YAXPAX@Z
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
malloc

Exports

Exports

XP_AnalyzePage
XP_AnalyzeSegments
XP_CanTwoPassScan
XP_CloseFile
XP_ConvertAndOutputText
XP_ConvertToBiLevelPage
XP_CreateAutoScanThumbnailPage
XP_CreatePageFromDIB
XP_DeInitializeScanSource
XP_DeletePage
XP_DumpMemory
XP_EndInstance
XP_EndOcrDocument
XP_FileAppendPage
XP_FileGetPageInfo
XP_FileGetSegmentInfo
XP_FileReadBiPage
XP_FileReadPage
XP_FileSpigotToPage
XP_FlushPage
XP_FreeLangSetInfo
XP_FreeLanguageInfo
XP_GetDefaultScanner
XP_GetEachScannerDriverName
XP_GetFileInfo
XP_GetLangSets
XP_GetLangsInSet
XP_GetPageDIB
XP_GetPageHandle
XP_GetPageInfo
XP_GetPageType
XP_GetScannerBounds
XP_GetScannerChoiceCount
XP_GetScannerChoiceString
XP_GetScannerChoiceStringEx
XP_GetScannerInfo
XP_GetScannerInfoEx
XP_GetSegmentInfo
XP_InitInstance
XP_InitializeScanSource
XP_IsIndicatorSuppressed
XP_IsSheetWaiting
XP_IsSourceUISuppressed
XP_OpenFile
XP_ParseSSDoc
XP_ParseXDoc
XP_ProcessPage
XP_ProcessScannerMessage
XP_Recognize
XP_Register
XP_ResetLanguageInfo
XP_ScanToPage
XP_ScanToPageEx
XP_SetDefaultLanguages
XP_SetLanguageSet
XP_SetOcrOperatingParameter
XP_SetProgressFunc
XP_SetScanRefresh
XP_SetScanStrings
XP_ShowSourceUI
XP_StartOcrDocument
XP_SuggestSaveName

Sections

.text
Size: 478KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 381KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5be9b382768101abc9fa5a606ffeca7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

psom

ximage3b

gdi32

oleaut32

msvcp80

msvcr80

Exports

Exports

Sections

.text Size: 478KB - Virtual size: 478KB

.data Size: 7KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 381KB - Virtual size: 384KB

.text
Size: 478KB - Virtual size: 478KB

.data
Size: 7KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 381KB - Virtual size: 384KB