NEAS[.]3d71f69e13389416a76eb5f238c2d540[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3d71f69e13389416a76eb5f238c2d540.exe
Size

2.3MB
MD5

3d71f69e13389416a76eb5f238c2d540
SHA1

c9ad06a65ba5c751bb132bbda9cec9aa04a54e14
SHA256

1109af0889bcd82267a84b9f18d7c2fdda7907815bcab059ab95650e6f185bab
SHA512

af5c389a937abfaf5476b2299af65aac122b6e530a4ceb5503254aea0d11f5c580efe40b5cf86ec2a76b46dd734a9d9ac9807ae8c523e27afdb4886040f1fa63
SSDEEP

24576:GEcKPMuN3QTnRyvzGsWKwGBN9BdT+t4xbSoi/XM11k7RM0Djnibp7TLW/9zgS6Rj:GEbLQTqGTYb9BdT4+ZiIk7RM0D+IYJM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3d71f69e13389416a76eb5f238c2d540.exe

Files

NEAS.3d71f69e13389416a76eb5f238c2d540.exe
.exe windows:6 windows x86

093132ebeea9649ea08af43e911e4381

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupDiEnumDeviceInterfaces
SetupDiOpenDeviceInterfaceRegKey
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceAlias
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

winmm

midiInGetDevCapsA
midiInStop
midiInGetNumDevs
midiInAddBuffer
midiInClose
midiInStart
midiInPrepareHeader
midiInReset
midiInOpen
midiInUnprepareHeader
waveOutOpen
waveOutReset
waveOutClose
waveOutGetDevCapsA
waveOutUnprepareHeader
waveOutGetNumDevs
waveOutGetID
waveOutWrite
waveOutPrepareHeader

ws2_32

freeaddrinfo
recv
select
shutdown
getaddrinfo
closesocket
send
connect
socket
WSAStartup

kernel32

GetWindowsDirectoryA
GetCurrentThread
GetConsoleMode
SetConsoleMode
SetConsoleCtrlHandler
GetSystemInfo
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateThread
IsBadReadPtr
ConnectNamedPipe
PeekNamedPipe
WriteFile
CreateNamedPipeA
ReleaseMutex
CreateMutexA
GetTickCount
CreateFileW
SetThreadPriority
DeviceIoControl
CreateEventA
ResetEvent
SetEvent
Sleep
SetPriorityClass
EnterCriticalSection
GetCurrentProcess
LeaveCriticalSection
InitializeCriticalSection
GetPriorityClass
DeleteCriticalSection
GetModuleFileNameA
GetStdHandle
TerminateProcess
UnmapViewOfFile
GetModuleHandleA
GetLastError
CreateFileA
CloseHandle
CreateFileMappingA
GetCurrentProcessId
MapViewOfFile
GetFileSize
MultiByteToWideChar
GetProcAddress
WideCharToMultiByte
FreeLibrary
HeapFree
HeapAlloc
GetProcessHeap
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
WaitForSingleObject
GetCurrentThreadId
GetVersion
WaitForMultipleObjects

user32

IsWindowVisible
GetDC
ReleaseDC
wsprintfA
GetClientRect

gdi32

StretchDIBits

ole32

PropVariantClear
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitializeEx

advapi32

RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ

vcruntime140

memset
_except_handler4_common
memchr
memcpy
memmove
_CxxThrowException
__current_exception_context
__current_exception
__std_terminate
__std_exception_destroy
__CxxFrameHandler3
strrchr
strchr
strstr
__std_exception_copy

api-ms-win-crt-stdio-l1-1-0

_chsize
tmpfile
fseek
_kbhit
__stdio_common_vfscanf
__stdio_common_vsscanf
_pclose
_popen
_lseeki64
__stdio_common_vsprintf
_ftelli64
fflush
__stdio_common_vswprintf
fread
puts
_set_fmode
_close
_open
fwrite
__acrt_iob_func
rewind
fgets
__p__commode
fputs
fgetc
_write
_fseeki64
__stdio_common_vfprintf
_read
_fileno
_setmode
fclose
_dup
ferror
putchar
fopen
putc

api-ms-win-crt-math-l1-1-0

_CIfmod
round
__setusermatherr
ldexp
frexp
__libm_sse2_exp
_fdopen
llround
modf
__libm_sse2_log
_CItanh
__libm_sse2_log10
__libm_sse2_cos
__libm_sse2_pow
__libm_sse2_sin
lround
__libm_sse2_tan
ceil
log2

api-ms-win-crt-heap-l1-1-0

free
_aligned_malloc
_aligned_free
_set_new_mode
calloc
realloc
_callnewh
malloc

api-ms-win-crt-string-l1-1-0

_strdup
strncat
strtok
iswctype
wcsncpy
isdigit
tolower
isupper
_stricmp
_wcsnicmp
isalnum
_strnicmp
toupper
isspace
strpbrk
strcspn
islower
isalpha
strncmp
strncpy

api-ms-win-crt-convert-l1-1-0

atoi
atol
strtoul
strtod
atof
strtol

api-ms-win-crt-runtime-l1-1-0

_set_errno
_errno
strerror
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_controlfp_s
_c_exit
exit
__p___argv
__p___argc
_beginthreadex
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_atexit
abort
_endthread
_register_onexit_function
signal
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-utility-l1-1-0

srand
rand
qsort
bsearch

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_findclose
_findnext64i32
_unlink
_findfirst64i32

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-conio-l1-1-0

_getch

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 238KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 43.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

093132ebeea9649ea08af43e911e4381

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

winmm

ws2_32

kernel32

user32

gdi32

ole32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-conio-l1-1-0

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 238KB - Virtual size: 238KB

.data Size: 42KB - Virtual size: 43.5MB

_RDATA Size: 140KB - Virtual size: 139KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 127KB - Virtual size: 127KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 238KB - Virtual size: 238KB

.data
Size: 42KB - Virtual size: 43.5MB

_RDATA
Size: 140KB - Virtual size: 139KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 127KB - Virtual size: 127KB