NEAS[.]095ad13befc9638019fb6b54b90e9460[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.095ad13befc9638019fb6b54b90e9460.exe
Size

354KB
MD5

095ad13befc9638019fb6b54b90e9460
SHA1

eb36e3a5ce179b35f485b3409b97259b1aac0865
SHA256

c222f4019cab6f92f7187c87c3e450ed7bbde86a12783f6d0df22f2b5f1cccec
SHA512

3a6175d4dbc02b47fb9bfb5fec267b61ca8f816730e040e5efd6105e049048eca5d138657e132d42852d6cddab85b1ea0e51253a791ec7cd751edcf09a1089ff
SSDEEP

6144:5z6LKgZ9lwqqpRj4Vsg87sGSVd5OlYY9UeqfTlnyQH3QQW7U:VTqqponwAnOlYYNOny4QQW4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.095ad13befc9638019fb6b54b90e9460.exe

Files

NEAS.095ad13befc9638019fb6b54b90e9460.exe
.exe windows:6 windows x86

759486ab43cb52df3577d6a2b8b7ceca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

ImageNtHeader
MiniDumpWriteDump

rpcrt4

RpcStringFreeW
UuidCreate
UuidToStringW
UuidFromStringW

iphlpapi

GetExtendedTcpTable

ws2_32

ntohs

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

StrCmpIW
PathFindExtensionW
PathFindFileNameW

kernel32

CreateFileW
GetFileAttributesW
GetCurrentThreadId
GetVersionExW
ReleaseMutex
SuspendThread
ResumeThread
OpenProcess
CreateToolhelp32Snapshot
CreateEventW
GetExitCodeThread
Sleep
FormatMessageW
GetLastError
SetEvent
DeleteFileW
CloseHandle
K32GetModuleBaseNameA
GetSystemInfo
K32GetModuleInformation
CreateThread
GetProcAddress
VirtualAllocEx
GetFileSize
ExitProcess
ReadProcessMemory
GetComputerNameW
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
SleepEx
CreateRemoteThread
QueryFullProcessImageNameW
K32EnumProcessModules
VirtualFreeEx
K32GetMappedFileNameW
DebugBreak
MoveFileW
CreateMutexW
OpenThread
LoadLibraryExW
FlushFileBuffers
GetExitCodeProcess
RaiseException
WaitForSingleObject
LeaveCriticalSection
Thread32Next
InitializeCriticalSectionAndSpinCount
K32GetModuleFileNameExW
GetModuleFileNameW
VirtualAlloc
WriteFile
GetCurrentProcess
FindNextFileW
VirtualFree
EnterCriticalSection
WriteProcessMemory
FindFirstFileW
SetConsoleCtrlHandler
ReadFile
CreateDirectoryW
FindClose
VirtualProtect
LoadLibraryExA
HeapAlloc
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
QueryPerformanceCounter
GetPrivateProfileStringW
ExpandEnvironmentStringsW
SetLastError
GetSystemTimeAsFileTime
GetProcessHeap
InitializeSListHead
SetFilePointer
Thread32First
CompareStringW
HeapReAlloc
GetEnvironmentVariableW
SetEnvironmentVariableW
lstrlenW
VirtualQuery

advapi32

LookupPrivilegeValueW
RegisterServiceCtrlHandlerExW
AdjustTokenPrivileges
RegCloseKey
CloseServiceHandle
OpenSCManagerW
SetServiceStatus
OpenProcessToken
StartServiceW
RegOpenKeyExW
StartServiceCtrlDispatcherW
OpenServiceW
QueryServiceStatusEx
RegQueryValueExW
EventRegister
EventUnregister
EventWriteString

vcruntime140

__std_exception_copy
__CxxFrameHandler3
wcsrchr
__std_exception_destroy
wcschr
memset
_CxxThrowException
_except_handler4_common
memcpy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf
__stdio_common_vswscanf
__acrt_iob_func
_set_fmode
__p__commode
__stdio_common_vswprintf

api-ms-win-crt-string-l1-1-0

wcsnlen
_wcsicmp
_stricmp
_wcsnicmp
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv
_cexit
_crt_atexit
_seh_filter_exe
_exit
_register_onexit_function
_initialize_onexit_table
_initialize_wide_environment
_get_initial_wide_environment
_controlfp_s
_errno
terminate
_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
__p___wargv
_c_exit
_set_app_type
exit
__p___argc

api-ms-win-crt-time-l1-1-0

_time64
_wstrdate_s
_gmtime64_s
_wstrtime_s

api-ms-win-crt-filesystem-l1-1-0

_wmakepath_s
_wremove
_wsplitpath_s

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 231KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

759486ab43cb52df3577d6a2b8b7ceca

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

rpcrt4

iphlpapi

ws2_32

version

shlwapi

kernel32

advapi32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 57KB - Virtual size: 57KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 19KB - Virtual size: 148KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 231KB - Virtual size: 232KB

.text
Size: 57KB - Virtual size: 57KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 19KB - Virtual size: 148KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 231KB - Virtual size: 232KB