NEAS[.]3d17569defb94f3158dfa450883c58a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3d17569defb94f3158dfa450883c58a0.exe
Size

149KB
MD5

3d17569defb94f3158dfa450883c58a0
SHA1

5022b84f6c70e0362dc1702994253405fd4dc2a7
SHA256

698215c5fcc203e4dd1ad2ebdd3b5d2cf1282f04e207c6c57b514a55c37344d2
SHA512

d05a225c0d972efca5effa3b75b4dd6d1aa78a4fee1fb741543234daf0b4f778ffffcbd0dee8f612680915b161606ac7162315f83ddb74e149c453d91581ff4b
SSDEEP

1536:9tafOkQTW+0CebtqMws4CEbid/aaFEfq6uqOAZyo175MGHP0fodMrFkLwlamPCt:9IfER0RbtqxCEed/oyo17W+wodSy5mi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3d17569defb94f3158dfa450883c58a0.exe

Files

NEAS.3d17569defb94f3158dfa450883c58a0.exe
.exe windows:4 windows x86

cf86e404fcc07794d8c84ee6c1abf4dc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathStripPathA
StrStrA

kernel32

CloseHandle
GetLastError
CreateMutexA
GetVersionExA
CreateThread
CreateEventA
WaitForSingleObject
SetEvent
UnmapViewOfFile
WaitForMultipleObjects
MapViewOfFile
CreateFileMappingA
lstrcmpiA
lstrcmpA
GetCurrentProcessId
Sleep
OutputDebugStringA
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
lstrlenA
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
LCMapStringW
LCMapStringA
MultiByteToWideChar
WriteFile
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapReAlloc
FlushFileBuffers
GetProcAddress
FreeLibrary
GetStringTypeW
SetStdHandle
GetStringTypeA
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetModuleFileNameA
ExitProcess
GetVersion
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA

user32

GetRawInputData
FindWindowA
GetAsyncKeyState
GetKeyState
PostMessageA
SendMessageA
MessageBoxA
SendNotifyMessageA
SendInput
AttachThreadInput
SetCursorPos
PostQuitMessage
DestroyWindow
DefWindowProcA
LoadCursorA
RegisterClassExA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
RegisterRawInputDevices
SendMessageTimeoutA

gdi32

GetStockObject

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA

setupapi

SetupDiGetClassDevsA
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

dacjkk
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 88KB - Virtual size: 86KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cf86e404fcc07794d8c84ee6c1abf4dc

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

advapi32

shell32

setupapi

Sections

.text Size: 24KB - Virtual size: 20KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 1KB

dacjkk Size: 8KB - Virtual size: 4KB

Size: 88KB - Virtual size: 86KB

.text
Size: 24KB - Virtual size: 20KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 1KB

dacjkk
Size: 8KB - Virtual size: 4KB