NEAS[.]9b6f6d605d100bcc80959a51f9df1a50[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9b6f6d605d100bcc80959a51f9df1a50.exe
Size

232KB
MD5

9b6f6d605d100bcc80959a51f9df1a50
SHA1

86b08fa6c37a6eda2dc2f2d8e2c6d8bf82b3dcc5
SHA256

7371e9c12c86702426b1dd63914bc7aeb6ac2203feb25623718209450c0a0169
SHA512

52074d39fffbbbeb6a89b7ca72465916835335bba8a20361189fc6657560c72f6330d3521bf1228d1c241ccba6b240e48cc73798aa5d283ebb1f6de63487109e
SSDEEP

3072:1iiFQqm+rokemRQwGNyNQTkSpPSzrHznzSceIJGno1N7ehMi8CGdg216Rkpr7891:1iiFQqmy2wGNjTkm+O1AgULBPa4i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9b6f6d605d100bcc80959a51f9df1a50.exe

Files

NEAS.9b6f6d605d100bcc80959a51f9df1a50.exe
.exe windows:6 windows x86

c9137d5bd7d9d82c164ba7f54ccb8061

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
WideCharToMultiByte
MultiByteToWideChar
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress

freeglut

glutInitWindowSize
glutInitWindowPosition
glutMainLoop
glutDisplayFunc
glutSpecialFunc
glutInitDisplayMode
glutIdleFunc
glutKeyboardFunc
__glutInitWithExit
__glutCreateWindowWithExit
glutReshapeFunc
glutSwapBuffers

opengl32

glTexParameteri
glTexImage2D
glGetString
glGetIntegerv
glGenTextures
glDeleteTextures
wglGetProcAddress
glOrtho
glBegin
glDisable
glColor4f
glVertex2f
glClearColor
glColor3f
glMatrixMode
glTexCoord2f
glEnd
glEnable
glBindTexture
glClear
glViewport
glBlendFunc
glLoadIdentity

msvcp140

??Bid@locale@std@@QAEIXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Xlength_error@std@@YAXPBD@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

vcruntime140

__vcrt_GetModuleFileNameW
__vcrt_LoadLibraryExW
_CxxThrowException
memset
strstr
memcpy
__std_terminate
__std_exception_copy
memmove
__std_exception_destroy
__CxxFrameHandler3
_except_handler4_common

api-ms-win-crt-runtime-l1-1-0

terminate
_controlfp_s
__p___argc
_wassert
_invalid_parameter_noinfo_noreturn
exit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
__p___argv
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_register_thread_local_exe_atexit_callback
_c_exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
freopen
__acrt_iob_func
__p__commode
fclose
fgetc
__stdio_common_vfprintf
feof
fopen
fread
fseek
ftell

api-ms-win-crt-time-l1-1-0

clock
_time64

api-ms-win-crt-utility-l1-1-0

srand
abs
rand

api-ms-win-crt-string-l1-1-0

toupper
strcmp
strncmp
strcat_s
strcpy_s

api-ms-win-crt-convert-l1-1-0

strtol
atoi

api-ms-win-crt-heap-l1-1-0

realloc
_callnewh
malloc
_set_new_mode
free

api-ms-win-crt-math-l1-1-0

__setusermatherr
pow
ldexp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c9137d5bd7d9d82c164ba7f54ccb8061

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

freeglut

opengl32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 88KB - Virtual size: 87KB

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 1KB - Virtual size: 5KB

.rsrc Size: 126KB - Virtual size: 125KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 88KB - Virtual size: 87KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 1KB - Virtual size: 5KB

.rsrc
Size: 126KB - Virtual size: 125KB

.reloc
Size: 4KB - Virtual size: 3KB