NEAS[.]11f93abd36ac2c6bc414d47655c59360[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.11f93abd36ac2c6bc414d47655c59360.exe
Size

1.6MB
MD5

11f93abd36ac2c6bc414d47655c59360
SHA1

d93dd98614c171936bbccad6bf92f0a0894ab190
SHA256

02c0559afecb1c1f1d4ddce0663a9e63457622910b14f39fac682fa97a14cfff
SHA512

cdd785eccef8c154637bef710f534fcc086acc790e893a4d2dfbbe085973376d5e0f39ec0b1b5b70d5f780f4095cfd41e73d868b9aa283b1b74bb0ac0aecf7e8
SSDEEP

24576:1h6Ur/ib3xM7dLtNsqjnhMgeiCl7G0nehbGZpbD:1hLbibedHDmg27RnWGj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.11f93abd36ac2c6bc414d47655c59360.exe

Files

NEAS.11f93abd36ac2c6bc414d47655c59360.exe
.exe windows:6 windows x64

6cd9823b30c54834537b0f8782d98900

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA
FreeEnvironmentStringsW
SetStdHandle
ExpandEnvironmentStringsW
GetCommandLineW
GetEnvironmentStringsW
GetStdHandle

api-ms-win-core-file-l1-1-0

FindFirstFileExW
GetFileType
CreateDirectoryW
FindClose
SetEndOfFile
FindNextFileW
FlushFileBuffers
SetFilePointerEx
WriteFile
CreateFileW
ReadFile

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
RaiseException
SetUnhandledExceptionFilter

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

SetEvent
InitializeCriticalSectionEx
WaitForSingleObjectEx
ResetEvent
DeleteCriticalSection
LeaveCriticalSection
WaitForMultipleObjectsEx
CreateEventW
EnterCriticalSection
InitializeCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject

api-ms-win-core-processthreads-l1-1-0

ExitProcess
GetCurrentProcessId
GetStartupInfoW
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadStringW
SizeofResource
GetModuleHandleW
GetProcAddress
GetModuleHandleExW
LoadLibraryExW
GetModuleFileNameW
LoadResource

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW
CharUpperW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegEnumKeyExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegSetValueExW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoResumeClassObjects
CoAddRefServerProcess
CoReleaseServerProcess
CoCreateInstance
CoInitializeSecurity

oleaut32

SafeArrayGetUBound
SafeArrayCreate
SafeArrayDestroy
SafeArrayRedim
SafeArrayGetLBound
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
VariantClear
VariantInit
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
LoadRegTypeLi

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-devices-config-l1-1-1

CM_Register_Notification
CM_Unregister_Notification
CM_Get_Device_Interface_List_SizeW
CM_Get_Device_Interface_ListW

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapReAlloc
HeapSize
HeapFree

api-ms-win-security-base-l1-1-0

MakeAbsoluteSD

api-ms-win-service-management-l2-1-0

ChangeServiceConfigW
QueryServiceConfigW

api-ms-win-service-management-l1-1-0

CloseServiceHandle
OpenServiceW
CreateServiceW
OpenSCManagerW
DeleteService

api-ms-win-service-winsvc-l1-1-0

ControlService

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
SetServiceStatus

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

user32

PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW

api-ms-win-core-localization-l1-2-0

GetUserDefaultLCID
GetCPInfo
GetACP
IsValidCodePage
GetOEMCP
GetLocaleInfoW
EnumSystemLocalesW
IsValidLocale
LCMapStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-console-l1-1-0

GetConsoleMode
ReadConsoleW
WriteConsoleW
GetConsoleCP

Exports

Exports

MessageBoxW

Sections

.text
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6cd9823b30c54834537b0f8782d98900

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-com-l1-1-0

oleaut32

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-io-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-security-sddl-l1-1-0

user32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-console-l1-1-0

Exports

Exports

Sections

.text Size: 289KB - Virtual size: 289KB

.rdata Size: 144KB - Virtual size: 144KB

.data Size: 8KB - Virtual size: 15KB

.pdata Size: 16KB - Virtual size: 15KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 289KB - Virtual size: 289KB

.rdata
Size: 144KB - Virtual size: 144KB

.data
Size: 8KB - Virtual size: 15KB

.pdata
Size: 16KB - Virtual size: 15KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB