NEAS[.]fedab80df94e8b52a2a6a45ecc5da580[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.fedab80df94e8b52a2a6a45ecc5da580.exe
Size

195KB
MD5

fedab80df94e8b52a2a6a45ecc5da580
SHA1

6a8fa800a179666f8df7f3c6d05a84d6c522a186
SHA256

9b91a6f05f19879636e84821a6dea7fa3b087f4e98d671f27825610b0cd998e7
SHA512

65ca6c5c4a66f8110698b5ac551fde6e128bbda268f18a80642b8d1b864b482b51a1033e1d91fe41ba8e3ed4049f0537fd4e2181c10ab6a1d0e7d343f89772f4
SSDEEP

6144:L59KDQLirz8WhzQ4/h9UzxpO80hLEAFZz:t92QLZWhk4jr8c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.fedab80df94e8b52a2a6a45ecc5da580.exe

Files

NEAS.fedab80df94e8b52a2a6a45ecc5da580.exe
.exe windows:6 windows x86

1191271eb3b3d64a9ea0595d7c000fc1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

inet_addr
freeaddrinfo
getnameinfo
getaddrinfo
ntohl
gethostbyname
htonl

kernel32

IsProcessorFeaturePresent
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleFileNameA
GetModuleHandleA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

vcruntime140

memcpy
memset
_except_handler4_common

api-ms-win-crt-string-l1-1-0

strcmp
strlen
strncpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
realloc
malloc
calloc

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_controlfp_s
_initialize_onexit_table
_seh_filter_exe
_set_app_type
_register_onexit_function
terminate
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
_read
_lseek
__acrt_iob_func
__stdio_common_vfprintf
fopen
_fileno
fclose
__p__commode
__stdio_common_vsprintf

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32
_stat64i32

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

GeoIPDBDescription
GeoIPRecord_delete
GeoIPRegion_delete
GeoIP_addr_to_num
GeoIP_assign_region_by_inetaddr
GeoIP_assign_region_by_inetaddr_gl
GeoIP_assign_region_by_inetaddr_v6
GeoIP_assign_region_by_inetaddr_v6_gl
GeoIP_charset
GeoIP_cleanup
GeoIP_code3_by_id
GeoIP_code_by_id
GeoIP_continent_by_id
GeoIP_country_code
GeoIP_country_code3
GeoIP_country_code3_by_addr
GeoIP_country_code3_by_addr_gl
GeoIP_country_code3_by_addr_v6
GeoIP_country_code3_by_addr_v6_gl
GeoIP_country_code3_by_ipnum
GeoIP_country_code3_by_ipnum_gl
GeoIP_country_code3_by_ipnum_v6
GeoIP_country_code3_by_ipnum_v6_gl
GeoIP_country_code3_by_name
GeoIP_country_code3_by_name_gl
GeoIP_country_code3_by_name_v6
GeoIP_country_code3_by_name_v6_gl
GeoIP_country_code_by_addr
GeoIP_country_code_by_addr_gl
GeoIP_country_code_by_addr_v6
GeoIP_country_code_by_addr_v6_gl
GeoIP_country_code_by_ipnum
GeoIP_country_code_by_ipnum_gl
GeoIP_country_code_by_ipnum_v6
GeoIP_country_code_by_ipnum_v6_gl
GeoIP_country_code_by_name
GeoIP_country_code_by_name_gl
GeoIP_country_code_by_name_v6
GeoIP_country_code_by_name_v6_gl
GeoIP_country_continent
GeoIP_country_id_by_addr
GeoIP_country_id_by_addr_v6
GeoIP_country_id_by_name
GeoIP_country_name
GeoIP_country_name_by_addr
GeoIP_country_name_by_addr_gl
GeoIP_country_name_by_addr_v6
GeoIP_country_name_by_addr_v6_gl
GeoIP_country_name_by_id
GeoIP_country_name_by_ipnum
GeoIP_country_name_by_ipnum_gl
GeoIP_country_name_by_ipnum_v6
GeoIP_country_name_by_ipnum_v6_gl
GeoIP_country_name_by_name
GeoIP_country_name_by_name_gl
GeoIP_country_name_by_name_v6
GeoIP_country_name_by_name_v6_gl
GeoIP_database_edition
GeoIP_database_info
GeoIP_db_avail
GeoIP_delete
GeoIP_enable_teredo
GeoIP_id_by_addr
GeoIP_id_by_addr_gl
GeoIP_id_by_addr_v6
GeoIP_id_by_addr_v6_gl
GeoIP_id_by_code
GeoIP_id_by_ipnum
GeoIP_id_by_ipnum_gl
GeoIP_id_by_ipnum_v6
GeoIP_id_by_ipnum_v6_gl
GeoIP_id_by_name
GeoIP_id_by_name_gl
GeoIP_id_by_name_v6
GeoIP_id_by_name_v6_gl
GeoIP_init_record_iter
GeoIP_last_netmask
GeoIP_lib_version
GeoIP_name_by_addr
GeoIP_name_by_addr_gl
GeoIP_name_by_addr_v6
GeoIP_name_by_addr_v6_gl
GeoIP_name_by_id
GeoIP_name_by_ipnum
GeoIP_name_by_ipnum_gl
GeoIP_name_by_ipnum_v6
GeoIP_name_by_ipnum_v6_gl
GeoIP_name_by_name
GeoIP_name_by_name_gl
GeoIP_name_by_name_v6
GeoIP_name_by_name_v6_gl
GeoIP_new
GeoIP_next_record
GeoIP_num_countries
GeoIP_num_to_addr
GeoIP_open
GeoIP_open_type
GeoIP_org_by_addr
GeoIP_org_by_addr_v6
GeoIP_org_by_ipnum
GeoIP_org_by_ipnum_v6
GeoIP_org_by_name
GeoIP_org_by_name_v6
GeoIP_range_by_ip
GeoIP_range_by_ip_delete
GeoIP_range_by_ip_gl
GeoIP_record_by_addr
GeoIP_record_by_addr_v6
GeoIP_record_by_ipnum
GeoIP_record_by_ipnum_v6
GeoIP_record_by_name
GeoIP_record_by_name_v6
GeoIP_record_id_by_addr
GeoIP_record_id_by_addr_v6
GeoIP_region_by_addr
GeoIP_region_by_addr_gl
GeoIP_region_by_addr_v6
GeoIP_region_by_addr_v6_gl
GeoIP_region_by_ipnum
GeoIP_region_by_ipnum_gl
GeoIP_region_by_ipnum_v6
GeoIP_region_by_ipnum_v6_gl
GeoIP_region_by_name
GeoIP_region_by_name_gl
GeoIP_region_by_name_v6
GeoIP_region_by_name_v6_gl
GeoIP_region_name_by_code
GeoIP_set_charset
GeoIP_setup_custom_directory
GeoIP_teredo
GeoIP_utf8_country_name
_GeoIP_addr_to_num_v6
_GeoIP_full_path_to
_GeoIP_lookupaddress
_GeoIP_lookupaddress_v6
_GeoIP_seek_record
_GeoIP_seek_record_gl
_GeoIP_seek_record_v6
_GeoIP_seek_record_v6_gl
_GeoIP_setup_dbfilename
__GEOIP_V6_IS_NULL

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1191271eb3b3d64a9ea0595d7c000fc1

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 101KB - Virtual size: 100KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 62KB - Virtual size: 62KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 101KB - Virtual size: 100KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 62KB - Virtual size: 62KB

.reloc
Size: 20KB - Virtual size: 19KB