NEAS[.]df470d222a7d887483ec80e4b7c934d0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.df470d222a7d887483ec80e4b7c934d0.exe
Size

334KB
MD5

df470d222a7d887483ec80e4b7c934d0
SHA1

c32068507ec104a65af3beef8970eddad9e37264
SHA256

105d1fb9933f9089e2295f63ec792f003aaee28ec19271f8506fa1d7592a383c
SHA512

87c1e4497f46e30fb6630f8ed20ca6f92b39064272af48dcf6a9e134b8167157dd7854a869586a7c8e37de9bd5f407ad739c5814605839f001a41b911e984846
SSDEEP

6144:DXTHUe/knCK82yRNqUjoRlW87gkUfYbh6k9jep0Abi4Mo0:DrUeeCKINqdy566k9epTMX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.df470d222a7d887483ec80e4b7c934d0.exe

Files

NEAS.df470d222a7d887483ec80e4b7c934d0.exe
.dll windows:6 windows x86

a54e2180093e4b5d643a442c8cfea6fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_isatty
_write
_lseeki64
_fileno
__pioinfo
__badioinfo
wctomb
_itoa
_snprintf
isleadbyte
_ismbblead
_amsg_exit
_initterm
free
malloc
_XcptFilter
_iob
_errno
tolower
isspace
getenv
atoi
_stricmp
_strnicmp
strstr
memcpy
memset
strchr
strncmp
_strcmpi

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
WaitForSingleObject
TerminateProcess
GetCurrentProcess
DuplicateHandle
GetPriorityClass
CreateProcessA
CreateThread
SetFilePointer
GetCurrentProcessId
CreateNamedPipeA
CreateFileA
CreateEventA
ReadFile
WriteFile
WaitForMultipleObjects
GetOverlappedResult
CloseHandle
GetCurrentDirectoryA
MultiByteToWideChar
WideCharToMultiByte
LocalFree
LocalReAlloc
LocalAlloc
RemoveDirectoryA
GetFileAttributesA
CreateDirectoryA
GetLastError
OutputDebugStringA
DebugBreak
SetEnvironmentVariableA
SetLastError
SetCurrentDirectoryA
GetEnvironmentVariableA
DeleteFileA
CopyFileA
GetPrivateProfileSectionA
GetModuleFileNameA

advapi32

RegCreateKeyA
RegSetValueA
RegCloseKey
RegQueryValueA

Exports

Exports

SrcSrvCleanup
SrcSrvEnumTokens
SrcSrvExecToken
SrcSrvExecTokenA
SrcSrvExecTokenW
SrcSrvGetFile
SrcSrvGetFileA
SrcSrvGetFileW
SrcSrvGetOptions
SrcSrvGetToken
SrcSrvGetTokenA
SrcSrvGetTokenW
SrcSrvInit
SrcSrvInitA
SrcSrvInitW
SrcSrvIsModuleLoaded
SrcSrvLoadModule
SrcSrvLoadModuleA
SrcSrvLoadModuleW
SrcSrvRegisterCallback
SrcSrvResolveTokenVar
SrcSrvResolveTokenVarA
SrcSrvResolveTokenVarW
SrcSrvSetOptions
SrcSrvSetParentWindow
SrcSrvSetTargetPath
SrcSrvSetTargetPathA
SrcSrvSetTargetPathW
SrcSrvUnloadModule

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 253KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a54e2180093e4b5d643a442c8cfea6fd

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

advapi32

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 42KB

.data Size: 30KB - Virtual size: 173KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 253KB - Virtual size: 256KB

.text
Size: 43KB - Virtual size: 42KB

.data
Size: 30KB - Virtual size: 173KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 253KB - Virtual size: 256KB