NEAS[.]0c601be014f1c68d87a68fb308dbe8f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0c601be014f1c68d87a68fb308dbe8f0.exe
Size

286KB
MD5

0c601be014f1c68d87a68fb308dbe8f0
SHA1

d24edb0eed964bbfe4932ff4afe8e630e879ccc7
SHA256

b59c87b594f2268ea36b77b5ff193dc46478a4f3ac2d3be2017c8280484d07f1
SHA512

40ec05e3f43fcc0bbd10ae9cff3bd089ade65081cae2256b91eb415eac28311e70d1cad140d86a72cf0c6f92892c81439d29ccea51454a7df21968b4af42f1fe
SSDEEP

6144:07Ztzyu7Oa5rJmVUcBB5vP6jx5TLpSc66GQ7p8:kYMr8VjBc5TUcXX7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0c601be014f1c68d87a68fb308dbe8f0.exe

Files

NEAS.0c601be014f1c68d87a68fb308dbe8f0.exe
.dll windows:6 windows x86

a0a6d4dc6f940e6087d4b3ebbc40532c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr100

memcmp
__CxxFrameHandler3
_vsnwprintf_s
_snwprintf_s
ceil
malloc
free
rand
memset
wcsncpy_s
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common

kernel32

RaiseException
LocalAlloc
GetProcAddress
FreeLibrary
LoadLibraryA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
DeleteFileW
GetFileAttributesExW
GetLastError
MoveFileExW
DisableThreadLibraryCalls
QueryPerformanceCounter
GetProcessHeap
HeapSetInformation
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
VirtualProtect
WerRegisterMemoryBlock
EncodePointer
DecodePointer

gdiplus

GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateMetafileFromEmf
GdipDrawImageRectRectI
GdipGraphicsClear
GdipDeleteGraphics
GdipCreateBitmapFromHBITMAP
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageHeight
GdipGetImageBounds
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipDisposeImage
GdipGetMatrixElements
GdipRotateMatrix
GdipScaleMatrix
GdipTranslateMatrix
GdipMultiplyMatrix
GdipSetMatrixElements
GdipDeleteMatrix
GdipCreateMatrix3
GdipCreateMatrix2
GdipCreateMatrix
GdipAddPathRectangle
GdipGetPathFillMode
GdipGetPathPoints
GdipGetPathTypes
GdipGetPointCount
GdipDeletePath
GdipCreatePath
GdipGetImageWidth

gdi32

GetGlyphIndicesW
SetTextAlign
SelectObject
GetCharWidthI
CreateCompatibleBitmap
GetTextAlign
GetOutlineTextMetricsA
DeleteObject

mso

ord1747
ord469
ord3834
ord6049
ord1905
ord3425
ord6664
ord25
ord5362
ord8007
ord7488
ord5467
ord7612
ord6125
ord5541
ord1932
ord5885
ord7285
ord4602
ord3278
ord2622
ord4454
ord151
ord6176
ord9608
ord3946
ord1485
ord2634
ord3520
ord9462
ord7908
ord6652
ord1594
ord2609
ord7714
ord6930
ord491
ord6705
ord2125
ord2878
ord6137
ord8879

Exports

Exports

HrGetDocExDocument

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 233KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0a6d4dc6f940e6087d4b3ebbc40532c

Headers

DLL Characteristics

File Characteristics

Imports

msvcr100

kernel32

gdiplus

gdi32

mso

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 50KB

.data Size: 512B - Virtual size: 888B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 233KB - Virtual size: 236KB

.text
Size: 50KB - Virtual size: 50KB

.data
Size: 512B - Virtual size: 888B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 233KB - Virtual size: 236KB