NEAS[.]1fee11b0eb3044783781d64a7a2972a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1fee11b0eb3044783781d64a7a2972a0.exe
Size

27KB
MD5

1fee11b0eb3044783781d64a7a2972a0
SHA1

9952fd6d60c3a333ce32bd15cd6ae23aabb746bf
SHA256

c704003902e0336293885d35820ce2b411c849e54f2a312e5106df830b00989f
SHA512

9da187589db03b1bdda7daaf0a2a0fab2616a5c9d8689d6a2ed3e0c1af56508c92e3f729c508541040c1ee0fc7078cc7cc5ab5118f1ed4dad40003b45c5a5578
SSDEEP

384:mRF4zWJUev3oXrYoAv4zD4Qka+/dMD4cPf9ACqRe29jqlwHvmA:mozWJUkorHnNkrMD4Of+H3qlOf

Score

1^/10

Malware Config

Signatures

Files

NEAS.1fee11b0eb3044783781d64a7a2972a0.exe
.exe windows:4 windows x64

b2a95c038e1a7e49639c37680f3fbbc6

Code Sign

33:00:06:b7:c3:2b:ca:21:12:81:b3:66:04:00:00:00:06:b7:c3
Certificate

Issuer

CN=Microsoft Azure RSA TLS Issuing CA 07,O=Microsoft Corporation,C=US

Not Before

20/09/2023, 15:16

Not After

14/09/2024, 15:16

Subject

CN=surface.com,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

62:74:fd:c4:55:ad:15:c8:c8:3c:d7:5f:8f:4f:12:41:9d:1b:7f:d9:fb:4c:89:c4:57:ce:7a:db:b5:84:53:71
Signer

Actual PE Digest

62:74:fd:c4:55:ad:15:c8:c8:3c:d7:5f:8f:4f:12:41:9d:1b:7f:d9:fb:4c:89:c4:57:ce:7a:db:b5:84:53:71

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CreateEventA
CreateFileA
CreateFileMappingA
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentThread
GetLastError
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
MapViewOfFile
SetErrorMode
SetUnhandledExceptionFilter
Sleep
SleepEx
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject

msvcrt

__C_specific_handler
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_onexit
abort
acos
asin
calloc
exit
fprintf
free
fwrite
malloc
memcpy
rand
signal
strcmp
strlen
strncmp
vfprintf

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 484B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 384B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b2a95c038e1a7e49639c37680f3fbbc6

Code Sign

33:00:06:b7:c3:2b:ca:21:12:81:b3:66:04:00:00:00:06:b7:c3Certificate

62:74:fd:c4:55:ad:15:c8:c8:3c:d7:5f:8f:4f:12:41:9d:1b:7f:d9:fb:4c:89:c4:57:ce:7a:db:b5:84:53:71Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

Sections

.text Size: 15KB - Virtual size: 14KB

.data Size: 512B - Virtual size: 128B

.rdata Size: 4KB - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 612B

.xdata Size: 512B - Virtual size: 484B

.bss Size: - Virtual size: 384B

.idata Size: 2KB - Virtual size: 1KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 120B

33:00:06:b7:c3:2b:ca:21:12:81:b3:66:04:00:00:00:06:b7:c3
Certificate

62:74:fd:c4:55:ad:15:c8:c8:3c:d7:5f:8f:4f:12:41:9d:1b:7f:d9:fb:4c:89:c4:57:ce:7a:db:b5:84:53:71
Signer

.text
Size: 15KB - Virtual size: 14KB

.data
Size: 512B - Virtual size: 128B

.rdata
Size: 4KB - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 612B

.xdata
Size: 512B - Virtual size: 484B

.bss
Size: - Virtual size: 384B

.idata
Size: 2KB - Virtual size: 1KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 120B