NEAS[.]0013bf4403bc968c713b43a4278e3000[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0013bf4403bc968c713b43a4278e3000.exe
Size

453KB
MD5

0013bf4403bc968c713b43a4278e3000
SHA1

5afc7a8e865b474c1a8a3afe69d7adedf778e91c
SHA256

175f0ce757aadc949e71a442d3554d01df8336a82caddac28bfacb72236a7ae5
SHA512

5f317c2acd8268266884886075334fe0120141fe61fc689424796bd9db90ea3ed21905de69727964e02e026e13603a47e70d71075515395a9722b7785e386204
SSDEEP

6144:VnqrrUu3Z8Je2QL3iJGeYnmFOfox8J5KUJprO3NgdVB1BvjitsuVHfn6:Vn5LJe2hJGG+oxm5KUJpCmDXBv2+K/n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0013bf4403bc968c713b43a4278e3000.exe

Files

NEAS.0013bf4403bc968c713b43a4278e3000.exe
.exe windows:6 windows x86

ace9079c3d3eb02f9d7e43d91faea8e8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

CloseServiceHandle
OpenSCManagerA
OpenServiceW
QueryServiceStatus
QueryServiceConfigW
ChangeServiceConfigW
StartServiceW
EnumDependentServicesW
ControlService
CreateServiceW
DeleteService
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
ChangeServiceConfig2W
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetServiceObjectSecurity
RegDeleteKeyA
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExW
RegEnumValueW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
GetTokenInformation
RegQueryValueExW
RegEnumKeyW

kernel32

HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetSystemTime
GetTempPathW
CreateFileW
Sleep
WriteFile
LoadLibraryW
GetProcAddress
FreeLibrary
GetLocaleInfoW
SetThreadUILanguage
GetUserDefaultLCID
GetSystemDefaultLCID
ConvertDefaultLocale
GetConsoleOutputCP
GetFileAttributesW
HeapSize
CloseHandle
GetCurrentProcess
LocalFree
GetModuleHandleA
lstrcmpiA
IsDBCSLeadByte
WideCharToMultiByte
LeaveCriticalSection
RaiseException
EnterCriticalSection
FindResourceA
LoadLibraryExA
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
DecodePointer
EncodePointer
GetModuleHandleW
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
IsWow64Process
GetVersionExW
GetSystemDirectoryW
CreateProcessW
WaitForSingleObject
GetStdHandle
GetFileType
GetConsoleMode
WriteConsoleW
lstrlenW
GetEnvironmentVariableW
GetVersion
ReadFile
FlushFileBuffers
SetStdHandle
LCMapStringW
SetFilePointerEx
GetConsoleCP
OutputDebugStringW
RtlUnwind
GetStringTypeW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
HeapDestroy
MultiByteToWideChar
GetFullPathNameW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetOEMCP
GetCommandLineA
GetFileAttributesExW
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualQuery
IsDebuggerPresent
IsProcessorFeaturePresent
SetLastError
GetCurrentThreadId
ExitProcess
GetModuleHandleExW
InitializeCriticalSectionEx
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
ReadConsoleW

ole32

CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
VariantChangeType
SysStringLen
VarUI4FromStr
GetErrorInfo
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen

user32

CharNextA
LoadStringW

httpapi

HttpSetServiceConfiguration
HttpDeleteServiceConfiguration
HttpTerminate
HttpQueryServiceConfiguration
HttpInitialize

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 269KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ace9079c3d3eb02f9d7e43d91faea8e8

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

ole32

oleaut32

user32

httpapi

version

Sections

.text Size: 171KB - Virtual size: 170KB

.data Size: 5KB - Virtual size: 12KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 269KB - Virtual size: 272KB

.text
Size: 171KB - Virtual size: 170KB

.data
Size: 5KB - Virtual size: 12KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 269KB - Virtual size: 272KB