NEAS[.]87732d3805ea6d18171a9f459dd32430[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.87732d3805ea6d18171a9f459dd32430.exe
Size

94KB
MD5

87732d3805ea6d18171a9f459dd32430
SHA1

ac2602fdca3f46f13393fc57b99040b1c1c0f1f3
SHA256

38ab67474cff61f0a8439e2a10e2e04ce0231e0948fba0ce75da26272d803946
SHA512

fbd9bfa7456ba9210e19427366d535f5b7c70d03393025b4968fd54fff88b8c6e9bbcaf4296b1a6e7ac328cfbfaf6a9e2114999a9e73327d5ac7c0aef7242002
SSDEEP

1536:NX3X3VRofAf+KBxdK3MO9esIXq9eFHUAf9HeIMTWmg9Ppki6EPAyVF:NX3X3VR+mlHk3MO9caMFHt1BWg9RkkBz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.87732d3805ea6d18171a9f459dd32430.exe

Files

NEAS.87732d3805ea6d18171a9f459dd32430.exe
.dll windows:6 windows x64

22625abe73325738490f37951899a7d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

factorygame-core

?GCoreObjectArrayForDebugVisualizers@@3PEAVFChunkedFixedUObjectArray@@EA
?GCoreComplexObjectPathDebug@@3PEAUFStoredObjectPath@Private@CoreUObject@UE@@EA
?GCoreObjectHandlePackageDebug@@3PEAUFObjectHandlePackageDebugData@Private@CoreUObject@UE@@EA
?IsEnsureAllowed@FGenericPlatformMisc@@SA_NXZ
?IsDebuggerPresent@FWindowsPlatformMisc@@SA_NXZ
?PromptForRemoteDebugging@FWindowsPlatformMisc@@SAX_N@Z
?CheckVerifyFailedImpl@FDebug@@SAXPEBD0HPEAXPEB_WZZ
?OptionallyLogFormattedEnsureMessageReturningFalseImpl@FDebug@@CA_N_NPEBD1HPEAXPEB_WZZ
?Malloc@FMemory@@SAPEAX_KI@Z
?Free@FMemory@@SAXPEAX@Z
??0FString@@QEAA@XZ
??4FString@@QEAAAEAV0@AEBV0@@Z
??1FString@@QEAA@XZ
?GetBlocks@FNameDebugVisualizer@@SAPEAPEAEXZ
?GIgnoreDebugger@@3_NA

factorygame-coreuobject

?ConstructUScriptStruct@UECodeGen_Private@@YAXAEAPEAVUScriptStruct@@AEBUFStructParams@1@@Z
?ConstructUPackage@UECodeGen_Private@@YAXAEAPEAVUPackage@@AEBUFPackageParams@1@@Z
?GetStaticStruct@@YAPEAVUScriptStruct@@P6APEAV1@XZPEAVUObject@@PEB_W@Z
?RegisterCompiledInInfo@@YAXP6APEAVUPackage@@XZPEB_WAEAU?$TRegistrationInfo@VUPackage@@UFPackageReloadVersionInfo@@@@AEBUFPackageReloadVersionInfo@@@Z
?RegisterCompiledInInfo@@YAXPEB_WPEBUFClassRegisterCompiledInInfo@@_KPEBUFStructRegisterCompiledInInfo@@2PEBUFEnumRegisterCompiledInInfo@@2@Z
??0ICppStructOps@UScriptStruct@@QEAA@HH@Z
??1ICppStructOps@UScriptStruct@@UEAA@XZ
?HasGetTypeHash@ICppStructOps@UScriptStruct@@QEBA_NXZ
?Z_Construct_UScriptStruct_FGuid@@YAPEAVUScriptStruct@@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception
__std_type_info_destroy_list
__C_specific_handler
__current_exception_context
memset
memcpy

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_cexit
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
terminate
_initialize_onexit_table

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
QueryPerformanceCounter

Exports

Exports

??$StaticStruct@UFSessionServiceLog@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFSessionServiceLogSubscribe@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFSessionServiceLogUnsubscribe@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFSessionServicePing@@@@YAPEAVUScriptStruct@@XZ
??$StaticStruct@UFSessionServicePong@@@@YAPEAVUScriptStruct@@XZ
?StaticStruct@FSessionServiceLog@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FSessionServiceLogSubscribe@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FSessionServiceLogUnsubscribe@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FSessionServicePing@@SAPEAVUScriptStruct@@XZ
?StaticStruct@FSessionServicePong@@SAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FSessionServiceLog@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FSessionServiceLogSubscribe@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FSessionServiceLogUnsubscribe@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FSessionServicePing@@YAPEAVUScriptStruct@@XZ
?Z_Construct_UScriptStruct_FSessionServicePong@@YAPEAVUScriptStruct@@XZ
InitializeModule

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.uedbg
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 468B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

22625abe73325738490f37951899a7d4

Headers

DLL Characteristics

File Characteristics

Imports

factorygame-core

factorygame-coreuobject

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 13KB - Virtual size: 13KB

.uedbg Size: 4KB - Virtual size: 3KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 1024B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 59KB - Virtual size: 58KB

.reloc Size: 512B - Virtual size: 468B

.text
Size: 13KB - Virtual size: 13KB

.uedbg
Size: 4KB - Virtual size: 3KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 1024B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 59KB - Virtual size: 58KB

.reloc
Size: 512B - Virtual size: 468B