NEAS[.]e41d2be24c85245383660474808a9ad0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e41d2be24c85245383660474808a9ad0.exe
Size

366KB
MD5

e41d2be24c85245383660474808a9ad0
SHA1

098716a4049fd0183d2d8cee59f7ea1f0a4981dc
SHA256

85f62ca5a2abebca95f6e483d2eb04ce4500e86cfcbf202ca378eb753ae7be32
SHA512

4b3f4488d467269da93691fdcc52870cfbc2c080eadc1d75a5d9310a6dd4b83336ddc68b8fe0cd8cdab5c416c27af3c7c06497461bdfd37a7fdff5c75064643c
SSDEEP

6144:wxdaLkgPBLWDYMdeqmgmziVinB+m7rx6WTRewW6NuYy/lhXj+gvHB0QOY+:xAg5YY+VOMKd6WRewmLKEWQOY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e41d2be24c85245383660474808a9ad0.exe

Files

NEAS.e41d2be24c85245383660474808a9ad0.exe
.dll windows:6 windows x86

c94fc0ee0fdaf7f86776d1eddadc4ac6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathFindExtensionW
PathCreateFromUrlW

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

wininet

InternetCrackUrlA
InternetCrackUrlW

kernel32

GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
lstrcmpA
MultiByteToWideChar
CreateFileW
ReadFile
CloseHandle
GetUserDefaultLangID
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExA
LoadResource
FlushInstructionCache
lstrcmpiA
FindResourceA
IsDBCSLeadByte
CreateFileA
SetFilePointer
WriteFile
GetTempPathA
GetTempFileNameA
GetProcessHeap
HeapFree
HeapAlloc
OutputDebugStringW
IsDebuggerPresent
GetCurrentThreadId
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetLastError
GetLastError
RaiseException
DecodePointer
OutputDebugStringA
InitializeSListHead
InterlockedPopEntrySList
GetSystemTimeAsFileTime
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
EncodePointer
QueryPerformanceCounter
GetCurrentProcessId
SizeofResource

user32

RedrawWindow
GetSysColor
FillRect
UnregisterClassA
RegisterWindowMessageA
SendMessageA
DefWindowProcA
CallWindowProcA
OffsetRect
GetWindowLongA
SetWindowLongA
GetDesktopWindow
GetParent
GetClassNameA
GetWindow
LoadCursorA
LoadStringA
RegisterClassExA
GetClassInfoExA
CreateWindowExA
IsWindow
IsChild
DestroyWindow
MoveWindow
SetWindowPos
GetDlgItem
CharNextA
SetFocus
GetFocus
SetCapture
ReleaseCapture
CreateAcceleratorTableA
DestroyAcceleratorTable
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
InvalidateRgn
ScreenToClient
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
GetClientRect
ClientToScreen
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
BringWindowToTop
ShowWindow
RegisterClassA
PostMessageA
wsprintfA

gdi32

CreateDIBSection
GetObjectA
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt

advapi32

RegQueryValueExA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
RegQueryInfoKeyW
RegEnumKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA

ole32

CoTaskMemRealloc
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
OleUninitialize
OleLockRunning
CoUninitialize
StringFromGUID2
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal

oleaut32

SysAllocString
SysFreeString
OleCreateFontIndirect
VarUI4FromStr
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysAllocStringLen

urlmon

CoInternetGetSession

msvcp120

?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

msvcr120

__clean_type_info_names_internal
_initterm_e
_initterm
_malloc_crt
_amsg_exit
__CppXcptFilter
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
??1type_info@@UAE@XZ
_except_handler4_common
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
?terminate@@YAXXZ
memcpy
_time64
swprintf_s
_mbsnbicmp
_wcsicmp
wcscpy
strrchr
_stricmp
srand
rand
??3@YAXPAX@Z
_mbsnbcpy_s
??2@YAPAXI@Z
__CxxFrameHandler3
_CxxThrowException
sprintf_s
wcslen
strlen
memcpy_s
memcmp
_resetstkoflw
_recalloc
calloc
_purecall
memset
??_V@YAXPAX@Z
malloc
free
_mbsstr

Exports

Exports

GetAcrobatMPPInterface

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 257KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c94fc0ee0fdaf7f86776d1eddadc4ac6

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

version

wininet

kernel32

user32

gdi32

advapi32

ole32

oleaut32

urlmon

msvcp120

msvcr120

Exports

Exports

Sections

.text Size: 71KB - Virtual size: 70KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 5KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 257KB - Virtual size: 260KB

.text
Size: 71KB - Virtual size: 70KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 5KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 257KB - Virtual size: 260KB