NEAS[.]ef477585b25ad3d0a652dbebbc1dfb90[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ef477585b25ad3d0a652dbebbc1dfb90.exe
Size

858KB
MD5

ef477585b25ad3d0a652dbebbc1dfb90
SHA1

91cfa60b59688fa21133618b91eee6f737023a09
SHA256

6cba16dee5fc6606d6bba5ce1d844930ccbc85a60f094e38c2bc6d98081388c3
SHA512

f7b6344b4e62ac503c6f2a5db6051053a72352cce59877d0946574fa58c9ed213623f447c75ebd9ca5c044b40a998a17c0b389e146634798885772923f85d3d4
SSDEEP

12288:tCue9/kzb1uYBqDF1kF5Mcu/NbD8zwbD/OTIq5j/0r/y4NdGgE7Nbn:tLe9/kR6TVzmwbDUL5j/0sn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ef477585b25ad3d0a652dbebbc1dfb90.exe

Files

NEAS.ef477585b25ad3d0a652dbebbc1dfb90.exe
.exe windows:5 windows x86

1fcb75d3c5c52944305fd66350377f62

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupIterateCabinetW

lz32

LZRead
LZClose
LZOpenFileW
LZSeek

kernel32

GetSystemDefaultLangID
GetCommandLineW
GetTempFileNameW
FindFirstFileW
FindResourceW
LoadResource
InterlockedIncrement
InterlockedDecrement
CreateDirectoryW
GetUserDefaultLCID
GetPrivateProfileStringW
WriteFile
GetUserDefaultLangID
SizeofResource
GetFileAttributesW
CreateFileW
GetTempPathW
GetPrivateProfileIntW
GetLastError
FindClose
LockResource
RemoveDirectoryW
FindNextFileW
CloseHandle
DeleteFileW
SetLastError
GetFileSize
HeapAlloc
HeapFree
GetProcessHeap
IsBadReadPtr
ReadFile
MultiByteToWideChar
TlsGetValue
GetCurrentProcess
InitializeCriticalSection
TlsSetValue
LeaveCriticalSection
TerminateProcess
InterlockedExchange
GetStdHandle
EnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
DebugBreak
GetConsoleMode
GetModuleFileNameW
GetShortPathNameW
SetFileAttributesW
SetFilePointer
SetErrorMode
GetTickCount
GetSystemTimeAsFileTime
Sleep
GetModuleHandleW
GetConsoleCP
VirtualQuery
GetModuleHandleA
GetCurrentProcessId
CreateFileA
FlushFileBuffers
WriteConsoleW
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetStringTypeA
GetStringTypeW
CopyFileW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WideCharToMultiByte
LocalFree
HeapReAlloc
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
VirtualAlloc
GetProcAddress
ExitProcess
GetModuleFileNameA
TlsFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapSize
LCMapStringA

user32

MessageBoxW

advapi32

RegCloseKey
RegOpenKeyExW
ImpersonateLoggedOnUser
RegQueryValueExW
LogonUserW

shell32

CommandLineToArgvW

ole32

CoUninitialize
CoInitialize
OleRun
CoCreateInstance

oleaut32

VariantClear
SysAllocString
GetErrorInfo
VariantInit
SysFreeString

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 704KB - Virtual size: 704KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

axyoquk
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1fcb75d3c5c52944305fd66350377f62

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

lz32

kernel32

user32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 85KB - Virtual size: 85KB

.rdata Size: 24KB - Virtual size: 24KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 704KB - Virtual size: 704KB

.reloc Size: 37KB - Virtual size: 38KB

axyoquk Size: - Virtual size: 4KB

.text
Size: 85KB - Virtual size: 85KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 704KB - Virtual size: 704KB

.reloc
Size: 37KB - Virtual size: 38KB

axyoquk
Size: - Virtual size: 4KB