NEAS[.]604d9510c8fd30c5d26c4aa06f12dc60[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.604d9510c8fd30c5d26c4aa06f12dc60.exe
Size

256KB
MD5

604d9510c8fd30c5d26c4aa06f12dc60
SHA1

7fa1ad8ac1722d3b9bd75df2926d35dca4f7d675
SHA256

9fd4e64c5ed8713c94a7709b5110d85b417e374276ad025c8106d564e18d44a1
SHA512

ffbf5e4599dfd366c6fecc011a5a081f0675d9fd4c78375cdebbe1c331d61683816bea0564e5bd368039194dc5856bece0d1cc328f862f1ab9cb9b91618381ba
SSDEEP

6144:d0WzvVb0M0PWT+CsQORHb6AtXXow+sDYoiH3YwzsVat:d0WzvVRNsBHb6AN8oiH3Y7at

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.604d9510c8fd30c5d26c4aa06f12dc60.exe

Files

NEAS.604d9510c8fd30c5d26c4aa06f12dc60.exe
.exe windows:4 windows x86

4fe86ed1c7d97e4619b3475dc2db5c20

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_iob
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
_abnormal_termination
_ftime
_endthreadex
_beginthreadex
__CxxFrameHandler
_except_handler3
sprintf
isdigit
calloc
fprintf
printf
perror
_errno
strerror
fflush
sscanf
wcstombs
mbstowcs
wcscpy
strcat
toupper
fputc
wcscat
strtok
_ftol
__p__commode
srand
fwrite
fseek
ftell
malloc
free
exit
strncmp
atof
memcmp
strchr
strncat
_memccpy
_itoa
_stricmp
system
atoi
strcpy
fgets
fopen
fread
strcmp
fclose
memmove
memcpy
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_vsnprintf
strlen
strncpy
memset
strstr
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
__p__fmode
__set_app_type
_controlfp
rand
_strdup

msvcp60

?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ

kernel32

SetEvent
GetStartupInfoA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
TlsGetValue
SetLastError
TlsFree
TlsAlloc
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcessId
SetThreadPriority
GetProcessAffinityMask
RaiseException
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
WaitForMultipleObjects
CreateEventA
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
DuplicateHandle
InterlockedIncrement
GetThreadPriority
EnterCriticalSection
LeaveCriticalSection
SuspendThread
GetThreadContext
SetThreadContext
ResumeThread
WaitForSingleObject
ResetEvent
InterlockedDecrement
TransactNamedPipe
MultiByteToWideChar
GetLastError
CopyFileA
GetModuleFileNameA
OpenProcess
GetModuleHandleA
FreeConsole
AllocConsole
GetStdHandle
WriteFile
CreateNamedPipeA
WaitNamedPipeA
CreateFileA
TerminateProcess
CloseHandle
ReadFile
GetTickCount
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteFileA
ExitProcess
GetSystemDirectoryA
CreateProcessA
ExpandEnvironmentStringsA
GetComputerNameA
GetVersionExA
GlobalMemoryStatus

user32

ExitWindowsEx
wsprintfA

advapi32

OpenSCManagerA
RegCloseKey
RegQueryValueExA
RegQueryInfoKeyA
RegEnumKeyExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
OpenServiceA
DeleteService
ControlService
RegSetValueExA
CreateServiceA
CloseServiceHandle
ChangeServiceConfig2A
RegCreateKeyExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegOpenKeyExA
RegDeleteValueA

shell32

ShellExecuteA

ws2_32

gethostname
sendto
htonl
setsockopt
WSASocketA
ntohl
WSASetLastError
WSAIoctl
getservbyname
shutdown
ntohs
gethostbyaddr
inet_ntoa
gethostbyname
ioctlsocket
getpeername
getsockname
send
connect
WSACleanup
WSAStartup
inet_addr
recv
WSAGetLastError
select
__WSAFDIsSet
accept
bind
listen
closesocket
socket
getsockopt
htons

netapi32

NetUseDel
NetApiBufferFree
NetShareEnum
NetUserEnum
NetScheduleJobAdd
NetRemoteTOD
NetUseAdd

mpr

WNetAddConnection2A
WNetCancelConnection2W
WNetCancelConnection2A
WNetAddConnection2W

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameA

dnsapi

DnsQuery_A

Exports

Exports

pthreadCancelableTimedWait
pthreadCancelableWait
pthread_attr_destroy
pthread_attr_getdetachstate
pthread_attr_getinheritsched
pthread_attr_getschedparam
pthread_attr_getschedpolicy
pthread_attr_getscope
pthread_attr_getstackaddr
pthread_attr_getstacksize
pthread_attr_init
pthread_attr_setdetachstate
pthread_attr_setinheritsched
pthread_attr_setschedparam
pthread_attr_setschedpolicy
pthread_attr_setscope
pthread_attr_setstackaddr
pthread_attr_setstacksize
pthread_barrier_destroy
pthread_barrier_init
pthread_barrier_wait
pthread_barrierattr_destroy
pthread_barrierattr_getpshared
pthread_barrierattr_init
pthread_barrierattr_setpshared
pthread_cancel
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_wait
pthread_condattr_destroy
pthread_condattr_getpshared
pthread_condattr_init
pthread_condattr_setpshared
pthread_create
pthread_delay_np
pthread_detach
pthread_equal
pthread_exit
pthread_getconcurrency
pthread_getschedparam
pthread_getspecific
pthread_getw32threadhandle_np
pthread_join
pthread_key_create
pthread_key_delete
pthread_kill
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_timedlock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_getkind_np
pthread_mutexattr_getpshared
pthread_mutexattr_gettype
pthread_mutexattr_init
pthread_mutexattr_setkind_np
pthread_mutexattr_setpshared
pthread_mutexattr_settype
pthread_num_processors_np
pthread_once
pthread_rwlock_destroy
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_timedrdlock
pthread_rwlock_timedwrlock
pthread_rwlock_tryrdlock
pthread_rwlock_trywrlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_rwlockattr_destroy
pthread_rwlockattr_getpshared
pthread_rwlockattr_init
pthread_rwlockattr_setpshared
pthread_self
pthread_setcancelstate
pthread_setcanceltype
pthread_setconcurrency
pthread_setschedparam
pthread_setspecific
pthread_spin_destroy
pthread_spin_init
pthread_spin_lock
pthread_spin_trylock
pthread_spin_unlock
pthread_testcancel
pthread_timechange_handler_np
pthread_win32_process_attach_np
pthread_win32_process_detach_np
pthread_win32_thread_attach_np
pthread_win32_thread_detach_np
ptw32_get_exception_services_code
ptw32_pop_cleanup
ptw32_push_cleanup
sched_get_priority_max
sched_get_priority_min
sched_getscheduler
sched_setscheduler
sched_yield
sem_close
sem_destroy
sem_getvalue
sem_init
sem_open
sem_post
sem_post_multiple
sem_timedwait
sem_trywait
sem_unlink
sem_wait

Sections

.text
Size: 164KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fuzi
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4fe86ed1c7d97e4619b3475dc2db5c20

Headers

File Characteristics

Imports

msvcrt

msvcp60

kernel32

user32

advapi32

shell32

ws2_32

netapi32

mpr

psapi

dnsapi

Exports

Exports

Sections

.text Size: 164KB - Virtual size: 160KB

.rdata Size: 28KB - Virtual size: 25KB

.data Size: 44KB - Virtual size: 59KB

.fuzi Size: 16KB - Virtual size: 16KB

.text
Size: 164KB - Virtual size: 160KB

.rdata
Size: 28KB - Virtual size: 25KB

.data
Size: 44KB - Virtual size: 59KB

.fuzi
Size: 16KB - Virtual size: 16KB