NEAS[.]be979546945f997ba7bd3b24bdba0350[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.be979546945f997ba7bd3b24bdba0350.exe
Size

289KB
MD5

be979546945f997ba7bd3b24bdba0350
SHA1

17332978250c6e9a6407889376a5ce3eb0304dd1
SHA256

a9f47fd7c7e96980b8554d898bf17ae30255d86f6b496f4fa0a350d178e94b6b
SHA512

09f73a3dd7507ebbfb537f16ff140a4dfb088ffa32b7a1a72cb024f87c682b731ef09a6b5af285bcb0c3c892ad330d3cf95394f53043c994eadcc55bc7121b6c
SSDEEP

6144:GXotp5xJnn5qtAyope/67HI8J34gzs6HCk8NlD4D/foa:jTppvsk34ghCk8L4L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.be979546945f997ba7bd3b24bdba0350.exe

Files

NEAS.be979546945f997ba7bd3b24bdba0350.exe
.dll windows:6 windows x86

a0a6d4dc6f940e6087d4b3ebbc40532c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr100

memcmp
__CxxFrameHandler3
_vsnwprintf_s
_snwprintf_s
ceil
malloc
free
rand
memset
wcsncpy_s
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common

kernel32

RaiseException
LocalAlloc
GetProcAddress
FreeLibrary
LoadLibraryA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DeleteFileW
GetFileAttributesExW
GetLastError
MoveFileExW
DisableThreadLibraryCalls
QueryPerformanceCounter
GetProcessHeap
HeapSetInformation
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
VirtualProtect
WerRegisterMemoryBlock
EncodePointer
DecodePointer

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateMetafileFromEmf
GdipDrawImageRectRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipCreateBitmapFromHBITMAP
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageBounds
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipDisposeImage
GdipGetMatrixElements
GdipRotateMatrix
GdipScaleMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipSetMatrixElements
GdipDeleteMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipAddPathRectangle
GdipGetPathFillMode
GdipGetPathPoints
GdipGetPathTypes
GdipGetPointCount
GdipDeletePath
GdipCreatePath
GdipGetImageWidth

gdi32

GetGlyphIndicesW
SetTextAlign
SelectObject
GetCharWidthI
CreateCompatibleBitmap
GetTextAlign
GetOutlineTextMetricsA
DeleteObject

mso

ord1747
ord469
ord3834
ord6049
ord1905
ord3425
ord6664
ord25
ord5362
ord8007
ord7488
ord5467
ord7612
ord6125
ord5541
ord1932
ord5885
ord7285
ord4602
ord3278
ord2622
ord4454
ord151
ord6176
ord9608
ord3946
ord1485
ord2634
ord3520
ord9462
ord7908
ord6652
ord1594
ord2609
ord7714
ord6930
ord491
ord6705
ord2125
ord2878
ord6137
ord8879

Exports

Exports

HrGetDocExDocument

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 235KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0a6d4dc6f940e6087d4b3ebbc40532c

Headers

DLL Characteristics

File Characteristics

Imports

msvcr100

kernel32

gdiplus

gdi32

mso

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 50KB

.data Size: 512B - Virtual size: 888B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 235KB - Virtual size: 236KB

.text
Size: 50KB - Virtual size: 50KB

.data
Size: 512B - Virtual size: 888B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 235KB - Virtual size: 236KB