NEAS[.]d5504e62e207421d88de2e330e9fd430[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d5504e62e207421d88de2e330e9fd430.exe
Size

1.5MB
MD5

d5504e62e207421d88de2e330e9fd430
SHA1

9d497a644519b6bca0c1d1ffd236d8b39b199836
SHA256

80ba735d3208112220d4140eb96ccbba92c07421350814743098d17b9a7f32d4
SHA512

0ecef2e2eda18be8ce29ac2b0a82bf787756b4baeaef299f43f7d13016be4c60594c0d36930a0bee06afc0e5ce1912a31f7f2e8cd8868edde7d81283676f3820
SSDEEP

24576:k9D3TarV3PmOmXeI1cVSvHM9pIELC7QsD/vgLRcEd7:A3g4OfVsqpBLYQsj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d5504e62e207421d88de2e330e9fd430.exe

Files

NEAS.d5504e62e207421d88de2e330e9fd430.exe
.dll windows:6 windows x86

7fab449da81a525a6782861209da7e8e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetLastError
InterlockedIncrement
InterlockedDecrement
TlsGetValue
TlsSetValue
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CloseHandle
TryEnterCriticalSection
ResetEvent
GetCurrentProcess
GetCurrentThread
GetVersionExW
CreateTimerQueueTimer
DeleteTimerQueueTimer
DeleteTimerQueueEx
GetModuleFileNameW
LocalAlloc
LocalFree
GetTimeZoneInformation
MultiByteToWideChar
WideCharToMultiByte
GetThreadLocale
GetUserDefaultUILanguage
RaiseException
TlsAlloc
TlsFree
GetModuleHandleW
GetProcAddress
SetEvent
CreateEventW
lstrcmpiW
lstrlenW
SetLastError
GetCurrentThreadId
FlushInstructionCache
CreateTimerQueue
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
lstrcmpW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
DecodePointer
InterlockedCompareExchange
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
GetCommandLineA
EncodePointer
RtlUnwind
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
TerminateProcess
Sleep
IsDebuggerPresent
WriteFile
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
GetTimeFormatEx
GetDateFormatEx
CompareStringEx
LCMapStringEx
InterlockedExchange
FreeLibrary
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
SetEnvironmentVariableA
ExpandEnvironmentStringsW
ReadFile
ReleaseMutex
WaitForSingleObject
CreateMutexW
FileTimeToLocalFileTime
FileTimeToSystemTime
InitializeCriticalSection
GetCurrentProcessId
WTSGetActiveConsoleSessionId
DeleteFileW
GetSystemInfo
GetModuleHandleA
lstrcmpA
CopyFileW
GetUserDefaultLCID
lstrlenA
GlobalFree
GetFileSize
SetFilePointer
GetLocalTime
UnregisterWaitEx
RegisterWaitForSingleObject
LoadLibraryExA
FindClose
FindFirstFileExW
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
ReadConsoleW

Exports

Exports

AuthIdentityToService
AuthIdentityToServiceEx
CancelPendingRequest
CloseEnumIdentitiesHandle
CloseIdentityHandle
CreateIdentityHandle
CreateIdentityHandle2
CreateIdentityHandleEx
EnumIdentitiesWithCachedCredentials
GetAuthState
GetAuthStateEx
GetAuthenticationStatus
GetExtendedError
GetIdentityProperty
GetIdentityPropertyByName
GetRealmInfo
GetRealmInfo2
GetToken
HasPersistedCredential
Initialize
InitializeEx
LogonIdentity
LogonIdentityEx
LogonIdentityExSSO
LogonIdentityExWithUI
NextIdentity
PassportFreeMemory
PersistCredential
RemovePersistedCredential
SetCredential
SetIdcrlOptions
SetIdentityCallback
SetIdentityProperty
Uninitialize

Sections

.text
Size: 690KB - Virtual size: 689KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 378KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 456KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fab449da81a525a6782861209da7e8e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 690KB - Virtual size: 689KB

.rdata Size: 378KB - Virtual size: 377KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 31KB - Virtual size: 31KB

.reloc Size: 456KB - Virtual size: 460KB

.text
Size: 690KB - Virtual size: 689KB

.rdata
Size: 378KB - Virtual size: 377KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 31KB - Virtual size: 31KB

.reloc
Size: 456KB - Virtual size: 460KB