NEAS[.]d8f642798d120850aef21133e383bbc0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d8f642798d120850aef21133e383bbc0.exe
Size

408KB
MD5

d8f642798d120850aef21133e383bbc0
SHA1

e5974000ccb1732968db8759f22ea059e9bab0f0
SHA256

3f22d0eaf94200fd7b6c932cccbd32661d660f72761004b12d0fcd80d085ea4d
SHA512

70ef724e5d7399f79c92b95c05562825a13ded02439af330d6e92a3c55634b8e9d3735bf4d7bbb01366a1c1406f1abf3c47d922c621dd27262af283690b7f7e7
SSDEEP

12288:+QVb+iXqtgnoaO2rzLr78Nwot6Mc38aDV:+CN6OnoaOKLr78N8MYJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d8f642798d120850aef21133e383bbc0.exe

Files

NEAS.d8f642798d120850aef21133e383bbc0.exe
.dll windows:4 windows x86

2277e2ea67a232bdcc4bbd41683f87a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr80

__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
free
_encoded_null
?terminate@@YAXXZ
_encode_pointer
??2@YAPAXI@Z
_vsnprintf
_vsnwprintf
sscanf_s
qsort
isalpha
strcat_s
strstr
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_wcsnicmp
_stricmp
??3@YAXPAX@Z
memset
memmove
fopen_s
fwprintf_s
fclose
vsprintf_s
wcscpy_s
vswprintf_s
_strnicmp
_malloc_crt
memcpy
strchr
wcsncmp
wcsrchr
strncmp
_wcsicmp
??_U@YAPAXI@Z
??_V@YAXPAX@Z
strrchr

user32

MsgWaitForMultipleObjectsEx
LoadStringW
GetForegroundWindow
PeekMessageA
TranslateMessage
DispatchMessageA
MsgWaitForMultipleObjects

kernel32

WaitForMultipleObjectsEx
SetLastError
DuplicateHandle
WaitForSingleObjectEx
WaitForSingleObject
GetTempPathA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
LoadLibraryW
HeapAlloc
HeapFree
GetTempFileNameA
CreateProcessA
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
QueryPerformanceCounter
VirtualProtect
CompareStringA
GetACP
GetSystemTimeAsFileTime
lstrcmpiA
IsBadReadPtr
IsBadStringPtrA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
CreateEventA
SetEvent
ResetEvent
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
CompareFileTime
GetSystemTime
GetLastError
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThread
SetThreadPriority
LocalFree
ReadFile
CreateFileA
DeleteFileA
SetFilePointer
GetSystemDirectoryA
GetModuleHandleA
GetThreadPriority
FreeLibrary
GetProcAddress
LoadLibraryA

ole32

CoInitializeEx
CreateStreamOnHGlobal
CoCreateInstance
CoGetMalloc
CoUninitialize

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA

olmapi32

HrCreateNewWrappedObjectEx@48
HrSaveRegisteredOptions@16
ScMAPIFindOrLoadProvider@12
FEnsureRichEdit@0
OlkGetMapiSupport@16
FMapiIsInitialized@0
HrBase64ToBytes@24
ord136
HrNewSrvConnThrottle@12
CreateVirtualStream@4
HrRequestNewCredentials@8
ord13
ord17
ord140
HrBytesToBase64@20
EtwTraceErrorTag@8
UnloadRichEdit@0
ReleaseRegisteredOptions@4
ScFreeAndRemoveLibrary@4
ord73
ord19
ord135
REFTRACK_AddRefEx@16
ord75
ord15

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc

crypt32

CryptProtectData
CryptUnprotectData

mso

ord6945
ord6797
ord6848
ord1059
ord6303
ord6374

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain@12
HrCreateProtoHandler

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 248KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2277e2ea67a232bdcc4bbd41683f87a8

Headers

DLL Characteristics

File Characteristics

Imports

msvcr80

user32

kernel32

ole32

advapi32

olmapi32

shell32

crypt32

mso

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 128KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 25KB - Virtual size: 25KB

.reloc Size: 248KB - Virtual size: 252KB

.text
Size: 128KB - Virtual size: 128KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 25KB - Virtual size: 25KB

.reloc
Size: 248KB - Virtual size: 252KB