NEAS[.]cf935e63fefcb28a55c1743514d10ff0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.cf935e63fefcb28a55c1743514d10ff0.exe
Size

1.3MB
MD5

cf935e63fefcb28a55c1743514d10ff0
SHA1

fb255bf226b9e4e445bfd8e23b204bc8b37dd927
SHA256

abde3f6f6d312f3375e90e8d2cb43366e30ff4c14be514582ced89bcc950d62b
SHA512

e5d242ed4ee40fe5e98382a1b1c12e780fd2d61eeae72489b5fb945f83b0715071976ecbfc4220cd06d8edab7e0fd2f8679c2c30c384e0aecf655fa612ff04a6
SSDEEP

12288:7kysXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wyssqjnhMgeiCl7G0nehbGZpbD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cf935e63fefcb28a55c1743514d10ff0.exe

Files

NEAS.cf935e63fefcb28a55c1743514d10ff0.exe
.exe windows:6 windows x64

364ce282a93e03a146321d365523e1d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCommandLineW
TlsGetValue
UnregisterWait
TlsFree
TlsAlloc
LocalAlloc
ExpandEnvironmentStringsW
SetFileAttributesW
LocalFree
DeleteFileW
DeleteCriticalSection
FindNextFileW
IsDebuggerPresent
LockResource
FindClose
GetModuleFileNameW
GetExitCodeProcess
FormatMessageW
GetCurrentThread
CreateDirectoryW
LoadLibraryExW
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
GetThreadContext
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetFullPathNameW
FreeLibrary
SetEvent
WaitForSingleObjectEx
OutputDebugStringW
QueryFullProcessImageNameW
CreateEventA
CreateFileW
GetLastError
GetProcAddress
ResetEvent
GetLocalTime
LoadLibraryA
QueueUserWorkItem
CloseHandle
DebugBreak
GetSystemWindowsDirectoryA

ole32

CoCreateInstance
StringFromGUID2
CoGetObjectContext
CoInitializeEx
CoUninitialize

msvcrt

__CxxFrameHandler3
??1type_info@@UEAA@XZ
_wfopen
memcpy
_CxxThrowException
memset
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_purecall
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
free
_callnewh
malloc
wcschr
_wstrdate
_waccess
_wstrtime
_wcsicmp
_vsnwprintf
fwprintf
fflush
fopen
fprintf
fclose
wcsrchr
_local_unwind

msdtctm

ord4

ntdll

RtlReportException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

version

VerQueryValueW

user32

GetWindowRect
GetThreadDesktop
CloseWindowStation
DialogBoxParamW
GetProcessWindowStation
OpenDesktopW
GetClientRect
SetProcessWindowStation
EndDialog
GetDesktopWindow
SetWindowPos
SetThreadDesktop
SetDlgItemTextW
OpenWindowStationW
MapWindowPoints
LoadStringW
CloseDesktop

advapi32

RegOpenKeyExW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExA
DeregisterEventSource
RegQueryValueExW
RegQueryValueExA

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

364ce282a93e03a146321d365523e1d1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

msvcrt

msdtctm

ntdll

version

user32

advapi32

Sections

.text Size: 39KB - Virtual size: 38KB

.data Size: 1KB - Virtual size: 10KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 94KB - Virtual size: 94KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 39KB - Virtual size: 38KB

.data
Size: 1KB - Virtual size: 10KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 94KB - Virtual size: 94KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB