NEAS[.]d828ed01e2a2ac1a6c84fec5ada17200[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d828ed01e2a2ac1a6c84fec5ada17200.exe
Size

751KB
MD5

d828ed01e2a2ac1a6c84fec5ada17200
SHA1

7453c3578f87723aeb65648df38e7513b9e736b5
SHA256

4f56ab78e259247a04711351e2f676b50697108a5377f1454793c10898ff629f
SHA512

338ee3628d9b7170f560098640d54e9f0e4318b61fb4c09444a82eff8269bddf3a8804402570ba02d1c6bb0e16b9dd119aecf7f906598fbfdd6f760a05dfcbfb
SSDEEP

12288:JHPcmkgpTOGaIOlStxLuEi873NKrGyfL5npld663mK21lagYpR:RPcrgRRSlBQsGa5nTkisa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d828ed01e2a2ac1a6c84fec5ada17200.exe

Files

NEAS.d828ed01e2a2ac1a6c84fec5ada17200.exe
.dll windows:4 windows x86

1a5821d0f0bd4860e4e4f28144815112

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLocaleInfoW
GetVersionExA
GetProcAddress
GetModuleHandleW
MulDiv
LoadLibraryA
GlobalSize
DeleteFileW
CloseHandle
WriteFile
SetEndOfFile
GetFileAttributesExA
GetComputerNameW
GetLastError
OutputDebugStringW
FindClose
FindNextFileA
FindFirstFileA
MultiByteToWideChar
GetUserDefaultLCID
HeapAlloc
HeapCreate
GlobalFree
HeapFree
HeapSize
HeapReAlloc
GetLocalTime
LocalAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetACP
GetSystemDefaultLCID
FreeLibrary
GetSystemDefaultLangID
GetUserDefaultLangID
GlobalReAlloc
SetFilePointer
GlobalAlloc
GlobalLock
ReadFile
LCMapStringA
GlobalUnlock
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
WideCharToMultiByte
HeapDestroy
VirtualProtect
RaiseException

user32

GetSystemMetrics
GetDC
ReleaseDC

gdi32

GetWindowOrgEx
GetViewportExtEx
GetWindowExtEx
GetViewportOrgEx
SaveDC
SetMapMode
SelectObject
RestoreDC
GetDeviceCaps

oleaut32

VariantInit
SysAllocStringLen
SysAllocString
VariantClear
SysFreeString

advapi32

RegCloseKey

shlwapi

wnsprintfW
wnsprintfA

msvcr80

_invalid_parameter_noinfo
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
memset
_wcsdup
_wsplitpath_s
memmove
iswalnum
_wcsupr_s
iswspace
_wcsnicmp
wcsncmp
malloc
free
_resetstkoflw
wprintf
_wtoi
_CxxThrowException
?terminate@@YAXXZ
_unlock
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
__lconv_init
_except_handler4_common
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
memcpy
__CxxFrameHandler3
_wtol

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

Exports

Exports

??0ICX@@QAE@ABV0@@Z
??0ICX@@QAE@XZ
??0IParseXML@@QAE@ABV0@@Z
??0IParseXML@@QAE@XZ
??1ICX@@UAE@XZ
??4ICX@@QAEAAV0@ABV0@@Z
??4IParseXML@@QAEAAV0@ABV0@@Z
??_7ICX@@6B@
??_7IParseXML@@6B@
ApplyTransform
ExitParseXML
FPropTablesOK
FreeXMLFormatList
GetXMLFormatList
LpBiff8CxfmtNew
LpBiffCxfmtNew
LpDhtmlCxfmtNew
LpDpCxfmtNew
LpExcel12BiffCxfmtNew
LpExcel12XmlCxfmtNew
LpInitParseXML
LpThtmlCxfmtNew
LpThtxCxfmtNew
LpTrtfCxfmtNew
LpTtextCxfmtNew
LpXmlCxfmtNew
SOA_AddStyle
SOA_CchClipWrap
SOA_ChangeOutputFile
SOA_End
SOA_ErrSetColumnWidths
SOA_ErrSetCurCol
SOA_ErrSetNextRowAttrs
SOA_ErrWrite
SOA_ErrWriteFtyp
SOA_GetFilename
SOA_IdBegin
SOA_PrinterSetup
SOA_SetDocInfo
SOA_SetMailOutput
SetSmartTagUtilsC

Sections

.text
Size: 357KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 285KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1a5821d0f0bd4860e4e4f28144815112

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

oleaut32

advapi32

shlwapi

msvcr80

msvcp80

Exports

Exports

Sections

.text Size: 357KB - Virtual size: 356KB

.data Size: 106KB - Virtual size: 106KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 285KB - Virtual size: 288KB

.text
Size: 357KB - Virtual size: 356KB

.data
Size: 106KB - Virtual size: 106KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 285KB - Virtual size: 288KB