NEAS[.]37bed059df19c3d43cc14ffde8c2fcf0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.37bed059df19c3d43cc14ffde8c2fcf0.exe
Size

571KB
MD5

37bed059df19c3d43cc14ffde8c2fcf0
SHA1

c1d061d06095f030baa3e17d6a460c929e1b44a6
SHA256

98ba74f2a518b20fdae8dd067a47a985020d8f2b4fc9a44477ba3afe8f6b8015
SHA512

ccd5accd5ca8578b61c95611cbda88cc1bb856e05c5dc4066f399224ff5791c4a9638e3f7531d5e6ba6766e88fea2a0c3c8996516afd9fced599d15abdad7a50
SSDEEP

12288:CWn1o1qr+PAX3q9SAn7f2aNGx38NXJNv+fnTskpLSMi+YNzz8C:bWYrl75aNxJN+fn4WSMi+YNzzD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.37bed059df19c3d43cc14ffde8c2fcf0.exe

Files

NEAS.37bed059df19c3d43cc14ffde8c2fcf0.exe
.exe windows:5 windows x86

4586b951eca1f9c726d086b6bab97b82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
GetProcessId
WaitForSingleObject
GetExitCodeProcess
OpenProcess
ExitThread
ReadFile
SetFilePointer
GetFileSize
CreateFileW
SetLastError
FlushInstructionCache
GetCurrentProcess
Process32FirstW
GetTickCount
GetCurrentThreadId
InterlockedIncrement
Process32NextW
GetLogicalDriveStringsW
QueryDosDeviceW
WaitForMultipleObjects
ResumeThread
SetThreadPriority
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
LoadLibraryExW
MultiByteToWideChar
GetLastError
EnterCriticalSection
RaiseException
LeaveCriticalSection
TerminateThread
ResetEvent
SetEvent
CreateEventW
GetVersionExW
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
lstrcmpiW
GetModuleHandleW
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetModuleHandleA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoA
GetFileType
GetProcAddress
lstrlenW
FreeLibrary
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
GetLocalTime
GetTimeZoneInformation
FormatMessageW
LocalFree
GetFileAttributesExW
CopyFileW
WriteFile
FlushFileBuffers
CreateDirectoryW
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
CreateMutexW
OpenMutexW
CloseHandle
GetCommandLineW
GetLocaleInfoW
GetEnvironmentVariableW
GetVolumeInformationW
GetWindowsDirectoryW
SystemTimeToFileTime
FileTimeToSystemTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LoadLibraryW
MulDiv
lstrcmpW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
GetModuleFileNameA
Sleep
ExitProcess
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
CreateThread

user32

ReleaseDC
GetDC
InvalidateRect
InvalidateRgn
FillRect
ScreenToClient
ClientToScreen
CreateAcceleratorTableW
RedrawWindow
GetSysColor
GetClassNameW
GetDlgItem
IsChild
EndPaint
BeginPaint
GetWindowTextW
GetWindowTextLengthW
GetDesktopWindow
SetWindowsHookExW
UnhookWindowsHookEx
DestroyAcceleratorTable
UnregisterClassA
ReleaseCapture
MoveWindow
PostMessageW
CallWindowProcW
CreateWindowExW
SetMenuItemInfoW
GetMenuItemInfoW
IsMenu
DialogBoxParamW
GetActiveWindow
GetFocus
SetFocus
SetForegroundWindow
IsWindow
TrackPopupMenuEx
GetCursorPos
GetSubMenu
LoadMenuW
ShowWindow
SetCapture
PtInRect
IsRectEmpty
GetClassInfoExW
RegisterClassExW
SetCursor
LoadCursorW
DestroyIcon
LoadImageW
GetSystemMetrics
OffsetRect
CallNextHookEx
SetWindowTextW
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetParent
MapWindowPoints
GetWindowRect
SetWindowLongW
GetWindowLongW
SendMessageW
SetWindowPos
GetClientRect
EndDialog
DestroyWindow
DefWindowProcW
CharNextW
SetRectEmpty
LoadStringW
MessageBoxW
RegisterWindowMessageW

advapi32

EnumServicesStatusW
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
RegEnumValueW
RegQueryValueExW
GetSecurityInfo
GetEffectiveRightsFromAclW
BuildTrusteeWithSidW
LookupAccountNameW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
IsTextUnicode
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetUserNameW
OpenSCManagerW

ole32

CoCreateInstance
CoTaskMemAlloc
StringFromCLSID
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromProgID
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CoSetProxyBlanket
OleUninitialize
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromString
OleInitialize
CoInitializeSecurity

oleaut32

SysAllocStringLen
VariantChangeType
VariantInit
VariantCopy
GetErrorInfo
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetUBound
SafeArrayCreateVector
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
LoadTypeLi
DispCallFunc
SysAllocString
VariantClear
SysFreeString
VarUI4FromStr

shlwapi

PathFileExistsW
UrlUnescapeW

comctl32

InitCommonControlsEx

urlmon

CoInternetParseUrl

wininet

HttpOpenRequestW
InternetConnectW
HttpSendRequestW
InternetSetOptionW
InternetOpenW
InternetQueryOptionW
HttpQueryInfoW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

crypt32

CertGetNameStringW
CertNameToStrW
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertCloseStore
CryptMsgClose

gdi32

BitBlt
GetObjectW
GetStockObject
DeleteDC
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
GetDeviceCaps

shell32

Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteExW
ord155
SHOpenFolderAndSelectItems
ord190
ShellExecuteW

psapi

GetProcessImageFileNameW
GetModuleFileNameExW

Exports

Exports

arcfour_LTX__is_block_algorithm
arcfour_LTX__mcrypt_algorithm_version
arcfour_LTX__mcrypt_decrypt
arcfour_LTX__mcrypt_encrypt
arcfour_LTX__mcrypt_get_algo_iv_size
arcfour_LTX__mcrypt_get_algorithms_name
arcfour_LTX__mcrypt_get_block_size
arcfour_LTX__mcrypt_get_key_size
arcfour_LTX__mcrypt_get_size
arcfour_LTX__mcrypt_get_supported_key_sizes
arcfour_LTX__mcrypt_self_test
arcfour_LTX__mcrypt_set_key
blowfish_LTX__is_block_algorithm
blowfish_LTX__mcrypt_algorithm_version
blowfish_LTX__mcrypt_decrypt
blowfish_LTX__mcrypt_encrypt
blowfish_LTX__mcrypt_get_algorithms_name
blowfish_LTX__mcrypt_get_block_size
blowfish_LTX__mcrypt_get_key_size
blowfish_LTX__mcrypt_get_size
blowfish_LTX__mcrypt_get_supported_key_sizes
blowfish_LTX__mcrypt_self_test
blowfish_LTX__mcrypt_set_key
blowfish_compat_LTX__is_block_algorithm
blowfish_compat_LTX__mcrypt_algorithm_version
blowfish_compat_LTX__mcrypt_decrypt
blowfish_compat_LTX__mcrypt_encrypt
blowfish_compat_LTX__mcrypt_get_algorithms_name
blowfish_compat_LTX__mcrypt_get_block_size
blowfish_compat_LTX__mcrypt_get_key_size
blowfish_compat_LTX__mcrypt_get_size
blowfish_compat_LTX__mcrypt_get_supported_key_sizes
blowfish_compat_LTX__mcrypt_self_test
blowfish_compat_LTX__mcrypt_set_key
cast_128_LTX__is_block_algorithm
cast_128_LTX__mcrypt_algorithm_version
cast_128_LTX__mcrypt_decrypt
cast_128_LTX__mcrypt_encrypt
cast_128_LTX__mcrypt_get_algorithms_name
cast_128_LTX__mcrypt_get_block_size
cast_128_LTX__mcrypt_get_key_size
cast_128_LTX__mcrypt_get_size
cast_128_LTX__mcrypt_get_supported_key_sizes
cast_128_LTX__mcrypt_self_test
cast_128_LTX__mcrypt_set_key
cast_256_LTX__is_block_algorithm
cast_256_LTX__mcrypt_algorithm_version
cast_256_LTX__mcrypt_decrypt
cast_256_LTX__mcrypt_encrypt
cast_256_LTX__mcrypt_get_algorithms_name
cast_256_LTX__mcrypt_get_block_size
cast_256_LTX__mcrypt_get_key_size
cast_256_LTX__mcrypt_get_size
cast_256_LTX__mcrypt_get_supported_key_sizes
cast_256_LTX__mcrypt_self_test
cast_256_LTX__mcrypt_set_key
des_LTX__is_block_algorithm
des_LTX__mcrypt_algorithm_version
des_LTX__mcrypt_decrypt
des_LTX__mcrypt_encrypt
des_LTX__mcrypt_get_algorithms_name
des_LTX__mcrypt_get_block_size
des_LTX__mcrypt_get_key_size
des_LTX__mcrypt_get_size
des_LTX__mcrypt_get_supported_key_sizes
des_LTX__mcrypt_self_test
des_LTX__mcrypt_set_key
end_mcrypt
enigma_LTX__is_block_algorithm
enigma_LTX__mcrypt_algorithm_version
enigma_LTX__mcrypt_decrypt
enigma_LTX__mcrypt_encrypt
enigma_LTX__mcrypt_get_algo_iv_size
enigma_LTX__mcrypt_get_algorithms_name
enigma_LTX__mcrypt_get_block_size
enigma_LTX__mcrypt_get_key_size
enigma_LTX__mcrypt_get_size
enigma_LTX__mcrypt_get_supported_key_sizes
enigma_LTX__mcrypt_self_test
enigma_LTX__mcrypt_set_key
gost_LTX__is_block_algorithm
gost_LTX__mcrypt_algorithm_version
gost_LTX__mcrypt_decrypt
gost_LTX__mcrypt_encrypt
gost_LTX__mcrypt_get_algorithms_name
gost_LTX__mcrypt_get_block_size
gost_LTX__mcrypt_get_key_size
gost_LTX__mcrypt_get_size
gost_LTX__mcrypt_get_supported_key_sizes
gost_LTX__mcrypt_self_test
gost_LTX__mcrypt_set_key
init_mcrypt
loki97_LTX__is_block_algorithm
loki97_LTX__mcrypt_algorithm_version
loki97_LTX__mcrypt_decrypt
loki97_LTX__mcrypt_encrypt
loki97_LTX__mcrypt_get_algorithms_name
loki97_LTX__mcrypt_get_block_size
loki97_LTX__mcrypt_get_key_size
loki97_LTX__mcrypt_get_size
loki97_LTX__mcrypt_get_supported_key_sizes
loki97_LTX__mcrypt_self_test
loki97_LTX__mcrypt_set_key
mcrypt
mcrypt_dlopen
mcrypt_enc_get_algorithms_name
mcrypt_enc_get_block_size
mcrypt_enc_get_iv_size
mcrypt_enc_get_key_size
mcrypt_enc_get_modes_name
mcrypt_enc_get_state
mcrypt_enc_get_supported_key_sizes
mcrypt_enc_is_block_algorithm
mcrypt_enc_is_block_algorithm_mode
mcrypt_enc_is_block_mode
mcrypt_enc_mode_has_iv
mcrypt_enc_self_test
mcrypt_enc_set_state
mcrypt_free
mcrypt_generic
mcrypt_generic_deinit
mcrypt_generic_end
mcrypt_generic_init
mcrypt_get_algo_iv_size
mcrypt_get_size
mcrypt_mode_get_size
mcrypt_module_algorithm_version
mcrypt_module_close
mcrypt_module_get_algo_block_size
mcrypt_module_get_algo_key_size
mcrypt_module_get_algo_supported_key_sizes
mcrypt_module_is_block_algorithm
mcrypt_module_is_block_algorithm_mode
mcrypt_module_is_block_mode
mcrypt_module_mode_version
mcrypt_module_open
mcrypt_module_self_test
mcrypt_perror
mcrypt_set_key
mcrypt_strerror
mdecrypt
mdecrypt_generic
rc2_LTX__is_block_algorithm
rc2_LTX__mcrypt_algorithm_version
rc2_LTX__mcrypt_decrypt
rc2_LTX__mcrypt_encrypt
rc2_LTX__mcrypt_get_algorithms_name
rc2_LTX__mcrypt_get_block_size
rc2_LTX__mcrypt_get_key_size
rc2_LTX__mcrypt_get_size
rc2_LTX__mcrypt_get_supported_key_sizes
rc2_LTX__mcrypt_self_test
rc2_LTX__mcrypt_set_key
rijndael_128_LTX__is_block_algorithm
rijndael_128_LTX__mcrypt_algorithm_version
rijndael_128_LTX__mcrypt_decrypt
rijndael_128_LTX__mcrypt_encrypt
rijndael_128_LTX__mcrypt_get_algorithms_name
rijndael_128_LTX__mcrypt_get_block_size
rijndael_128_LTX__mcrypt_get_key_size
rijndael_128_LTX__mcrypt_get_size
rijndael_128_LTX__mcrypt_get_supported_key_sizes
rijndael_128_LTX__mcrypt_self_test
rijndael_128_LTX__mcrypt_set_key
rijndael_192_LTX__is_block_algorithm
rijndael_192_LTX__mcrypt_algorithm_version
rijndael_192_LTX__mcrypt_decrypt
rijndael_192_LTX__mcrypt_encrypt
rijndael_192_LTX__mcrypt_get_algorithms_name
rijndael_192_LTX__mcrypt_get_block_size
rijndael_192_LTX__mcrypt_get_key_size
rijndael_192_LTX__mcrypt_get_size
rijndael_192_LTX__mcrypt_get_supported_key_sizes
rijndael_192_LTX__mcrypt_self_test
rijndael_192_LTX__mcrypt_set_key
rijndael_256_LTX__is_block_algorithm
rijndael_256_LTX__mcrypt_algorithm_version
rijndael_256_LTX__mcrypt_decrypt
rijndael_256_LTX__mcrypt_encrypt
rijndael_256_LTX__mcrypt_get_algorithms_name
rijndael_256_LTX__mcrypt_get_block_size
rijndael_256_LTX__mcrypt_get_key_size
rijndael_256_LTX__mcrypt_get_size
rijndael_256_LTX__mcrypt_get_supported_key_sizes
rijndael_256_LTX__mcrypt_self_test
rijndael_256_LTX__mcrypt_set_key
saferplus_LTX__is_block_algorithm
saferplus_LTX__mcrypt_algorithm_version
saferplus_LTX__mcrypt_decrypt
saferplus_LTX__mcrypt_encrypt
saferplus_LTX__mcrypt_get_algorithms_name
saferplus_LTX__mcrypt_get_block_size
saferplus_LTX__mcrypt_get_key_size
saferplus_LTX__mcrypt_get_size
saferplus_LTX__mcrypt_get_supported_key_sizes
saferplus_LTX__mcrypt_self_test
saferplus_LTX__mcrypt_set_key
serpent_LTX__is_block_algorithm
serpent_LTX__mcrypt_algorithm_version
serpent_LTX__mcrypt_decrypt
serpent_LTX__mcrypt_encrypt
serpent_LTX__mcrypt_get_algorithms_name
serpent_LTX__mcrypt_get_block_size
serpent_LTX__mcrypt_get_key_size
serpent_LTX__mcrypt_get_size
serpent_LTX__mcrypt_get_supported_key_sizes
serpent_LTX__mcrypt_self_test
serpent_LTX__mcrypt_set_key
tripledes_LTX__is_block_algorithm
tripledes_LTX__mcrypt_algorithm_version
tripledes_LTX__mcrypt_decrypt
tripledes_LTX__mcrypt_encrypt
tripledes_LTX__mcrypt_get_algorithms_name
tripledes_LTX__mcrypt_get_block_size
tripledes_LTX__mcrypt_get_key_size
tripledes_LTX__mcrypt_get_size
tripledes_LTX__mcrypt_get_supported_key_sizes
tripledes_LTX__mcrypt_self_test
tripledes_LTX__mcrypt_set_key
twofish_LTX__is_block_algorithm
twofish_LTX__mcrypt_algorithm_version
twofish_LTX__mcrypt_decrypt
twofish_LTX__mcrypt_encrypt
twofish_LTX__mcrypt_get_algorithms_name
twofish_LTX__mcrypt_get_block_size
twofish_LTX__mcrypt_get_key_size
twofish_LTX__mcrypt_get_size
twofish_LTX__mcrypt_get_supported_key_sizes
twofish_LTX__mcrypt_self_test
twofish_LTX__mcrypt_set_key
wake_LTX__is_block_algorithm
wake_LTX__mcrypt_algorithm_version
wake_LTX__mcrypt_decrypt
wake_LTX__mcrypt_encrypt
wake_LTX__mcrypt_get_algo_iv_size
wake_LTX__mcrypt_get_algorithms_name
wake_LTX__mcrypt_get_block_size
wake_LTX__mcrypt_get_key_size
wake_LTX__mcrypt_get_size
wake_LTX__mcrypt_get_supported_key_sizes
wake_LTX__mcrypt_self_test
wake_LTX__mcrypt_set_key
xtea_LTX__is_block_algorithm
xtea_LTX__mcrypt_algorithm_version
xtea_LTX__mcrypt_decrypt
xtea_LTX__mcrypt_encrypt
xtea_LTX__mcrypt_get_algorithms_name
xtea_LTX__mcrypt_get_block_size
xtea_LTX__mcrypt_get_key_size
xtea_LTX__mcrypt_get_size
xtea_LTX__mcrypt_get_supported_key_sizes
xtea_LTX__mcrypt_self_test
xtea_LTX__mcrypt_set_key

Sections

.text
Size: 383KB - Virtual size: 383KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4586b951eca1f9c726d086b6bab97b82

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

urlmon

wininet

version

crypt32

gdi32

shell32

psapi

Exports

Exports

Sections

.text Size: 383KB - Virtual size: 383KB

.rdata Size: 115KB - Virtual size: 115KB

.data Size: 19KB - Virtual size: 50KB

.rsrc Size: 9KB - Virtual size: 9KB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 383KB - Virtual size: 383KB

.rdata
Size: 115KB - Virtual size: 115KB

.data
Size: 19KB - Virtual size: 50KB

.rsrc
Size: 9KB - Virtual size: 9KB

.reloc
Size: 31KB - Virtual size: 30KB