NEAS[.]1e3f7a9c2f363edb322c495305f6b490[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1e3f7a9c2f363edb322c495305f6b490.exe
Size

2.3MB
MD5

1e3f7a9c2f363edb322c495305f6b490
SHA1

122d2c613453b4ba22c74b27b54e589b87ef9112
SHA256

ab1f2e6bc7f21624203b7af3ff8739825038b4f7ed7f9b1d1c7e1d274a5f1cbd
SHA512

8889cda657bee4e5cc55c0363b89f83fd8df7adb1fbbd5fcd35ec973599994e046bf6f9c5b1f2877c7d89ccea3995be503413991cd8e564e58dc31ffcf689584
SSDEEP

49152:9VuGgRPn6SgRPPu2buS9nmLgb50T7vfCue7jTUviBpA:uO93mLgNUvfCL4ac

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1e3f7a9c2f363edb322c495305f6b490.exe

Files

NEAS.1e3f7a9c2f363edb322c495305f6b490.exe
.dll windows:4 windows x86

47e71ecd47256ef5cc2270747be3d912

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc80u

ord1170
ord1168
ord1192
ord1115
ord1162
ord371
ord1093
ord1199
ord1197
ord1087
ord1033
ord1079
ord315
ord765
ord777
ord774
ord3249
ord1172
ord5316
ord1571
ord6282
ord2340
ord5327
ord6293
ord1925
ord894
ord897
ord898
ord3204
ord3198
ord6031
ord1959
ord1271
ord2239
ord1043
ord3824
ord757
ord4032
ord4008
ord6272
ord3795
ord6274
ord4320
ord2054
ord2009
ord5579
ord3800
ord1007
ord5096
ord6215
ord5378
ord3826
ord1911
ord2925
ord5220
ord5222
ord3942
ord4562
ord5226
ord5209
ord5562
ord2531
ord2725
ord2829
ord4301
ord2708
ord1200
ord581
ord2832
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4475
ord4255
ord3327
ord566
ord3677
ord2895
ord2460
ord5398
ord280
ord5584
ord3885
ord5519
ord347
ord1270
ord1957
ord602
ord283
ord287
ord764
ord870
ord1476
ord1908
ord265
ord314
ord6751
ord1176
ord293
ord577
ord1178
ord1182
ord266
ord762

msvcr80

_recalloc
swprintf_s
_time64
wcsstr
_localtime64_s
_wcsicmp
wcsrchr
wcschr
_access
strstr
atoi
_strnicmp
_CIfmod
memcpy
floor
memmove
_hypot
_CIasin
srand
rand
strtoul
ferror
fopen
fread
fgetc
fseek
fgets
abort
_errno
_CIatan
malloc
??0exception@std@@QAE@ABQBD@Z
_getcwd
_CItan
isxdigit
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
memset
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_vsnwprintf
ceil
_CIpow
strtod
strtol
strtok
_strupr
isalnum
isalpha
strchr
qsort
realloc
strncmp
strrchr
toupper
calloc
isspace
isdigit
modf
getenv
_ftime64
atol
bsearch
atof
_vsnprintf
_ctime64
_CIatan2
_CIsin
_CIcos
_CIsqrt
fclose
fwrite
_stricmp
free
_wfopen
wcstok
_wcsnicmp
memcpy_s
_wsplitpath
_CIacos
_amsg_exit
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_crt_debugger_hook
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__CppXcptFilter
_adjust_fdiv
wcsncpy_s
_initterm_e
_initterm
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
fopen_s
fwprintf_s
vsprintf_s
wcscpy_s
vswprintf_s
_CIlog10

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0strstreambuf@std@@QAE@PBDH@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1strstreambuf@std@@UAE@XZ
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBEHXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@HH@Z
?eof@?$char_traits@D@std@@SAHXZ
?eof@ios_base@std@@QBE_NXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

kernel32

HeapFree
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
LoadLibraryExW
FreeLibrary
LoadLibraryA
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThreadId
OutputDebugStringA
SetLastError
GetLastError
SearchPathA
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
CloseHandle
CreateProcessA
GetTempFileNameA
GetTempPathA
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
CreateFileW
GetFileType
GetFileTime
GetFileSize
SetFilePointer
WriteFile
ReadFile
GetSystemDefaultLangID
GetVersionExW
LoadLibraryW
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
GetCurrentProcess
FlushInstructionCache
RaiseException
GetVersion
GetFileAttributesW
GetModuleHandleA
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpiW
SizeofResource
FindResourceW
LoadResource
GetCPInfo
GetACP
GetCurrentDirectoryA
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
LocalAlloc
LocalLock
LocalUnlock
lstrlenW
LocalFree
MultiByteToWideChar
GetVersionExA
GetProcAddress
GetModuleHandleW

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VarBstrCat
SysAllocStringLen
VariantCopy
VariantChangeType
LoadRegTypeLi
LoadTypeLi
VarBstrCmp
GetActiveObject
VariantTimeToSystemTime
SystemTimeToVariantTime
VarUI4FromStr

ole32

CreateStreamOnHGlobal
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
OleCreateDefaultHandler
CoGetMalloc
OleRegGetUserType
OleIsRunning
OleRegEnumVerbs
OleRegGetMiscStatus
CreateOleAdviseHolder
CreateDataAdviseHolder
CoTaskMemRealloc
CoCreateInstance
ProgIDFromCLSID

user32

UnregisterClassA
GetKeyState
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnionRect
PtInRect
CallWindowProcW
BeginPaint
GetClientRect
EndPaint
EqualRect
SetWindowRgn
LoadCursorW
GetWindowLongW
SetWindowLongW
GetParent
GetFocus
IsChild
SetFocus
DefWindowProcW
InvalidateRect
IsWindow
DestroyWindow
ShowWindow
SetWindowPos
CharNextW
GetDC
ReleaseDC
LoadStringA
MessageBoxW
IsRectEmpty
CopyRect
LoadStringW
OffsetRect
IntersectRect

advapi32

RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW

gdi32

SelectObject
GetStockObject
RestoreDC
DeleteObject
SelectClipRgn
CreateRectRgnIndirect
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
LineTo
MoveToEx
Polyline
Polygon
DeleteDC
CreateSolidBrush
DeleteMetaFile
CloseMetaFile
CreateMetaFileW
CreateDCW
GetGlyphOutlineW
GetTextExtentPoint32A
CreateFontIndirectA
SetROP2
GetTextMetricsW
SetPolyFillMode
FillPath
EndPath
TextOutW
BeginPath
GetTextExtentPoint32W
CreateHatchBrush
GetBkColor
CreatePen
SetTextAlign
SetTextColor
SetBkMode
SetPixel
ExtCreatePen
GetROP2

shlwapi

PathFindExtensionA
PathFindFileNameW
PathFindFileNameA

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 709KB - Virtual size: 712KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

47e71ecd47256ef5cc2270747be3d912

Headers

DLL Characteristics

File Characteristics

Imports

mfc80u

msvcr80

msvcp80

kernel32

oleaut32

ole32

user32

advapi32

gdi32

shlwapi

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.data Size: 48KB - Virtual size: 64KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 709KB - Virtual size: 712KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 48KB - Virtual size: 64KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 709KB - Virtual size: 712KB