NEAS[.]ea71c4dff8e561b9f4d3a0636f0e2290[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ea71c4dff8e561b9f4d3a0636f0e2290.exe
Size

480KB
MD5

ea71c4dff8e561b9f4d3a0636f0e2290
SHA1

0fcf949d6246695297a73ad68188efa1c023b2ec
SHA256

205550aeb3c9f4058df31c7b2afaecd1a9c419c9ad786c1440f2770c134ef26f
SHA512

131d1449458f0a9cd985c354a033515e38857638d62b742395a023296210d3662f9d548ca7723d55b56cbfc34f4dd963f233301977f7726987026cb4eeb82a2b
SSDEEP

6144:SAvd4N4xAaELON5sOj5VoLTchWsK3wl84K1H6DXQ0UggsusqoFbkhM5t5iEwYAZ:SAvd4N42aYO/0TdIkOtUgWCkhM5iEA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ea71c4dff8e561b9f4d3a0636f0e2290.exe

Files

NEAS.ea71c4dff8e561b9f4d3a0636f0e2290.exe
.dll regsvr32 windows:5 windows x86

ac9fda67c4fa59caec270cd760a2a039

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryW
GlobalHandle
GlobalFree
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcmpW
MulDiv
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
SetLastError
FormatMessageW
LocalFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetUserDefaultLCID
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetModuleFileNameW
lstrlenW
RaiseException
GetLastError
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
InterlockedCompareExchange
FreeLibrary
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
Sleep
DisableThreadLibraryCalls
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
lstrcmpiW
GetTickCount

msvcr80

_except_handler4_common
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
__CxxFrameHandler3
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
memset
_wcsicmp
wcschr
_wcsdup
_CxxThrowException
_wcsupr
swprintf_s
_ltow_s
_purecall
??_U@YAPAXI@Z
??2@YAPAXI@Z
_recalloc
free
wcscpy_s
wcscat_s
wcsncpy_s
memcpy_s
malloc
??_V@YAXPAX@Z
??3@YAXPAX@Z
wcsstr

advapi32

RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW

ole32

CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromString

oleaut32

UnRegisterTypeLi
VarUI4FromStr
SysFreeString
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantInit
SysAllocStringLen
OleCreateFontIndirect
SysStringByteLen
VariantClear
VariantCopy
GetErrorInfo
RegisterTypeLi

user32

GetWindow
MapDialogRect
CreateWindowExW
RegisterClassExW
LoadCursorW
GetClassInfoExW
GetWindowTextLengthW
RegisterWindowMessageW
GetDesktopWindow
InvalidateRgn
InvalidateRect
ReleaseCapture
SetCapture
MoveWindow
ClientToScreen
CreateAcceleratorTableW
GetParent
GetClassNameW
RedrawWindow
SetWindowContextHelpId
IsWindow
CallWindowProcW
SetFocus
GetFocus
IsChild
ReleaseDC
GetDC
EndPaint
FillRect
GetClientRect
BeginPaint
GetSysColor
DefWindowProcW
DestroyAcceleratorTable
SetWindowLongW
DestroyWindow
MessageBoxW
UnregisterClassA
EndDialog
DialogBoxIndirectParamW
GetActiveWindow
GetWindowTextW
SetWindowTextW
LoadStringW
ShowWindow
SetWindowPos
ScreenToClient
GetWindowRect
SendMessageW
GetDlgItem
EnableWindow
CharNextW
GetWindowLongW

gdi32

CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
BitBlt
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
GetObjectW

comdlg32

GetOpenFileNameW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 227KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac9fda67c4fa59caec270cd760a2a039

Headers

File Characteristics

Imports

kernel32

msvcr80

advapi32

ole32

oleaut32

user32

gdi32

comdlg32

Exports

Exports

Sections

.text Size: 92KB - Virtual size: 92KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 159KB - Virtual size: 158KB

.reloc Size: 227KB - Virtual size: 228KB

.text
Size: 92KB - Virtual size: 92KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 159KB - Virtual size: 158KB

.reloc
Size: 227KB - Virtual size: 228KB