NEAS[.]3e86410425893d7916a39bf6882f0c90[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3e86410425893d7916a39bf6882f0c90.exe
Size

56KB
MD5

3e86410425893d7916a39bf6882f0c90
SHA1

9d72d8772f26b350584e69ca2d434010f3c10482
SHA256

99f291c04fb0d3b4a065b704c7ece82e52d7d31e9930340da9147b7ea43bd80a
SHA512

f7d2dc842d3435ebcb2754ce323c05f27674db824140db37f7117e24ec5664ae1f7ee55bb4c6327dcecb50cd803a99dc96dfdac8d642f046607636477e426881
SSDEEP

1536:wOhOiy/wCq4eppJT8CAsO4D+uSDvIloQk:wOhs/wZpushh+gl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3e86410425893d7916a39bf6882f0c90.exe

Files

NEAS.3e86410425893d7916a39bf6882f0c90.exe
.dll windows:4 windows x86

e22523b9fbb194d82e70e5d8b1a79821

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetEvent
GetTickCount
WaitForMultipleObjects
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LockResource
SizeofResource
LoadResource
FindResourceA
WaitForSingleObject
ResetEvent
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
TerminateThread
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
ResumeThread
CloseHandle
CreateEventA
lstrcpyA
IsBadReadPtr
SetUnhandledExceptionFilter
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsBadWritePtr
HeapReAlloc
RtlUnwind
HeapFree
HeapAlloc
GetLastError
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
GetCommandLineA
GetVersion
TlsAlloc
TlsFree
SetLastError
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
ExitProcess
VirtualAlloc

user32

ShowWindow
CreateWindowExA
CopyRect
RegisterClassExA
GetSysColorBrush
LoadCursorA
DefWindowProcA
DispatchMessageA
IsWindow
TranslateMessage
GetMessageA
MsgWaitForMultipleObjects
ClientToScreen
SendMessageA
EnableWindow
SetWindowLongA
UnregisterClassA
DestroyWindow
GetWindowLongA

gdi32

GetStockObject

comdlg32

GetSaveFileNameA

ole32

CoInitialize

dsound

ord6
ord7
ord11

winmm

mixerGetLineControlsA
mixerGetLineInfoA
mixerOpen
mixerSetControlDetails
timeGetTime
mmioClose
mmioOpenA
mmioAscend
mmioRead
mmioDescend
mmioGetInfo
mmioCreateChunk
mmioSeek
mmioSetInfo
mmioWrite
mixerClose
mmioAdvance

Exports

Exports

??0IRemote_Plug_WorkBase@@QAE@ABV0@@Z
??0IRemote_Plug_WorkBase@@QAE@XZ
??4IRemote_Plug_WorkBase@@QAEAAV0@ABV0@@Z
??_7IRemote_Plug_WorkBase@@6B@
ApiClientAddRemoteAudioBuf
ApiClientInitRemoteAudio
ApiClientRemoteUnitAudio
ApiOpenClientAudioOpert
ApiRemoteCmdAudio
ApiRemoteInitAudio
ApiRemoteUnitAudio
CreatePlug
GetOsVersion
ReleasePlug

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e22523b9fbb194d82e70e5d8b1a79821

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

ole32

dsound

winmm

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 32KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 36KB - Virtual size: 32KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 3KB