NEAS[.]81f761c384790ef3434f197bb2084dd0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.81f761c384790ef3434f197bb2084dd0.exe
Size

341KB
MD5

81f761c384790ef3434f197bb2084dd0
SHA1

82b73764b73eef84438b10948dbd34fb1f8de4b0
SHA256

c73b046625903867325b95873f2ecd0b929765a981226ccbd63718ae400f4fb4
SHA512

e6be406d3d27a403861bf93c4e80e63b8bea2e7f9eac41ebceff76fa68259b937bb035a155cabe4f8d4d1654eb8748635360a9020a148301eaf34d3b2ee26b69
SSDEEP

6144:Lf86xbrPpX2hKqCUUBJdk7H9sHJxqzf2wRglGavfuWNk6:LlxbrPpX2otfIKJIawsHuWNk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.81f761c384790ef3434f197bb2084dd0.exe

Files

NEAS.81f761c384790ef3434f197bb2084dd0.exe
.dll windows:6 windows x86

4edcd6d6106398ed32511bf5ba5471b5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SwitchToThread
GetCurrentThreadId
CloseHandle
QueryPerformanceCounter
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
CreateThread
GetSystemTimeAsFileTime
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleA
GetProcAddress
SetCurrentDirectoryA
GetCurrentDirectoryA
EnterCriticalSection
LeaveCriticalSection
Sleep
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetCurrentProcessId

msvcr120

_i64toa_s
_ui64toa_s
_ltoa_s
_ultoa_s
_itow_s
_ltow_s
_ultow_s
_i64tow_s
_ui64tow_s
_makepath_s
_splitpath_s
gets_s
vprintf_s
vsprintf_s
vwprintf_s
memcpy_s
memset
memmove_s
_itoa_s
qsort
log
??3@YAXPAX@Z
strlen
_purecall
__RTDynamicCast
free
malloc
fclose
feof
ferror
fflush
fopen
fread
fseek
ftell
fwrite
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_vsnprintf_s
_except1
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_except_handler4_common
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__clean_type_info_names_internal
strtok_s
__CxxFrameHandler3
_CxxThrowException
_hypot
strcmp

Exports

Exports

BIBGetGetProcAddress
BIBGetVersion
BIBInitialize
BIBInitialize2
BIBInitialize3
BIBInitialize4
BIBLockSmithAssertNoLocksImpl
BIBLockSmithDeleteImpl
BIBLockSmithLockImpl
BIBLockSmithUnlockImpl
BIBTerminate

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 240KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4edcd6d6106398ed32511bf5ba5471b5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr120

Exports

Exports

Sections

.text Size: 65KB - Virtual size: 65KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 240KB - Virtual size: 244KB

.text
Size: 65KB - Virtual size: 65KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 240KB - Virtual size: 244KB