NEAS[.]607ab124ba5026ec1d4412d14cf5fad0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.607ab124ba5026ec1d4412d14cf5fad0.exe
Size

2.2MB
MD5

607ab124ba5026ec1d4412d14cf5fad0
SHA1

d09e11cb19fff75c398de22b489617edc96d7529
SHA256

11ec792c4d070a70b519ea444192d493e22ee44bb1e72165ad1b43c7b773fac7
SHA512

3373e45b2e5b095671871ebce6943e957541d36a2cfdd7f4161ad8d9ca9a792b63bbf0a77994f9f621c139fa52e000635f8ead6ab475edab704a6d9dc2a0868a
SSDEEP

49152:zUIG7t76PldCPuxtrKCWuNGmmtw+4StzVFt6Cj+SRtSnmGdNfDUa:PG7eEuxFKCnNGmYHP6s+2tSnBNQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.607ab124ba5026ec1d4412d14cf5fad0.exe

Files

NEAS.607ab124ba5026ec1d4412d14cf5fad0.exe
.dll windows:5 windows x86

d43b714311961723a574cf9134a38307

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetModuleHandleA
GetBinaryTypeW
OpenFile
TlsFree
GetModuleFileNameW
GetModuleFileNameA
SetEvent
InterlockedFlushSList
WaitForSingleObject
GetProcAddress
WaitForSingleObjectEx

ole32

CreateILockBytesOnHGlobal

setupapi

SetupDiClassNameFromGuidExA

winmm

midiOutReset

rpcrt4

RpcMgmtSetCancelTimeout

mprapi

MprAdminTransportGetInfo

user32

UnpackDDElParam
ScrollDC
PostQuitMessage
RegisterClassA

gdi32

OffsetWindowOrgEx
ScaleWindowExtEx
CreateCompatibleDC
StretchDIBits

advapi32

CryptSetProviderExW

shell32

DragQueryFileW
SHGetFolderPathAndSubDirW
DoEnvironmentSubstW

urlmon

CoInternetIsFeatureEnabledForUrl

Exports

Exports

KhhfyRlpie

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 484KB - Virtual size: 481KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PACK
Size: 252KB - Virtual size: 250KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CODE
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d43b714311961723a574cf9134a38307

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

setupapi

winmm

rpcrt4

mprapi

user32

gdi32

advapi32

shell32

urlmon

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 42KB

.rdata Size: 484KB - Virtual size: 481KB

.data Size: 76KB - Virtual size: 73KB

PACK Size: 252KB - Virtual size: 250KB

CODE Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 24KB - Virtual size: 21KB

.text
Size: 44KB - Virtual size: 42KB

.rdata
Size: 484KB - Virtual size: 481KB

.data
Size: 76KB - Virtual size: 73KB

PACK
Size: 252KB - Virtual size: 250KB

CODE
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 24KB - Virtual size: 21KB