NEAS[.]47bd01c160774e3ab0209443fc88a5d0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.47bd01c160774e3ab0209443fc88a5d0.exe
Size

80KB
MD5

47bd01c160774e3ab0209443fc88a5d0
SHA1

a8d49d02fd3e898f8734a4b12bd8722e7baed8a5
SHA256

c6649881abbf33f6b9be618e117c883a5ec5a59f17ae109ebf91d9b5e0618da0
SHA512

8913f99be9e84724053d5ed17d6baaf827a5e93a9d1af54f4411615c5f07882f0f648517439fb4db3e579e30f7ad825fa3ae43e8c0aa26f6e684d7b3af158d32
SSDEEP

768:p18XzsCmT1yDGyP3zTlwUaNzZAK5KouVd8od1:pYLmT1yayv7aNzuK8obod

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.47bd01c160774e3ab0209443fc88a5d0.exe

Files

NEAS.47bd01c160774e3ab0209443fc88a5d0.exe
.dll windows:4 windows x86

ad0a1ee781e170d204482467c8cf6f32

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ResetEvent
GetOverlappedResult
WaitForMultipleObjects
WriteFile
ReadFile
CreateEventA
EscapeCommFunction
SetCommState
GetCommState
SetCommTimeouts
CloseHandle
CreateFileA
CreateThread
Sleep
GetLastError
DeleteFileA
Beep
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

user32

MoveWindow
GetActiveWindow
GetWindowRect
SetWindowPos

Exports

Exports

Asleep
BuffCUT
DprnRead
DprnWright
Dread
Dwright
Fdelete
GetPHwnd
GetProcessCount
GetThreadCount
MoveWin
SetMacin
SetThread
Setcom
beep
getwinpos
usThreadEnd
windel
winshow

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.GLOBALS
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ad0a1ee781e170d204482467c8cf6f32

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 17KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 12KB

.GLOBALS Size: 36KB - Virtual size: 33KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 20KB - Virtual size: 17KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 12KB

.GLOBALS
Size: 36KB - Virtual size: 33KB

.reloc
Size: 4KB - Virtual size: 3KB