NEAS[.]3698b423bc9b699bc6134bd9385c7720[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3698b423bc9b699bc6134bd9385c7720.exe
Size

304KB
MD5

3698b423bc9b699bc6134bd9385c7720
SHA1

5986dcd18abb99b27770c453303bfb7f67d15b75
SHA256

01e1acc942d47b07a328fc540fccd47ae07953b0fb5c05742839a735a26cb28a
SHA512

d015eb3b7ffcbc67959405121cb5f9d112af19c0fa93a25f8566bdf36101c7c9e329837a2b84e9dc4d54590a1aedc7586031105a68fb2069a28af264a857d7ab
SSDEEP

6144:09jrEC/CBnvyh9Wzp+mWEwwYWl8QZo+su0vm8nZzhGCsz8LVY:0BECaBnKOFvWEwRWBZzsuiThGFzL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3698b423bc9b699bc6134bd9385c7720.exe

Files

NEAS.3698b423bc9b699bc6134bd9385c7720.exe
.dll windows:6 windows x86

a54e2180093e4b5d643a442c8cfea6fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_isatty
_write
_lseeki64
_fileno
__pioinfo
__badioinfo
wctomb
_itoa
_snprintf
isleadbyte
_ismbblead
_amsg_exit
_initterm
free
malloc
_XcptFilter
_iob
_errno
tolower
isspace
getenv
atoi
_stricmp
_strnicmp
strstr
memcpy
memset
strchr
strncmp
_strcmpi

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
WaitForSingleObject
TerminateProcess
GetCurrentProcess
DuplicateHandle
GetPriorityClass
CreateProcessA
CreateThread
SetFilePointer
GetCurrentProcessId
CreateNamedPipeA
CreateFileA
CreateEventA
ReadFile
WriteFile
WaitForMultipleObjects
GetOverlappedResult
CloseHandle
GetCurrentDirectoryA
MultiByteToWideChar
WideCharToMultiByte
LocalFree
LocalReAlloc
LocalAlloc
RemoveDirectoryA
GetFileAttributesA
CreateDirectoryA
GetLastError
OutputDebugStringA
DebugBreak
SetEnvironmentVariableA
SetLastError
SetCurrentDirectoryA
GetEnvironmentVariableA
DeleteFileA
CopyFileA
GetPrivateProfileSectionA
GetModuleFileNameA

advapi32

RegCreateKeyA
RegSetValueA
RegCloseKey
RegQueryValueA

Exports

Exports

SrcSrvCleanup
SrcSrvEnumTokens
SrcSrvExecToken
SrcSrvExecTokenA
SrcSrvExecTokenW
SrcSrvGetFile
SrcSrvGetFileA
SrcSrvGetFileW
SrcSrvGetOptions
SrcSrvGetToken
SrcSrvGetTokenA
SrcSrvGetTokenW
SrcSrvInit
SrcSrvInitA
SrcSrvInitW
SrcSrvIsModuleLoaded
SrcSrvLoadModule
SrcSrvLoadModuleA
SrcSrvLoadModuleW
SrcSrvRegisterCallback
SrcSrvResolveTokenVar
SrcSrvResolveTokenVarA
SrcSrvResolveTokenVarW
SrcSrvSetOptions
SrcSrvSetParentWindow
SrcSrvSetTargetPath
SrcSrvSetTargetPathA
SrcSrvSetTargetPathW
SrcSrvUnloadModule

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 223KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a54e2180093e4b5d643a442c8cfea6fd

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

advapi32

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 42KB

.data Size: 30KB - Virtual size: 173KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 223KB - Virtual size: 224KB

.text
Size: 43KB - Virtual size: 42KB

.data
Size: 30KB - Virtual size: 173KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 223KB - Virtual size: 224KB