NEAS[.]f7b604e73a735a51ab13100b739bb6a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f7b604e73a735a51ab13100b739bb6a0.exe
Size

445KB
MD5

f7b604e73a735a51ab13100b739bb6a0
SHA1

513ff33580109389ddbed53cf20bd5eca0079eb9
SHA256

a6238f9df6ed660ee4d26a3cf36d5b785753b3e13ee670e5ead7d7283408d76f
SHA512

a9a45f5d1005f8983131c2f7b33f1470e314846be0b2a63cecb391981a7a335912a2b82f208b518f20c59d49014833620ebb3dceb2fccd027472efd65f161e0d
SSDEEP

12288:MWwDMAyGWECoM/53F9ZlQ9Ingv4pCL/HQNTc:xwLyG6/53F9ZlQ9IgvGAHYTc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f7b604e73a735a51ab13100b739bb6a0.exe

Files

NEAS.f7b604e73a735a51ab13100b739bb6a0.exe
.exe windows:6 windows x86

ab464d1142f3ccca9ff61357de50df68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

vcruntime140

__telemetry_main_return_trigger
__telemetry_main_invoke_trigger
strrchr
memcpy
_except_handler4_common
memset

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
_set_fmode
__stdio_common_vsscanf
fgetc
puts
__stdio_common_vsprintf
fwrite
fflush
fclose
fopen
__stdio_common_vfprintf
ftell
fseek
fread

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_initterm
_initterm_e
_seh_filter_exe
_initialize_narrow_environment
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_set_app_type
exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_errno
_exit

api-ms-win-crt-heap-l1-1-0

calloc
realloc
free
_set_new_mode
malloc

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
UnhandledExceptionFilter

Sections

.text
Size: 384KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab464d1142f3ccca9ff61357de50df68

Headers

DLL Characteristics

File Characteristics

Imports

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Sections

.text Size: 384KB - Virtual size: 384KB

.rdata Size: 43KB - Virtual size: 42KB

.data Size: 2KB - Virtual size: 213KB

.gfids Size: 512B - Virtual size: 32B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 384KB - Virtual size: 384KB

.rdata
Size: 43KB - Virtual size: 42KB

.data
Size: 2KB - Virtual size: 213KB

.gfids
Size: 512B - Virtual size: 32B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 13KB - Virtual size: 13KB