NEAS[.]808d4a739ad7ba3dc283ae045b46ae80[.]exe

General

Target

NEAS.808d4a739ad7ba3dc283ae045b46ae80.exe
Size

279KB
MD5

808d4a739ad7ba3dc283ae045b46ae80
SHA1

3e9bf400d6c72a507cb37f3263bec4e29d4d2fc5
SHA256

9ec45c6987a3bd3a3d5d8cdde7c6669f449ac733ee447052cf25cc4341be2704
SHA512

5d166de43dd65f47221be662b1bd78881f80d10e5c9bb355e365bf5e8e3368a844e6ae3911a324e74556187e775672ace040cd0cd24e6f669e2c9987a6bc1a3b
SSDEEP

6144:geTS4/ZtWeSXr/4A5N0gfv0M0V0Gb2Eb1:gD487/Mwkb1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.808d4a739ad7ba3dc283ae045b46ae80.exe

Files

NEAS.808d4a739ad7ba3dc283ae045b46ae80.exe
.dll windows:5 windows x86

5de3f2f2d321ea0bae51b3cf9fdd0ba6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

win32k.sys

EngFntCacheFault
EngFntCacheAlloc
EngFntCacheLookUp
EngCreateSemaphore
EngReleaseSemaphore
EngAcquireSemaphore
EngSetLastError
EngMulDiv
XFORMOBJ_iGetXform
FONTOBJ_pxoGetXform
FONTOBJ_pifi
EngGetCurrentCodePage
PATHOBJ_bPolyLineTo
PATHOBJ_bPolyBezierTo
PATHOBJ_bCloseFigure
PATHOBJ_bMoveTo
EngGetFileChangeTime
EngGetFilePath
EngUnmapFontFileFD
EngUnmapFontFile
EngFreeModule
EngAllocMem
EngMapModule
EngLoadModule
EngLoadModuleForWrite
EngMapFontFileFD
EngMapFontFile
EngUnicodeToMultiByteN
EngMultiByteToUnicodeN
EngMultiByteToWideChar
FLOATOBJ_MulFloat
EngFreeMem
FLOATOBJ_GetLong
FLOATOBJ_Neg
FLOATOBJ_AddFloat
FLOATOBJ_Add
FLOATOBJ_DivLong
FLOATOBJ_AddLong
FLOATOBJ_MulLong
FLOATOBJ_SetLong
EngBugCheckEx
RtlUnwind
RtlUnicodeToMultiByteN

Sections

.text
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5de3f2f2d321ea0bae51b3cf9fdd0ba6

Headers

File Characteristics

Imports

win32k.sys

Sections

.text Size: 203KB - Virtual size: 203KB

.rdata Size: 25KB - Virtual size: 25KB

.data Size: 33KB - Virtual size: 33KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 13KB

.text
Size: 203KB - Virtual size: 203KB

.rdata
Size: 25KB - Virtual size: 25KB

.data
Size: 33KB - Virtual size: 33KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 13KB