NEAS[.]36a0b4ee0084ac3ec299d0aa31ebca70[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.36a0b4ee0084ac3ec299d0aa31ebca70.exe
Size

1.1MB
MD5

36a0b4ee0084ac3ec299d0aa31ebca70
SHA1

674b65bd2fcbe51c46b1249942a6cd9973121765
SHA256

e3e55efc04dca528ec2fc4ad5c9bcaff30d09d9060d552e54fc3f87a3cf6ca01
SHA512

68d22d31edde5f74f452ac5c62e8cac02fb16d6c76e97538805757e71c09b562b665d664bb18a4835698bc183708c4f1a37d176902adbeb035dd5b136a58ec06
SSDEEP

24576:EVp5XWMNeFCvYt1AD8LHgZSJ873hIfxfq65Bq/:EVphfrvYjAD8LHHJ8zhIfxy65Bq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.36a0b4ee0084ac3ec299d0aa31ebca70.exe

Files

NEAS.36a0b4ee0084ac3ec299d0aa31ebca70.exe
.exe windows:6 windows x86

213855c1afe1a9636c3c70cb223546d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

advapi32

RegCreateKeyExW
RegQueryInfoKeyW
RegEnumValueW
EventUnregister
GetSecurityDescriptorDacl
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegDeleteValueW
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegSetValueExA
RegSetValueExW
SetNamedSecurityInfoW
ConvertSidToStringSidA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetUserNameA
RegEnumKeyExA
RegEnumValueA
RegQueryInfoKeyA
DeregisterEventSource
RegisterEventSourceW
ReportEventA
ReportEventW
OpenProcessToken
AddAccessAllowedAce
AddAccessDeniedAce
AllocateAndInitializeSid
CheckTokenMembership
CopySid
CreateWellKnownSid
EqualSid
FreeSid
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
IsValidSid
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
RegOpenKeyExW
EventWrite
RegEnumKeyW
RegGetValueW
EventRegister

comctl32

ord17
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create

cabinet

ord22
ord23
ord10
ord21
ord11
ord13
ord12
ord14
ord20

gdi32

CreateFontIndirectW
GetTextFaceA
CreateFontIndirectA
CreateFontA
DeleteDC
DeleteObject
GetDeviceCaps
GetTextExtentPoint32W
RestoreDC
SaveDC
SelectObject
SetBkMode
SetMapMode
SetTextColor
SetTextAlign
GetTextMetricsA
GetObjectA
GetObjectW
ExtTextOutW

kernel32

GetShortPathNameA
GetLastError
EnterCriticalSection
LeaveCriticalSection
GetLocalTime
GetCommandLineW
DeleteFileW
CloseHandle
SetUnhandledExceptionFilter
SetErrorMode
ReleaseMutex
WaitForSingleObject
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateThread
GetModuleHandleA
GetProcAddress
SetProcessWorkingSetSize
WaitForMultipleObjects
MapViewOfFile
GetProcessHeap
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
GetVersionExW
FreeLibrary
GetModuleFileNameW
MultiByteToWideChar
FindClose
FindFirstFileW
FindNextFileW
WriteFile
SetLastError
GetSystemTimeAsFileTime
GetTickCount
GetSystemWindowsDirectoryW
LocalFree
MoveFileW
GetDateFormatW
GetTimeFormatW
GetFileSize
ReadFile
SetFilePointer
RaiseException
ExitThread
SuspendThread
SetPriorityClass
GetTickCount64
UnmapViewOfFile
CreateFileMappingA
GetComputerNameA
GetModuleFileNameA
GetModuleHandleW
LoadLibraryExA
MulDiv
GetACP
GetSystemDefaultUILanguage
GetSystemDefaultLangID
GetSystemDefaultLCID
SetEnvironmentVariableA
ExpandEnvironmentStringsW
CreateDirectoryW
GetFileAttributesW
SetEndOfFile
GetTempPathW
SetEvent
CreateRemoteThread
SetThreadPriority
CreateProcessW
OpenProcess
GetSystemInfo
IsWow64Process
VirtualQueryEx
ReadProcessMemory
WideCharToMultiByte
IsDBCSLeadByte
GetStringTypeExW
IsValidCodePage
CreateFileA
CreateFileW
GetFileType
CreateMutexA
CreateEventA
OpenEventA
OpenMutexA
CreateSemaphoreA
OpenSemaphoreA
HeapAlloc
HeapFree
GlobalFree
LocalAlloc
GetCurrentThread
GlobalAlloc
GetLocaleInfoEx
InitializeCriticalSectionEx
GetCurrentThreadId
LocaleNameToLCID
GetUserDefaultLocaleName
IsValidLocale
CompareStringW
GetUserDefaultLCID
CompareStringEx
LCIDToLocaleName
GetSystemDefaultLocaleName
EnumSystemLocalesEx
GetDateFormatEx
GetCalendarInfoEx
GetThreadUILanguage
LoadResource
SetFileAttributesW
RaiseFailFastException
OutputDebugStringA
GetVersion
LoadLibraryW
WaitForSingleObjectEx
GetDiskFreeSpaceExW
GetFileAttributesExW
GlobalMemoryStatusEx
GetSystemDirectoryW
GetNativeSystemInfo
GetProductInfo
GetTimeZoneInformation
GetUserGeoID
GetUserDefaultUILanguage
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
RtlUnwind
HeapReAlloc
HeapSize
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCPInfo
GetOEMCP
IsProcessorFeaturePresent
LCMapStringW
GetStringTypeW
InterlockedExchange
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetLongPathNameW
GetShortPathNameW
lstrcmpiW
FindResourceW
SizeofResource
LoadLibraryExW
LoadLibraryA
RtlCaptureStackBackTrace
GetUserDefaultLangID
GetSystemDirectoryA

ole32

CoCreateGuid
CoUninitialize
CoInitializeEx
CoCreateInstance
StringFromIID
CoTaskMemFree

oleacc

CreateStdAccessibleObject
LresultFromObject

oleaut32

SysStringLen
SystemTimeToVariantTime
VariantTimeToDosDateTime
SysAllocString
SysFreeString

Sections

.text
Size: 473KB - Virtual size: 473KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 300KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 323KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

213855c1afe1a9636c3c70cb223546d6

Headers

DLL Characteristics

File Characteristics

Imports

version

wintrust

advapi32

comctl32

cabinet

gdi32

kernel32

ole32

oleacc

oleaut32

Sections

.text Size: 473KB - Virtual size: 473KB

.data Size: 300KB - Virtual size: 304KB

.rsrc Size: 15KB - Virtual size: 14KB

.reloc Size: 323KB - Virtual size: 324KB

.text
Size: 473KB - Virtual size: 473KB

.data
Size: 300KB - Virtual size: 304KB

.rsrc
Size: 15KB - Virtual size: 14KB

.reloc
Size: 323KB - Virtual size: 324KB