NEAS[.]0218deaf59919b591cbc8a00348e43a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0218deaf59919b591cbc8a00348e43a0.exe
Size

7.1MB
MD5

0218deaf59919b591cbc8a00348e43a0
SHA1

7a32eafff0bbd17c3228b201f4fecdf4602eb972
SHA256

2a7a92b76609538ff2350542c4b0704b09896a8aefe7d7b5f18c3f9a80ba80bc
SHA512

4a786db256c0869413bea7c58c2b649e1ccf85748b0dd9f70b1925ccdb663c8e7b85648f4cdfd3b6186271cba9865d2fee4ba8466fcbcbcfea0bf1ddcc65c761
SSDEEP

98304:TIt6w7lEXVwe2OCfKxXXMm3+RKOGWUDZjTu9g:TQZ5cB2OCfs6nDKjTu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0218deaf59919b591cbc8a00348e43a0.exe

Files

NEAS.0218deaf59919b591cbc8a00348e43a0.exe
.exe windows:6 windows x86

3076ba246463cf0e1a429c2640a5dcce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCreateFromUrlW
StrCmpNW
UrlIsW
PathRemoveFileSpecW
PathStripPathW
StrCmpNA
UrlCanonicalizeA

kernel32

VerifyVersionInfoA
GetFileType
PostQueuedCompletionStatus
IsProcessInJob
ProcessIdToSessionId
SystemTimeToTzSpecificLocalTime
WakeConditionVariable
GetProcessTimes
K32GetProcessMemoryInfo
CreateThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks
GetTempPathW
CreateDirectoryW
FreeEnvironmentStringsW
GetEnvironmentStringsW
OpenProcess
GetThreadId
CreateThread
GetCurrentProcess
WaitForMultipleObjects
ResetEvent
DuplicateHandle
GetCurrentThreadId
GetCommandLineW
WaitNamedPipeW
GetOverlappedResult
QueryInformationJobObject
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
LocalFree
ResumeThread
TerminateProcess
GetCurrentProcessId
VerifyVersionInfoW
HeapSetInformation
GetProcessHeap
VerSetConditionMask
SetEvent
CreateEventA
LoadLibraryW
SetInformationJobObject
GetQueuedCompletionStatus
SetFileAttributesW
CreateThreadpool
CloseThreadpool
CloseThreadpoolWork
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
QueueUserWorkItem
GetFileSizeEx
CreateIoCompletionPort
GlobalFree
GlobalAlloc
GetProcAddress
GetModuleHandleW
GetModuleHandleA
SetThreadErrorMode
GetThreadErrorMode
AssignProcessToJobObject
CreateJobObjectW
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
LoadLibraryExA
ReleaseSemaphore
WaitForSingleObject
SwitchToThread
DeleteFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetDriveTypeW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFilePointer
MoveFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
TlsAlloc
TlsGetValue
GetModuleFileNameW
TlsFree
LocalAlloc
CreateSemaphoreA
GetSystemTimeAsFileTime
GetLocalTime
FileTimeToSystemTime
FindNextFileW
RemoveDirectoryW
CreateProcessW
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesW
GetSystemDirectoryA
LoadLibraryA
lstrlenA
InitializeCriticalSectionAndSpinCount
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
AreFileApisANSI
HeapCreate
HeapFree
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
CreateMutexW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
WaitForSingleObjectEx
DeleteFileA
HeapReAlloc
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
GetFileSize
SystemTimeToFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
OpenEventA
WaitForMultipleObjectsEx
SetWaitableTimer
GetLogicalProcessorInformation
CreateWaitableTimerA
QueryPerformanceFrequency
PeekNamedPipe
CreateNamedPipeA
LoadLibraryExW
GetUserDefaultLCID
GetCurrentThread
CreateEventW
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
QueryDosDeviceW
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualFree
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitThread
GetModuleHandleExW
GetStdHandle
WriteConsoleW
ExitProcess
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
SetEnvironmentVariableW
SetStdHandle
ReadConsoleW
CreateWaitableTimerW
DeleteCriticalSection
InitializeCriticalSectionEx
SetLastError
RaiseException
DecodePointer
OutputDebugStringA
lstrlenW
GetTickCount
Sleep
OpenMutexW
SetNamedPipeHandleState
GetLastError
CloseHandle
GetWindowsDirectoryW
GetCurrentDirectoryW
WriteFile
ReadFile
GetVolumeInformationW
CreateFileW
TerminateThread
TlsSetValue
UnhandledExceptionFilter
SleepEx
DeviceIoControl
GetEnvironmentVariableW
QueueUserAPC

user32

MsgWaitForMultipleObjects
PeekMessageA
GetWindowThreadProcessId
GetForegroundWindow
DispatchMessageA
FindWindowW
PostMessageW
LoadImageW
GetCursorPos
GetPropW
SetPropW
SetForegroundWindow
InsertMenuItemW
TrackPopupMenu
InsertMenuW
DestroyMenu
CreatePopupMenu
GetSystemMetrics
DestroyWindow
CreateWindowExW
RegisterClassW
CallWindowProcA
PostQuitMessage
DefWindowProcA
PostMessageA
GetMessageA
LoadStringW
TranslateMessage

advapi32

RegOpenKeyA
RegSetValueExW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegOpenKeyW
OpenThreadToken
GetTokenInformation
ConvertSidToStringSidA
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
SetTokenInformation
GetLengthSid
DuplicateTokenEx
OpenProcessToken
RegDeleteTreeW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
TreeSetNamedSecurityInfoW
GetNamedSecurityInfoW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSecurityDescriptorSacl
GetAclInformation
GetAce
CreateProcessAsUserW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptImportKey
CryptSetHashParam

shell32

SHQueryUserNotificationState
Shell_NotifyIconW
SHGetKnownFolderPath
SHFileOperationA
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteA
SHCreateDirectoryExW

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoTaskMemFree

sensapi

IsNetworkAlive

ws2_32

WSACleanup
WSAGetLastError
WSACreateEvent
WSAEventSelect
WSAIoctl
WSASocketA
WSAStartup

wininet

DetectAutoProxyUrl
HttpOpenRequestA
HttpEndRequestA
InternetConnectA
InternetOpenA
InternetCrackUrlA
HttpSendRequestA
InternetCloseHandle
InternetSetCookieExA
InternetReadFile
InternetWriteFile
HttpQueryInfoA
InternetSetOptionA
HttpSendRequestExA
HttpAddRequestHeadersA

crypt32

CryptProtectData
CryptUnprotectData

oleaut32

SafeArrayDestroy
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
SysFreeString

netapi32

NetShareGetInfo

mpr

WNetGetResourceInformationW
WNetAddConnection2W
WNetCancelConnection2W

winhttp

WinHttpReadData
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSetStatusCallback
WinHttpSetCredentials
WinHttpSendRequest
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpQueryAuthSchemes
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryHeaders

Exports

Exports

gudeCancel
gudeClearCache
gudeCreate
gudeDestroy
gudeDownload
gudeDownloadRangeToMemory
gudeDownloadToMemory
gudeErrorString
gudeHTTPStatusString
gudePause
gudeRegisterAddChunkHeaderCallback
gudeRegisterAddHeaderCallback
gudeRegisterAddParametersCallback
gudeRegisterCancellationCallback
gudeRegisterChunkErrorRetryCallback
gudeRegisterCompletionCallback
gudeRegisterErrorCallback
gudeRegisterLoggingCallback
gudeRegisterMonitorCallback
gudeRegisterPausedCallback
gudeRegisterProgressCallback
gudeRegisterRequestBodyCallback
gudeRegisterResponseBodyCallback
gudeRegisterResponseHeaderCallback
gudeRegisterSSLCertificatePolicyCallback
gudeRegisterSetServerTypeCallback
gudeRegisterSetTimeoutCallback
gudeRegisterStatusLineCallback
gudeResume
gudeSendRequest
gudeSetLogLevel
gudeSetMultipartUploadThreshold
gudeSetSystemProxyCredentials
gudeSetTargetDataRates
gudeSetWorkerPoolUpperLimit
gudeUpload
gudeUploadFromMemory
gudeVersion

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 851KB - Virtual size: 850KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 257KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3076ba246463cf0e1a429c2640a5dcce

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

ole32

sensapi

ws2_32

wininet

crypt32

oleaut32

netapi32

mpr

winhttp

Exports

Exports

Sections

.text Size: 4.3MB - Virtual size: 4.3MB

.rdata Size: 851KB - Virtual size: 850KB

.data Size: 257KB - Virtual size: 279KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 1.8MB - Virtual size: 1.8MB

.text
Size: 4.3MB - Virtual size: 4.3MB

.rdata
Size: 851KB - Virtual size: 850KB

.data
Size: 257KB - Virtual size: 279KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 1.8MB - Virtual size: 1.8MB