NEAS[.]37dded97884d8d3b3273bbbb40e0e980[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.37dded97884d8d3b3273bbbb40e0e980.exe
Size

337KB
MD5

37dded97884d8d3b3273bbbb40e0e980
SHA1

decf098ee97a1017bb888d3dd6a5a15c90a7cade
SHA256

f21f04ec93f903acd2b949b50f3a995f897891f0d3a589e8474f19ef4e6b9832
SHA512

a86c2dafbe6d58714f7fdf87d2972b9ffa264c54d35e8407426f757f5eb1590a1bd555deb51819bc68b4999802d9b1b846ce8aedd47a49894ad59536b6d30a78
SSDEEP

6144:Y8h6ENUY1xZW54gyOeCZu5ZGdsTyQCKtDFzHc1rkYSi6lhoFoW:Y6UiCteCg5cSTNCKJVAAi6P8oW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.37dded97884d8d3b3273bbbb40e0e980.exe

Files

NEAS.37dded97884d8d3b3273bbbb40e0e980.exe
.exe windows:4 windows x86

570a9943cef4f4c1855a340c1fee950b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
MultiByteToWideChar
WideCharToMultiByte
SetCurrentDirectoryW
GetCurrentDirectoryW
GetModuleHandleW
VirtualProtect
SetFilePointer
GetFileType
SystemTimeToFileTime
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetCurrentThreadId
SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
CompareStringA
GetLocaleInfoW
SetConsoleCtrlHandler
LoadLibraryA
GetUserDefaultLCID
EnumSystemLocalesA
FindFirstFileW
IsValidCodePage
GetCommandLineW
GetCPInfo
LCMapStringW
LCMapStringA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStartupInfoA
GetStdHandle
SetHandleCount
GetCommandLineA
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetTimeZoneInformation
Sleep
GetStringTypeW
GetStringTypeA
HeapSize
FatalAppExitA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetVersionExA
FindNextFileW
FindClose
GetTempPathW
GetTempFileNameW
DeleteFileW
InterlockedIncrement
lstrlenA
OutputDebugStringW
DebugBreak
GetModuleFileNameW
GetCurrentProcessId
CreateFileW
DeviceIoControl
GetProcAddress
GetLocaleInfoA
FreeLibrary
lstrlenW
InterlockedDecrement
CloseHandle
CreateMutexW
GetEnvironmentVariableA
GetModuleFileNameA
GetCurrentThread
LocalFileTimeToFileTime
SetEndOfFile
WriteFile
SetFilePointerEx
ReadFile
GetFileSizeEx
TlsGetValue
OpenThread
IsValidLocale
GetLastError
TlsSetValue
WaitForSingleObject
TerminateProcess
HeapReAlloc
RaiseException
ExitProcess
GetVersion
GetStartupInfoW
GetModuleHandleA
RtlUnwind
SetLastError
LocalFree
GetSystemTime
FormatMessageW
LoadLibraryW
GetLocalTime
CreateFileA
GetSystemTimeAsFileTime
HeapFree
TlsFree
ReleaseMutex
SetEnvironmentVariableW
TlsAlloc
HeapAlloc
GetProcessHeap
GetEnvironmentVariableW
LoadLibraryExW

user32

GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
CreateWindowExW
EndDialog
IsIconic
GetWindow
SystemParametersInfoW
MapWindowPoints
GetSystemMetrics
LoadImageW
GetDlgItem
SetWindowTextW
BringWindowToTop
SetForegroundWindow
PostMessageW
CallWindowProcW
GetWindowLongW
ClientToScreen
SetCapture
GetCapture
ChildWindowFromPoint
InvalidateRect
SetWindowPos
PtInRect
BeginPaint
EndPaint
ReleaseCapture
ShowWindow
MoveWindow
GetParent
GetClientRect
GetWindowRect
ScreenToClient
CopyRect
CharLowerW
CharNextW
wvsprintfW
MessageBoxW
LoadStringW
SetWindowLongW
DestroyWindow
DialogBoxParamW
DefWindowProcW
FindWindowW
IsWindow
SendMessageW
GetActiveWindow
RegisterClassW
GetClassInfoW
WindowFromPoint

gdi32

CreatePen
MoveToEx
LineTo
SetBkColor
ExtTextOutW
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteObject
GetObjectW
CreateFontIndirectW
CreateDCW
DeleteDC
SetViewportOrgEx

advapi32

RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegCloseKey
RegQueryValueExA
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW

ole32

CoUninitialize
CoInitialize

oleaut32

SysStringByteLen
SysAllocStringByteLen
VariantInit
VariantClear
SysStringLen
SysFreeString
GetErrorInfo
SetErrorInfo
VariantChangeType
SysAllocString
CreateErrorInfo

comctl32

InitCommonControlsEx

msimg32

GradientFill

shlwapi

SHGetValueW
PathCombineW
PathFileExistsW
PathAppendW
SHSetValueW
PathRemoveFileSpecW
PathIsRelativeW

shell32

ShellExecuteExW
ShellExecuteW

Sections

.text
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

570a9943cef4f4c1855a340c1fee950b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

comctl32

msimg32

shlwapi

shell32

Sections

.text Size: 184KB - Virtual size: 183KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 24KB - Virtual size: 27KB

.rsrc Size: 100KB - Virtual size: 100KB

.text
Size: 184KB - Virtual size: 183KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 24KB - Virtual size: 27KB

.rsrc
Size: 100KB - Virtual size: 100KB