NEAS[.]82c07e8ff1ad653a08e7baeff3df4fb0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NEAS.82c07e8ff1ad653a08e7baeff3df4fb0.exe
Size 4.4MB
Sample231024-3lzcrsbf56
SHA256 6838d01d5dc7b1f6582584eb66e3c7314352e060654180dfb0eb45fa2f17e64c
MD5 82c07e8ff1ad653a08e7baeff3df4fb0
SHA1 f388dd36e0a98df4c913292ebdc76cd8b3c1c4a4
SHA512 39b6ea4ffb918c96a5b17ab58cc06f353dae406f198d894cdd435b870c7ae03c0f9317eb105eb4189a3c62cb3346a199df26f1dd134dee949e888ecef3860b0c
SSDEEP 98304:v4/a5mVzk/PUj0UV8puC01sFIe3/aaFeKNeQSutdaxSTAlvb:v4mMzkUj3V8pH1vyaFBIQ74su
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.82c07e8ff1ad653a08e7baeff3df4fb0.exe

File Explorer

NEAS.82c07e8ff1ad653a08e7baeff3df4fb0.exe

.exe 4.4MB

NEAS.82c07e8ff1ad653a08e7baeff3df4fb0.exe

IMPHASH b59111de33e57ff4c9c0b99c635e5629
SHA256 6838d01d5dc7b1f6582584eb66e3c7314352e060654180dfb0eb45fa2f17e64c
MD5 82c07e8ff1ad653a08e7baeff3df4fb0
SHA1 f388dd36e0a98df4c913292ebdc76cd8b3c1c4a4
SHA512 39b6ea4ffb918c96a5b17ab58cc06f353dae406f198d894cdd435b870c7ae03c0f9317eb105eb4189a3c62cb3346a199df26f1dd134dee949e888ecef3860b0c
SSDEEP 98304:v4/a5mVzk/PUj0UV8puC01sFIe3/aaFeKNeQSutdaxSTAlvb:v4mMzkUj3V8pH1vyaFBIQ74su
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4768414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject GetModuleHandleA GetLocaleInfoA Sleep RemoveDirectoryTransactedA GetUserDefaultLCID CreateThread GetLastError DeleteFileA HeapAlloc lstrcpynA lstrcmpiW GetModuleFileNameA GetCurrentProcess GetSystemPowerStatus CreateMutexA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetSystemWow64DirectoryW GetTimeZoneInformation OpenMutexA Process32NextW GlobalAlloc GetEnvironmentVariableA Process32FirstW GlobalFree GetSystemInfo GetLogicalDriveStringsA GlobalMemoryStatusEx WideCharToMultiByte CreateProcessA GetComputerNameA UnmapViewOfFile GetFileInformationByHandle CreateFileA GetLocalTime CreateFileMappingA MapViewOfFile GetTickCount SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc OutputDebugStringW lstrlenA GetFileSize lstrcpyW GetVersionExW lstrlenW CreateDirectoryA SystemTimeToFileTime lstrcpyA CloseHandle GetFileAttributesA LocalFileTimeToFileTime SetCurrentDirectoryA GetCurrentDirectoryA SetFilePointer SetFileTime WriteFile ReadFile FindClose GetDriveTypeA CopyFileTransactedA FreeLibrary GetProcessHeap LocalFree GetProcAddress lstrcatW LoadLibraryA LocalAlloc DeleteFileTransactedA SetEnvironmentVariableW ReadConsoleW EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileSizeEx HeapSize GetCommandLineW GetCommandLineA WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW HeapFree FileTimeToSystemTime CreateDirectoryTransactedA RaiseException RtlUnwind TerminateProcess InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SetCurrentDirectoryW CreateDirectoryW CreateFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI SetLastError DeviceIoControl GetModuleHandleW CopyFileW CreateHardLinkW FormatMessageA EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount GlobalFree GetProcAddress LocalAlloc LocalFree ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetDesktopWindow wsprintfW wsprintfA GetSystemMetrics EnumDisplayDevicesA GetWindowDC GetWindowRect GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW

gdi32

BitBlt SaveDC SelectObject CreateDIBSection CreateCompatibleDC GetDeviceCaps DeleteDC RestoreDC DeleteObject

advapi32

GetTokenInformation CryptGetHashParam CryptDestroyHash RegQueryValueExA GetUserNameA CreateProcessWithTokenW OpenProcessToken RegOpenKeyExA ConvertSidToStringSidW DuplicateTokenEx RegQueryValueExW CryptReleaseContext RegCloseKey RegEnumKeyExW RegOpenKeyExW CryptAcquireContextA CredEnumerateW CredFree CryptCreateHash CryptHashData

shell32

SHGetFolderPathA ShellExecuteA SHGetSpecialFolderPathW

ole32

CoInitialize CoUninitialize CoTaskMemFree CoCreateInstance

userenv

GetUserProfileDirectoryA

ktmw32

RollbackTransaction CreateTransaction CommitTransaction

bcrypt

BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider

crypt32

CryptStringToBinaryA CryptUnprotectData

shlwapi

StrCmpNW StrStrIW

winhttp

WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpen WinHttpOpenRequest WinHttpReceiveResponse WinHttpReadData

gdiplus

GdiplusStartup GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdipSaveImageToFile

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

429KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Zipper@0

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Zipper@0

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Zipper@0

Size

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Zipper@1

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NEAS.82c07e8ff1ad653a08e7baeff3df4fb0.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

userenv

ktmw32

bcrypt

crypt32

shlwapi

winhttp

gdiplus

wtsapi32

generic