NEAS[.]6f719b6dcf3783816e398b8e395d96a0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.6f719b6dcf3783816e398b8e395d96a0.exe
Size

52KB
MD5

6f719b6dcf3783816e398b8e395d96a0
SHA1

f07de1db6f0c269245d7d008e5a4a1a8fc5578c9
SHA256

881effb70ca788a1a27eb4bcd560963e904a910f14a9762c844a59768841b90a
SHA512

14f9591a42015c8e2cfc0653bc59d53e1565a59b28136a3ab1766f8129632a4492268b89f6c8099155246243991eda5802449a6cc8b2cfdc1d5cfc30a9d907ac
SSDEEP

768:f8feHTTKolQpHBu8KFXA2nO+q7qWcEzlLindh:JTTKIGEtNnOj+6lLindh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6f719b6dcf3783816e398b8e395d96a0.exe

Files

NEAS.6f719b6dcf3783816e398b8e395d96a0.exe
.dll windows:4 windows x86

fc1b8c1796408fbe1ccf0170932bc354

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateProcessA
GetEnvironmentVariableA
Sleep
WinExec
FindClose
FindFirstFileA
ReadFile
VirtualAlloc
WaitForSingleObject
GetModuleFileNameA
HeapAlloc
LoadLibraryA
WideCharToMultiByte
GetLocalTime
lstrlenW
GlobalAlloc
GetSystemDirectoryA
lstrcatA
CreateFileA
SetFilePointer
lstrlenA
WriteFile
GetLastError
GlobalFree
VirtualProtect
GetModuleHandleA
GetProcAddress
CreateThread
GetFileSize
CloseHandle
InterlockedIncrement
InterlockedDecrement
LCMapStringW
LCMapStringA
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
HeapReAlloc

user32

wsprintfW
GetAsyncKeyState
MessageBoxA
wsprintfA

advapi32

RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey

ws2_32

closesocket
gethostbyname
WSASocketA
htons
WSAStartup
WSACleanup
connect

Exports

Exports

EventLogon
EventStartup

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc1b8c1796408fbe1ccf0170932bc354

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 20KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 944B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 24KB - Virtual size: 20KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 944B

.reloc
Size: 4KB - Virtual size: 3KB