NEAS[.]2e6a01fc33a1862c8303b6631daa1ee0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2e6a01fc33a1862c8303b6631daa1ee0.exe
Size

728KB
MD5

2e6a01fc33a1862c8303b6631daa1ee0
SHA1

973eb5057df9c4f9cf1057d6aeba722f50004dd5
SHA256

c23c844811cb8d987968a4b268960697550ba99d831db8dc8a542745d278e512
SHA512

9dbbc0dd03f1757f5467a99481cd64201a746fc653045dd108a81aa8efacb54cebb8ae228044ae2f8ec55c05be539faf1d862aabdda8b35c797ab641f4843913
SSDEEP

12288:7OoIOFip58s4c5+YpycmvDyBYTTpgP+iFj/l3IKauF:7OPOE8s4crpycmWKfpYlj/l3IKa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2e6a01fc33a1862c8303b6631daa1ee0.exe

Files

NEAS.2e6a01fc33a1862c8303b6631daa1ee0.exe
.dll regsvr32 windows:5 windows x86

8688b8a8b330f99164fbc3b4906a4a83

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comctl32

ord17

kernel32

SizeofResource
lstrcmpiA
FindClose
FindFirstFileA
GetFullPathNameA
GetFileAttributesA
CloseHandle
GetExitCodeProcess
WaitForSingleObject
SetEndOfFile
SetFilePointer
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
GetWindowsDirectoryA
GetShortPathNameA
MoveFileExA
DeleteFileA
FindNextFileA
CopyFileA
GetTempFileNameA
IsDBCSLeadByte
InterlockedDecrement
FreeLibrary
FindResourceA
LoadLibraryExA
GetSystemDirectoryA
CreateDirectoryA
RemoveDirectoryA
SetFileAttributesA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DisableThreadLibraryCalls
InterlockedIncrement
GlobalFree
GlobalHandle
LoadLibraryA
GetLongPathNameA
CreateThread
GlobalMemoryStatusEx
GetVersionExA
VerifyVersionInfoA
VerSetConditionMask
GetNativeSystemInfo
LocalFree
CreateProcessA
LocalAlloc
FormatMessageA
WTSGetActiveConsoleSessionId
GetTempPathA
GetLocalTime
OpenProcess
GetSystemWindowsDirectoryA
OutputDebugStringA
GetCurrentProcessId
InterlockedPushEntrySList
HeapFree
CompareStringW
WriteConsoleW
FindResourceW
SetStdHandle
GetStringTypeW
LoadLibraryW
InterlockedExchange
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
CreateFileW
GetFullPathNameW
GetStartupInfoW
SetHandleCount
Sleep
ReadFile
GetConsoleMode
GetConsoleCP
GetCurrentDirectoryW
GetFileType
PeekNamedPipe
GetFileInformationByHandle
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
HeapReAlloc
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
FindFirstFileExW
GetDriveTypeW
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
SetCurrentDirectoryA
GetCurrentDirectoryA
FindFirstFileExA
GetDriveTypeA
GetProcessHeap
LoadResource
LockResource
SetLastError
GetCurrentThreadId
RaiseException
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameA
lstrlenA
MulDiv
lstrcmpA
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
lstrlenW
GetEnvironmentVariableA
GetLastError
SetEnvironmentVariableA
GetLocaleInfoA
GetModuleHandleA
GetProcAddress
WideCharToMultiByte
FlushFileBuffers
FileTimeToLocalFileTime
FileTimeToSystemTime
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualProtect
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
InterlockedCompareExchange

user32

LoadCursorA
wsprintfA
EnableWindow
UnregisterClassA
GetDlgItem
DefWindowProcA
GetActiveWindow
SetWindowTextA
LoadStringA
EndDialog
GetClientRect
LoadBitmapA
GetDlgCtrlID
WaitForInputIdle
SetWindowLongA
GetWindowLongA
CreateWindowExA
SetWindowPos
GetWindow
SetWindowContextHelpId
SendMessageA
MapDialogRect
GetSysColor
CharNextA
MoveWindow
ClientToScreen
ScreenToClient
GetShellWindow
GetWindowThreadProcessId
OpenInputDesktop
CloseDesktop
GetCursorPos
GetWindowRect
SetCursor
DialogBoxIndirectParamA
GetKeyState
UnionRect
PtInRect
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
ShowWindow
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
CreateAcceleratorTableA
RegisterClassExA
GetClassInfoExA
IsWindow
GetDesktopWindow
GetFocus
SetFocus
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcA
DestroyWindow
FillRect
ReleaseCapture
GetClassNameA
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC

gdi32

SetTextColor
SetBkMode
LPtoDP
SetMapMode
CreateDCA
CreateRectRgnIndirect
CreateSolidBrush
BitBlt
CreateCompatibleBitmap
SelectObject
GetObjectA
CreateCompatibleDC
StretchBlt
GetStockObject
DeleteObject
DeleteDC
SaveDC
SetGraphicsMode
ModifyWorldTransform
SetViewportOrgEx
SetWindowOrgEx
GetDeviceCaps
DPtoLP
CreateFontIndirectA
RestoreDC

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CreateStreamOnHGlobal
OleInitialize
CoGetClassObject
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitialize
CreateOleAdviseHolder
OleRegEnumVerbs
CoTaskMemAlloc
OleLockRunning
OleUninitialize
StringFromGUID2
OleRegGetUserType
OleRegGetMiscStatus
WriteClassStm
OleSaveToStream
ReadClassStm
StringFromCLSID

oleaut32

OleCreatePropertyFrame
VariantChangeType
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
LoadTypeLi
SysFreeString
SysStringLen
SysAllocStringLen
SysAllocString
VariantInit
VariantClear
OleCreateFontIndirect
LoadRegTypeLi

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

Exports

Exports

CheckMozJavaPlugins
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IsSSVEnabledInMozilla
RedirectAllStaticVersionKeys
RedirectSelectedStaticVersionKeys
RegKeyBranchNeedsUpdating
RemoveAllMozillaJavaPlugins
RunBrokerProcess
UpdateTreatAsKey

Sections

.text
Size: 219KB - Virtual size: 219KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 285KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8688b8a8b330f99164fbc3b4906a4a83

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

kernel32

user32

gdi32

ole32

oleaut32

version

Exports

Exports

Sections

.text Size: 219KB - Virtual size: 219KB

.rdata Size: 55KB - Virtual size: 55KB

.data Size: 10KB - Virtual size: 18KB

.rsrc Size: 157KB - Virtual size: 156KB

.reloc Size: 285KB - Virtual size: 288KB

.text
Size: 219KB - Virtual size: 219KB

.rdata
Size: 55KB - Virtual size: 55KB

.data
Size: 10KB - Virtual size: 18KB

.rsrc
Size: 157KB - Virtual size: 156KB

.reloc
Size: 285KB - Virtual size: 288KB