NEAS[.]b6c02d61e7ce398585a72f8a5b873410[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b6c02d61e7ce398585a72f8a5b873410.exe
Size

1.3MB
MD5

b6c02d61e7ce398585a72f8a5b873410
SHA1

280d1b0c8b95070070b998bb2a3994850de003e9
SHA256

a0f2339b6eef360cd3b464aa1feb769233151b1bc369146e348facf86dd5009d
SHA512

90b3d3433d1242ad4254d9d6e9e9cf15407dcfbc681da9a407ccc321b7c8e9241634f1b718b751e06c5ba0866a6aa244c8e298593aef95277d9b84b8d216c796
SSDEEP

24576:bNvq4Qgkxd54AVNEJY8YBdzgYywwCd5jnHgTgfz9CuvI7:JvjQgk7sGtgYlw+Zn9fz9Cuv0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b6c02d61e7ce398585a72f8a5b873410.exe

Files

NEAS.b6c02d61e7ce398585a72f8a5b873410.exe
.exe windows:6 windows x64

00996cbaf40a49da37c118756a4764fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
RaiseException
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-localization-l1-2-0

IsValidCodePage
GetACP
IsValidLocale
GetLocaleInfoW
LCMapStringEx
GetUserDefaultLCID
EnumSystemLocalesW
FormatMessageA
GetCPInfo
FormatMessageW
GetOEMCP
GetLocaleInfoEx
LCMapStringW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringW
GetStringTypeW
MultiByteToWideChar
CompareStringEx

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

TryEnterCriticalSection
InitializeSRWLock
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
ResetEvent
WaitForSingleObjectEx
CreateEventA
OpenEventA
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetEvent

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetStartupInfoW
TlsAlloc
TlsFree
TerminateProcess
GetCurrentThreadId
ExitProcess
TlsSetValue
TlsGetValue

ws2_32

WSAStartup
WSACleanup
gethostname
WSASetLastError
WSAGetLastError

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetModuleFileNameW
GetProcAddress

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-file-l1-1-0

FlushFileBuffers
GetFileAttributesW
CreateFileW
FindFirstFileExW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
RemoveDirectoryW
ReadFile
GetFileTime
WriteFile
DeleteFileW
CreateDirectoryW
FindNextFileW
FindFirstFileW
FindClose
GetFileType

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-com-l1-1-0

CoTaskMemFree

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
ReadConsoleW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
GetCommandLineW
GetCommandLineA
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-heap-l1-1-0

HeapSize
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc

shell32

SHGetKnownFolderPath

advapi32

GetUserNameW

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

Sections

.text
Size: 755KB - Virtual size: 755KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 280KB - Virtual size: 280KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

00996cbaf40a49da37c118756a4764fb

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

ws2_32

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-console-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-heap-l1-1-0

shell32

advapi32

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

Sections

.text Size: 755KB - Virtual size: 755KB

.rdata Size: 190KB - Virtual size: 190KB

.data Size: 14KB - Virtual size: 76KB

.pdata Size: 31KB - Virtual size: 31KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 280KB - Virtual size: 280KB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 755KB - Virtual size: 755KB

.rdata
Size: 190KB - Virtual size: 190KB

.data
Size: 14KB - Virtual size: 76KB

.pdata
Size: 31KB - Virtual size: 31KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 280KB - Virtual size: 280KB

.reloc
Size: 6KB - Virtual size: 5KB