NEAS[.]b2cf9dc4afda4b29aa8a472163c50cd0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b2cf9dc4afda4b29aa8a472163c50cd0.exe
Size

2.1MB
MD5

b2cf9dc4afda4b29aa8a472163c50cd0
SHA1

73bbd8e016b052fc0b8d89f4b1fd2cd4b73f144a
SHA256

eab860f2b71c98bc62476d2b6240fcbf511d8138ca294837655d2763f793fdd2
SHA512

f63b289652241af7e29dc5aedc1d22a14ebd083d2e647c9f5e3f4b9d625c62f7513d212e582c67b5b1d047ad151f8f874b5e02a8d826b886a8ab6fb0a4661fa1
SSDEEP

49152:DSt4byso5JxK52/nUbqvEwOkTrb/0p6dzX:kxi2cbqoob/0p6dz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b2cf9dc4afda4b29aa8a472163c50cd0.exe

Files

NEAS.b2cf9dc4afda4b29aa8a472163c50cd0.exe
.exe windows:5 windows x86

0aef287dcb808092ca39583e3f254a74

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

__WSAFDIsSet
recvfrom
select
htonl
getaddrinfo
shutdown
setsockopt
send
connect
freeaddrinfo
recv
socket
htons
closesocket
sendto
bind
ntohs
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
inet_ntoa
WSACleanup
WSAStartup
listen
accept
ntohl
WSAGetLastError
gethostbyname

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

mixerSetControlDetails
mixerGetControlDetailsW
mixerOpen
waveOutGetVolume
PlaySoundW
mixerClose

wininet

HttpOpenRequestW
InternetCloseHandle
InternetReadFile
HttpQueryInfoW
HttpSendRequestW
InternetSetOptionW
InternetConnectW
InternetQueryOptionW
InternetOpenW

kernel32

GetModuleHandleW
CreateEventW
ResetEvent
CloseHandle
TerminateThread
WaitForSingleObject
SetEvent
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
ResumeThread
SetThreadPriority
CreateThread
InitializeCriticalSection
DeleteCriticalSection
OpenEventW
Sleep
FreeLibrary
WideCharToMultiByte
RaiseException
GetLastError
MultiByteToWideChar
lstrcpynW
EscapeCommFunction
SetCommState
GetCommState
CreateFileW
GetCommModemStatus
WriteFile
ReadFile
GetSystemInfo
SetFilePointer
GetFileSize
FlushInstructionCache
GetCurrentProcess
GlobalUnlock
GlobalLock
GlobalAlloc
GetCurrentThreadId
SetLastError
GetModuleFileNameW
GetExitCodeProcess
CreateProcessW
GetVersionExW
lstrcpynA
GetProcAddress
LoadLibraryW
LockResource
LoadResource
SizeofResource
FindResourceW
InterlockedDecrement
GlobalReAlloc
UnmapViewOfFile
lstrcpyW
GetCommandLineW
MapViewOfFile
CreateFileMappingW
lstrlenA
DebugBreak
OutputDebugStringW
InterlockedIncrement
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalMemoryStatus
GetDateFormatW
InitializeCriticalSectionAndSpinCount
lstrcmpW
MulDiv
GetTimeFormatW
GetTickCount
lstrcmpiW
LoadLibraryExW
CreateMutexW
SetCommTimeouts
GetCommTimeouts
ExitProcess
GetModuleHandleA
GetVersion
GetFileType
GetStdHandle
GetCurrentProcessId
LoadLibraryA
GetVersionExA
FlushConsoleInputBuffer
HeapReAlloc
HeapSetInformation
GetStartupInfoW
SetConsoleCtrlHandler
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
HeapAlloc
DecodePointer
EncodePointer
HeapFree
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetConsoleCP
FlushFileBuffers
SetStdHandle
LCMapStringW
CompareStringW
SetEnvironmentVariableA
WriteConsoleW
CreateFileA
SetEndOfFile
GetProcessHeap
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
lstrlenW

user32

LoadStringA
TrackPopupMenuEx
MessageBeep
PtInRect
GetWindowTextW
GetDlgItem
SetRect
CharNextW
SetCursor
UpdateWindow
GetUpdateRect
ScrollDC
SetRectEmpty
InflateRect
UnionRect
wvsprintfW
GetSysColor
MoveWindow
ClientToScreen
InvalidateRgn
RedrawWindow
IsChild
GetClassNameW
FillRect
GetDesktopWindow
DestroyAcceleratorTable
GetFocus
CreateAcceleratorTableW
GetWindowTextLengthW
SetLayeredWindowAttributes
EqualRect
GetWindowPlacement
GetDlgItemInt
SetDlgItemInt
GetMessageW
LoadAcceleratorsW
LoadMenuW
FindWindowExW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxA
GetMenuItemInfoW
RemoveMenu
GetMenuItemCount
PeekMessageW
SetFocus
SetForegroundWindow
TranslateMessage
DispatchMessageW
PostQuitMessage
DialogBoxParamW
SetDlgItemTextW
UnregisterClassA
RegisterClassExW
EmptyClipboard
SetClipboardData
CloseClipboard
TrackPopupMenu
GetKeyState
AdjustWindowRectEx
OffsetRect
LoadCursorW
GetClassInfoExW
SetWindowRgn
OpenClipboard
SetCapture
EnableWindow
ScreenToClient
SetWindowTextW
DestroyMenu
AppendMenuW
CreatePopupMenu
DestroyWindow
ShowCursor
ReleaseCapture
GetAsyncKeyState
wsprintfW
LoadImageW
GetSystemMetrics
CallWindowProcW
SetWindowLongW
DefWindowProcW
EndPaint
BeginPaint
LoadBitmapW
GetDC
ReleaseDC
DrawTextW
IsRectEmpty
CopyRect
KillTimer
SetTimer
InvalidateRect
MsgWaitForMultipleObjects
LoadStringW
FindWindowW
IsWindow
ShowWindow
SendMessageW
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
MessageBoxW
IsDlgButtonChecked
GetDlgItemTextW
CheckDlgButton
GetWindowLongW
EndDialog
PostMessageW
RegisterWindowMessageW
IntersectRect
CreateWindowExW

gdi32

GetClipBox
Ellipse
RoundRect
CreatePen
GetCurrentObject
SetDIBitsToDevice
GetStockObject
CreateCompatibleBitmap
ExtTextOutW
SetBkMode
Rectangle
CreateSolidBrush
CreateRectRgnIndirect
StretchBlt
DeleteDC
SelectClipRgn
SetStretchBltMode
ExtCreateRegion
CombineRgn
AddFontResourceW
GetDeviceCaps
DPtoLP
AddFontMemResourceEx
DeleteObject
GetObjectW
GetPixel
BitBlt
PatBlt
SetTextColor
SetBkColor
SelectObject
CreateCompatibleDC
CreateFontIndirectW
CreateDIBSection

advapi32

RegDeleteValueW
RegCloseKey
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteKeyW
RegSetValueExW
RegFlushKey
RegCreateKeyExW
RegQueryValueExW

shell32

ShellExecuteExW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree
StringFromCLSID
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemAlloc
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoTaskMemRealloc

oleaut32

SysStringLen
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysFreeString
VariantInit
VariantClear
SysAllocString
SysAllocStringLen

comctl32

PropertySheetW
InitCommonControlsEx

msimg32

TransparentBlt

Sections

.text
Size: 877KB - Virtual size: 876KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 932KB - Virtual size: 932KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0aef287dcb808092ca39583e3f254a74

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

version

winmm

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

msimg32

Sections

.text Size: 877KB - Virtual size: 876KB

.rdata Size: 222KB - Virtual size: 222KB

.data Size: 15KB - Virtual size: 1.6MB

.rsrc Size: 932KB - Virtual size: 932KB

.reloc Size: 66KB - Virtual size: 66KB

.text
Size: 877KB - Virtual size: 876KB

.rdata
Size: 222KB - Virtual size: 222KB

.data
Size: 15KB - Virtual size: 1.6MB

.rsrc
Size: 932KB - Virtual size: 932KB

.reloc
Size: 66KB - Virtual size: 66KB