NEAS[.]91f8973aa8510e7412c767febd4868d0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.91f8973aa8510e7412c767febd4868d0.exe
Size

240KB
MD5

91f8973aa8510e7412c767febd4868d0
SHA1

47f704e2c202f059bf53abc05d6e000a757e1f94
SHA256

87a77d716d651555b27b21d9646cf33f5daf17f32fec9927e026954f66fd68dc
SHA512

3561d6d9c163cd10083d75ca77bb64390dc68c059e02ff803e84eb880a378aaea3d56ca1eaf32c08e34b432cca9d5b35009f1c2ba450b99c16b1b281b3cd9500
SSDEEP

3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlLUz+mmCTHFZjoHEo3m:REd5+IZiZhLlG4QimmCv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.91f8973aa8510e7412c767febd4868d0.exe

Files

NEAS.91f8973aa8510e7412c767febd4868d0.exe
.exe windows:4 windows x86

dcac8383cc76738eecb5756694c4aeb2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord6648
ord6778
ord922
ord5710
ord4129
ord923
ord4277
ord940
ord640
ord2405
ord5785
ord1640
ord323
ord1168
ord6197
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord609
ord781
ord6438
ord2621
ord1134
ord6334
ord3708
ord2575
ord4396
ord3574
ord1146
ord6215
ord665
ord1979
ord353
ord6136
ord6140
ord535
ord6876
ord939
ord941
ord4278
ord341
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6021
ord5873
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord3571
ord3797
ord2381
ord2754
ord6194
ord6734
ord6170
ord3706
ord5781
ord2818
ord2370
ord2289
ord289
ord613
ord2860
ord4284
ord3874
ord470
ord5789
ord5875
ord6172
ord755
ord6663
ord2864
ord4275
ord540
ord860
ord858
ord795
ord3721
ord2642
ord3998
ord3301
ord283
ord5787
ord4476
ord3089
ord1641
ord3996
ord2414
ord1576
ord616
ord3663
ord3626
ord693
ord3640
ord3370
ord4402
ord2582
ord3582
ord4398
ord2578
ord4218
ord2023
ord2411
ord3573
ord3619
ord823
ord3092
ord6199
ord4376
ord6453
ord924
ord1200
ord800
ord2379
ord5280
ord4710
ord537
ord4234
ord2302
ord765
ord825
ord324
ord567
ord641
ord3698
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord3597
ord4425
ord1775
ord6052
ord2514
ord4998
ord4853
ord654
ord5265

msvcrt

_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
realloc
exit
_mbsstr
_setmbcp
_strnicmp
_wcsnicmp
_wcsicmp
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
__CxxFrameHandler
fclose
fread
fopen
sprintf
rand
fwrite
time
srand
wcscpy
wcscat
wcslen
_ftol
_except_handler3
_local_unwind2
wcsrchr
wcscmp
swprintf
wcsstr
fgets
malloc
calloc
free
_purecall
memmove
strncpy
_CxxThrowException
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
strrchr
__p___argc
__p___argv
_mbscmp
strncmp
sscanf
strtok

kernel32

GlobalFree
GetTickCount
CreateProcessA
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
TerminateThread
CloseHandle
GetFileAttributesA
DeleteFileA
CreateThread
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
CopyFileW
CreateDirectoryA
GetProcAddress
CopyFileA
GetComputerNameA
SystemTimeToFileTime
LocalFileTimeToFileTime
GetModuleHandleA
GetStartupInfoA
LoadLibraryA
GlobalAlloc
SetCurrentDirectoryA
GetCurrentDirectoryA
SetFileTime
SetFilePointerEx
SetEndOfFile
SetFilePointer
GetFileTime
MultiByteToWideChar
FindClose
FindNextFileW
GetFileAttributesW
FindFirstFileW
CreateFileA
GetExitCodeThread
GlobalUnlock
GlobalLock
WideCharToMultiByte
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDrives
FindNextFileA
FindFirstFileA
InitializeCriticalSection
DeleteCriticalSection
ReadFile
GetFileSize
WriteFile
LeaveCriticalSection
EnterCriticalSection
Sleep
ExitProcess
GetModuleFileNameA
GetTempFileNameA
GetUserDefaultLangID
GetLocaleInfoA

user32

BringWindowToTop
GrayStringA
DrawTextA
TabbedTextOutA
SetActiveWindow
GetSysColor
ShowWindow
SystemParametersInfoW
IsIconic
GetSystemMetrics
SetFocus
SetForegroundWindow
OffsetRect
SetWindowPos
DrawIcon
SetWindowTextW
LoadIconA
FindWindowW
wsprintfA
SystemParametersInfoA
SetTimer
SendMessageA
FillRect
RedrawWindow
InvalidateRect
SetCursor
GetParent
LoadCursorA
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetClientRect
KillTimer
EnableWindow

gdi32

ExtTextOutA
TextOutA
RectVisible
PtVisible
CreateCompatibleBitmap
CreateRectRgn
GetWindowOrgEx
GetViewportOrgEx
GetDeviceCaps
CreateCompatibleDC
BitBlt
DeleteObject
GetTextExtentPoint32A
GetObjectA
CreateFontIndirectA
PatBlt
CreateSolidBrush
CreateFontA
Escape

advapi32

RegQueryValueExA
GetUserNameA
CryptReleaseContext
RegSetValueExA
RegCreateKeyW
RegCloseKey
AllocateAndInitializeSid
CheckTokenMembership
FreeSid

shell32

ShellExecuteA
ShellExecuteExA
SHGetFolderPathW

comctl32

_TrackMouseEvent
ord8

oleaut32

VariantTimeToSystemTime

urlmon

URLDownloadToFileA

msvcp60

??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_Xlen@std@@YAXXZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB

ws2_32

select
connect
ioctlsocket
bind
socket
htons
gethostbyname
inet_addr
__WSAFDIsSet
WSAGetLastError
shutdown
send
recv
setsockopt
WSAStartup
inet_ntoa
closesocket

wininet

DeleteUrlCacheEntry

Sections

.text
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dcac8383cc76738eecb5756694c4aeb2

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

oleaut32

urlmon

msvcp60

ws2_32

wininet

Sections

.text Size: 80KB - Virtual size: 76KB

.rdata Size: 40KB - Virtual size: 36KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 104KB - Virtual size: 102KB

.text
Size: 80KB - Virtual size: 76KB

.rdata
Size: 40KB - Virtual size: 36KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 104KB - Virtual size: 102KB