NEAS[.]4540370befcbadfb3586123c45a640b0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4540370befcbadfb3586123c45a640b0.exe
Size

56KB
MD5

4540370befcbadfb3586123c45a640b0
SHA1

0bdbdea924ae7db1d30cb7c4c34127e7b892050a
SHA256

b8e3676d3a16b72d4265b1dbbabdf6574fe293822351d8cf1faf42dc7993241b
SHA512

96bf469cc10a80404ddbb2fb8e1feeb1003972fb16558772d1232219ac44f7521be58b1447404c3bb29ee9a8d19f111581ebdf41318dc22a46571c580d1ea3b3
SSDEEP

1536:KOhOiy/wCq4eppJT8CAsO4D+uSDvIloQk:KOhs/wZpushh+gl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4540370befcbadfb3586123c45a640b0.exe

Files

NEAS.4540370befcbadfb3586123c45a640b0.exe
.dll windows:4 windows x86

e22523b9fbb194d82e70e5d8b1a79821

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetEvent
GetTickCount
WaitForMultipleObjects
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LockResource
SizeofResource
LoadResource
FindResourceA
WaitForSingleObject
ResetEvent
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
TerminateThread
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
ResumeThread
CloseHandle
CreateEventA
lstrcpyA
IsBadReadPtr
SetUnhandledExceptionFilter
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsBadWritePtr
HeapReAlloc
RtlUnwind
HeapFree
HeapAlloc
GetLastError
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
GetCommandLineA
GetVersion
TlsAlloc
TlsFree
SetLastError
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
VirtualAlloc

user32

ShowWindow
CreateWindowExA
CopyRect
RegisterClassExA
GetSysColorBrush
LoadCursorA
DefWindowProcA
DispatchMessageA
IsWindow
TranslateMessage
GetMessageA
MsgWaitForMultipleObjects
ClientToScreen
SendMessageA
EnableWindow
SetWindowLongA
UnregisterClassA
DestroyWindow
GetWindowLongA

gdi32

GetStockObject

comdlg32

GetSaveFileNameA

ole32

CoInitialize

dsound

ord6
ord7
ord11

winmm

mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
mixerSetControlDetails
timeGetTime
mmioClose
mmioOpenA
mmioAscend
mmioRead
mmioDescend
mmioGetInfo
mmioCreateChunk
mmioSeek
mmioSetInfo
mmioWrite
mixerClose
mmioAdvance

Exports

Exports

??0IRemote_Plug_WorkBase@@QAE@ABV0@@Z
??0IRemote_Plug_WorkBase@@QAE@XZ
??4IRemote_Plug_WorkBase@@QAEAAV0@ABV0@@Z
??_7IRemote_Plug_WorkBase@@6B@
ApiClientAddRemoteAudioBuf
ApiClientInitRemoteAudio
ApiClientRemoteUnitAudio
ApiOpenClientAudioOpert
ApiRemoteCmdAudio
ApiRemoteInitAudio
ApiRemoteUnitAudio
CreatePlug
GetOsVersion
ReleasePlug

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e22523b9fbb194d82e70e5d8b1a79821

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

ole32

dsound

winmm

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 32KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 36KB - Virtual size: 32KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 3KB