NEAS[.]d6cd7c5c8211ca2c691f405e116598c0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d6cd7c5c8211ca2c691f405e116598c0.exe
Size

1.4MB
MD5

d6cd7c5c8211ca2c691f405e116598c0
SHA1

e42801a298c66606a084a3ee9d521be1600ee076
SHA256

31a814faeacacf13466fb005c80916af936f67ca6a9717a973c87a43e0b7778c
SHA512

8f77ee1c630c3d50796805bdb3021f9d7ccba47db469f40c6421564aafa00e84c80c7a25a11855313ba2e33dbfa1a6d1862d3b2c0f2515cc4cfac3ab7ed856b5
SSDEEP

24576:PK7CsTTUeD0FlZDXlhGtde8MebtD9syw7kc0MFAuG/ot62IcDHhZW7e:PK7DFD0FlZblctde8Mezsy+x0MFA662h

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d6cd7c5c8211ca2c691f405e116598c0.exe

Files

NEAS.d6cd7c5c8211ca2c691f405e116598c0.exe
.dll windows:4 windows x86

b7ee883a37d395fb0468297d74d28f48

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemInfo
SetEvent
WaitForSingleObject
CreateEventW
FindClose
FindFirstFileW
CloseHandle
GetLastError
CreateFileW
FormatMessageA
LockFileEx
WriteFile
ReadFile
SetFilePointer
GetCurrentThreadId
SetEndOfFile
UnlockFile
WideCharToMultiByte
MultiByteToWideChar
Sleep
lstrcpynW
GetFileAttributesW
FindNextFileW
ResumeThread
SetThreadPriority
GetThreadPriority
GetCurrentThread
CreateThread
DeleteFileW
FreeLibrary
GetVersionExA
LoadLibraryA
DeviceIoControl
GetLocalTime
GlobalMemoryStatus
GetDiskFreeSpaceA
GetComputerNameA
LocalAlloc
InterlockedDecrement
InterlockedIncrement
LocalFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
LoadLibraryW
HeapAlloc
HeapFree
GetTempPathA
GetTempFileNameA
CreateProcessA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
VirtualProtect
RaiseException

ole32

CoTaskMemFree
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoCreateInstance

msvcr80

_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
fopen_s
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
sscanf
vsprintf_s
wcscpy_s
vswprintf_s
wcsrchr
floor
_wtof
towlower
_wcsdup
clock
_time64
_localtime64
atof
iswdigit
??0exception@std@@QAE@ABQBDH@Z
_beginthreadex
??4exception@std@@QAEAAV01@ABV01@@Z
_vsnwprintf
_wtoi
_ftime64
strncat
_wmkdir
iswspace
iswalpha
towupper
_snprintf
_itoa
wcsncpy
strncpy
fsetpos
strtok
mbstowcs
isdigit
fgets
ftell
_fileno
_setmode
strchr
setvbuf
wcschr
fseek
_wfopen
sprintf
wcstombs
??_U@YAPAXI@Z
memmove_s
??2@YAPAXI@Z
??_V@YAXPAX@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_vsnprintf
ferror
strerror
_errno
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_CIsqrt
_CIsin
fopen
?terminate@@YAXXZ
_wcsnicmp
_wcsicmp
free
malloc
printf
memset
exit
isspace
fgetc
fprintf
vfprintf
ungetc
fscanf
fclose
atoi
strncmp
memcpy
feof
_CIlog10
qsort
memmove
_CIlog
_CIpow
_CIexp
_CIcos
fwrite
fread
__iob_func
fflush
fwprintf_s

msvcp80

??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?_Xlen@_String_base@std@@SAXXZ
?_Xran@_String_base@std@@SAXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

psrchlts

?GetPronunciation@@YGJPB_WPAPAPAPAH@Z
?DeleteResultBuffer@@YGJPAPAPAH@Z
?InitLTS@@YGJPB_W00PAPB_WH@Z
?FreeLTS@@YGJXZ

psrchfea

?NEW_FrontEndSAPI@@YGPAUIRawFrontEnd@@XZ

powrprof

CallNtPowerInformation

Exports

Exports

??0CIndexManager@AudioSearchAPI@MSRA@@QAE@ABUCONFIG@012@@Z
??0CIndexManagerImpl@AudioSearchAPI@MSRA@@QAE@ABUCONFIG@CIndexManager@12@@Z
??0CIndexingSession@AudioSearchAPI@MSRA@@QAE@AAVCIndexManager@12@AAUIIndexingSessionNotify@12@@Z
??0CIndexingSessionImpl@AudioSearchAPI@MSRA@@QAE@AAVCIndexManager@12@AAUIIndexingSessionNotify@12@@Z
??0CQuery@AudioSearchAPI@MSRA@@QAE@ABVCIndexManager@12@@Z
??0CQueryImpl@AudioSearchAPI@MSRA@@QAE@ABVCIndexManager@12@@Z
??0CQuickTimeStream@AIME@MSRA@@QAE@XZ
??0CRetrievalSession@AudioSearchAPI@MSRA@@QAE@ABVCIndexManager@12@AAUIRetrievalSessionNotify@12@@Z
??0CRetrievalSessionImpl@AudioSearchAPI@MSRA@@QAE@ABVCIndexManager@12@AAUIRetrievalSessionNotify@12@@Z
??0EXCEPTION@AudioSearchAPI@MSRA@@QAE@PBDJPB_W0@Z
??0IIndexingSession@AudioSearchAPI@MSRA@@QAE@XZ
??0IQuery@AudioSearchAPI@MSRA@@QAE@XZ
??0IRetrievalSession@AudioSearchAPI@MSRA@@QAE@XZ
??1CIndexManager@AudioSearchAPI@MSRA@@QAE@XZ
??1CIndexingSession@AudioSearchAPI@MSRA@@QAE@XZ
??1CQuery@AudioSearchAPI@MSRA@@QAE@XZ
??1CQuickTimeStream@AIME@MSRA@@QAE@XZ
??1CRetrievalSession@AudioSearchAPI@MSRA@@QAE@XZ
??4CQuery@AudioSearchAPI@MSRA@@QAEAAV012@ABV012@@Z
??4CQueryImpl@AudioSearchAPI@MSRA@@QAEAAUIQuery@12@ABU312@@Z
??4CQuickTimeStream@AIME@MSRA@@QAEAAV012@ABV012@@Z
??8CQuery@AudioSearchAPI@MSRA@@QBE_NABV012@@Z
??8CQueryImpl@AudioSearchAPI@MSRA@@QBE_NABUIQuery@12@@Z
?BindToFile@CQuickTimeStream@AIME@MSRA@@QAEJPB_W@Z
?Close@CQuickTimeStream@AIME@MSRA@@QAEJXZ
?CopyQuery@AudioSearchAPI@MSRA@@YGXABUIQuery@12@AAU312@@Z
?CreateIndexManagerImpl@AudioSearchAPI@MSRA@@YGPAVCIndexManagerImpl@12@ABUCONFIG@CIndexManager@12@@Z
?CreateIndexingSessionImpl@AudioSearchAPI@MSRA@@YGPAUIIndexingSession@12@AAVCIndexManager@12@AAUIIndexingSessionNotify@12@@Z
?CreateQueryImpl@AudioSearchAPI@MSRA@@YGPAUIQuery@12@ABVCIndexManager@12@@Z
?CreateRetrievalSessionImpl@AudioSearchAPI@MSRA@@YGPAUIRetrievalSession@12@ABVCIndexManager@12@AAUIRetrievalSessionNotify@12@@Z
?GetCurrentPosition@CQuickTimeStream@AIME@MSRA@@QAENXZ
?GetDuration@CQuickTimeStream@AIME@MSRA@@QAENXZ
?GetFormat@CQuickTimeStream@AIME@MSRA@@QAEJPAUtWAVEFORMATEX@@@Z
?GetProgress@CQuickTimeStream@AIME@MSRA@@QAEIXZ
?IsQueryEqual@AudioSearchAPI@MSRA@@YG_NABUIQuery@12@0@Z
?Read@CQuickTimeStream@AIME@MSRA@@QAEJPAXKPAKH@Z
?ReleaseIndexingSessionImpl@AudioSearchAPI@MSRA@@YGXPAUIIndexingSession@12@@Z
?ReleaseQueryImpl@AudioSearchAPI@MSRA@@YGXPAUIQuery@12@@Z
?ReleaseRetrievalSessionImpl@AudioSearchAPI@MSRA@@YGXPAUIRetrievalSession@12@@Z
?addAudioFile@CIndexingSession@AudioSearchAPI@MSRA@@UAE_NQB_WPB_W1@Z
?addIndexedAudioFile@CIndexingSession@AudioSearchAPI@MSRA@@UAE_NQB_WPB_W1@Z
?buildIndexedAudioFile@CIndexingSession@AudioSearchAPI@MSRA@@UAEXPB_W0@Z
?cancel@CIndexingSession@AudioSearchAPI@MSRA@@UAEXXZ
?cancel@CRetrievalSession@AudioSearchAPI@MSRA@@UAEXXZ
?clearIndex@CIndexingSession@AudioSearchAPI@MSRA@@UAEXXZ
?deleteIndex@CIndexingSession@AudioSearchAPI@MSRA@@UAEXXZ
?documentExists@CIndexingSession@AudioSearchAPI@MSRA@@UAEHQB_W@Z
?freeDocumentSet@CIndexingSession@AudioSearchAPI@MSRA@@UAEXPBUDOCUMENT_IN_INDEX@23@@Z
?get@CQuery@AudioSearchAPI@MSRA@@UBEPB_WH@Z
?getDocumentSet@CIndexingSession@AudioSearchAPI@MSRA@@UAEXAAPBUDOCUMENT_IN_INDEX@23@AAH@Z
?getIndexedAudioFile@CIndexingSession@AudioSearchAPI@MSRA@@UBEXPB_W0PA_WH@Z
?getNumTerms@CQuery@AudioSearchAPI@MSRA@@UBEHXZ
?getOperator@CQuery@AudioSearchAPI@MSRA@@UBE?AW4QUERY_OPERATOR@23@XZ
?getPhonetic@CQuery@AudioSearchAPI@MSRA@@UBEHHPA_WH@Z
?getStatistics@CIndexingSession@AudioSearchAPI@MSRA@@UAEXAAHAAM@Z
?go@CRetrievalSession@AudioSearchAPI@MSRA@@UAEXXZ
?goAndWait@CRetrievalSession@AudioSearchAPI@MSRA@@UAEXXZ
?registerAudioFile@CIndexingSession@AudioSearchAPI@MSRA@@UAEXQB_WPB_W1@Z
?remove@CIndexingSession@AudioSearchAPI@MSRA@@UAEXPB_W@Z
?set@CQuery@AudioSearchAPI@MSRA@@UAEXPAPB_WHW4QUERY_OPERATOR@23@@Z
?set@CQuery@AudioSearchAPI@MSRA@@UAEXPB_W@Z
?setError@FILELISTENTRY@CRetrievalSessionImpl@AudioSearchAPI@MSRA@@QAEXAAUEXCEPTION@34@@Z
?setLimits@CRetrievalSession@AudioSearchAPI@MSRA@@UAE?AULIMITS@23@ABU423@@Z
?setQuery@CRetrievalSession@AudioSearchAPI@MSRA@@UAEXABVCQuery@23@@Z
?setQuery@CRetrievalSessionImpl@AudioSearchAPI@MSRA@@UAEXABVCQuery@23@@Z
?setResolution@CRetrievalSession@AudioSearchAPI@MSRA@@UAE?AW4RESOLUTION@23@W4423@@Z
?setScope@CRetrievalSession@AudioSearchAPI@MSRA@@UAEXPBUSCOPE_DOCUMENT@23@HPBQB_WH@Z
?wait@CIndexingSession@AudioSearchAPI@MSRA@@UAE_NH@Z
?wait@CRetrievalSession@AudioSearchAPI@MSRA@@UAE_NH@Z

Sections

.text
Size: 989KB - Virtual size: 989KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 449KB - Virtual size: 452KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7ee883a37d395fb0468297d74d28f48

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

msvcr80

msvcp80

psrchlts

psrchfea

powrprof

Exports

Exports

Sections

.text Size: 989KB - Virtual size: 989KB

.data Size: 8KB - Virtual size: 115KB

.rsrc Size: 512B - Virtual size: 428B

.reloc Size: 449KB - Virtual size: 452KB

.text
Size: 989KB - Virtual size: 989KB

.data
Size: 8KB - Virtual size: 115KB

.rsrc
Size: 512B - Virtual size: 428B

.reloc
Size: 449KB - Virtual size: 452KB