NEAS[.]0b0a2bbfeb0c4b09f00f6ce63dd203b0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.0b0a2bbfeb0c4b09f00f6ce63dd203b0.exe
Size

1.3MB
MD5

0b0a2bbfeb0c4b09f00f6ce63dd203b0
SHA1

a6bd1ff152fc2f0cbb827e679b7cc5bda801a0b5
SHA256

cc91fbac873587b0e1f48052e84d39945951d30b5ee69b51fb81c26a3f5d15a9
SHA512

c558450907404ebf65e844effc702c15ea452e33256a65cd373d8c0c3b44b51e42d001d43dd9eb278a5bdb4f7c2463b89e4d0621ad4fec5107ed093a151e8c2b
SSDEEP

24576:kPnsDZd8qizvrjfnmUWpEJcvTiGdtmOyggh:kPnsDZdx+TjfmF6JYTiGDm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0b0a2bbfeb0c4b09f00f6ce63dd203b0.exe

Files

NEAS.0b0a2bbfeb0c4b09f00f6ce63dd203b0.exe
.exe windows:6 windows x64

848f18fa3bebac5630ee88749adb119a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

MessageBoxW

kernel32

CloseHandle
CreateEventW
CreateFileW
CreateProcessW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExA
FindNextFileA
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleCP
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentStringsW
GetExitCodeProcess
GetFileType
GetLastError
GetLongPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemTimeAsFileTime
GetTempPathW
GetThreadTimes
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExW
LocalFree
MoveFileExW
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetCurrentDirectoryW
SetEvent
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteConsoleW
WriteFile

shell32

CommandLineToArgvW
SHFileOperationW
ShellExecuteExW

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

848f18fa3bebac5630ee88749adb119a

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

shell32

Sections

.text Size: 88KB - Virtual size: 88KB

.rdata Size: 73KB - Virtual size: 72KB

.data Size: 3KB - Virtual size: 12KB

.pdata Size: 7KB - Virtual size: 6KB

.00cfg Size: 512B - Virtual size: 16B

.tls Size: 512B - Virtual size: 17B

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 88KB - Virtual size: 88KB

.rdata
Size: 73KB - Virtual size: 72KB

.data
Size: 3KB - Virtual size: 12KB

.pdata
Size: 7KB - Virtual size: 6KB

.00cfg
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 17B

.reloc
Size: 1.2MB - Virtual size: 1.8MB