NEAS[.]011dd1b99a8f880bf2454da686bb64a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.011dd1b99a8f880bf2454da686bb64a0.exe
Size

448KB
MD5

011dd1b99a8f880bf2454da686bb64a0
SHA1

9503cc46247c5334beb4412dc56a6285a5572e3f
SHA256

56270b13fccc87d2af2d3c842597d4e4d1a049080056aaa8d91cf6b6bd3ba805
SHA512

05576ee2cde7099386c2464e8e20d819d6483e241c67246d89dd81995d2b0eb76598c2dcd3c19b473e729f41703233389b4a5f223c8cb55fab007477e2b78601
SSDEEP

6144:UC+QLA/IX4IEgou1d8wVO/S5R0Z2y49hz8SHPQyIWCZ4umGb6yRihpZlxpK:8S4IH1i2718SHP3I/Z4Cb63lLK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.011dd1b99a8f880bf2454da686bb64a0.exe

Files

NEAS.011dd1b99a8f880bf2454da686bb64a0.exe
.dll windows:6 windows x86

03b12c0752d525be89249ee5c43a3148

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

wcspbrk
_wsplitpath_s
malloc
bsearch
memcpy
swprintf_s
_splitpath_s
_snprintf_s
_snwprintf_s
towupper
_heapmin
modf
_ftol2_sse
floor
_lock
__dllonexit
_unlock
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
_ltoa
_ultoa
strncpy_s
_errno
strtod
_ftol2
_ecvt
strchr
_mbsrev
_strnicmp
time
localtime
towlower
_wstat
wcscspn
swscanf_s
strcat_s
sprintf_s
_getcwd
strcpy_s
wcscat_s
wcstok
wcsncat_s
_wchdir
wcstol
wcsstr
wcschr
_itow
_ltow
memmove
_wcsnicmp
wcsncpy_s
wcsrchr
_vsnprintf
calloc
_wtol
_wcsicmp
_wfullpath
_wtoi
free
wcsncmp
_onexit
iswctype
wcscpy_s
memset

kernel32

GetSystemDirectoryA
GetModuleHandleA
OutputDebugStringW
LoadLibraryA
ExpandEnvironmentStringsA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetDateFormatA
GetTimeFormatA
GetCurrencyFormatA
GetNumberFormatA
FindResourceW
LoadResource
LockResource
FreeResource
GetTempPathW
GetTempFileNameW
DeleteFileW
MoveFileW
CreateFileW
CloseHandle
FindFirstFileW
FindNextFileW
FindClose
lstrlenW
GetCurrentProcessId
GetProcessVersion
InitializeCriticalSection
DeleteCriticalSection
GetVersion
VirtualQuery
GetSystemDirectoryW
WritePrivateProfileStringW
GetCurrentDirectoryW
GetWindowsDirectoryW
EnterCriticalSection
GetPrivateProfileStringW
GetLastError
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryExA
GetModuleFileNameA
WideCharToMultiByte
GetCurrentThreadId
GetSystemDefaultLCID
LeaveCriticalSection
GetUserDefaultLCID

user32

ReleaseDC
MessageBoxA
GetDC
CreateDialogParamW
DestroyWindow
CharToOemA
CharUpperW
GetDlgCtrlID
LoadCursorA
IsWindowEnabled
DialogBoxParamA
EndDialog
SetWindowLongA
RegisterWindowMessageA
GetWindowLongA
ShowWindow
GetWindowTextLengthW
SetWindowTextW
GetWindow
EnableWindow
SetWindowPos
SetFocus
CharLowerW
LoadStringW
GetParent
GetDesktopWindow
GetWindowRect
GetClientRect
ClientToScreen
MoveWindow
GetWindowTextW
DialogBoxParamW
GetDlgItem
SendMessageW
LoadCursorW
SetCursor
MessageBoxW
LoadStringA

advapi32

RegOpenKeyExW
RegOpenKeyExA
GetUserNameW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
RegQueryValueExA
RegCloseKey

gdi32

GetTextExtentPointW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

msjet40

ord185
ord112
ord110
ord157
ord56
ord316
ord158
ord304
ord108
ord120
ord159
ord179
ord172
ord126
ord310
ord136
ord145
ord317
ord133
ord140
ord151
ord132
ord138
ord178
ord137
ord302
ord319
ord156
ord146
ord311
ord169
ord154
ord103
ord130
ord107
ord153
ord109
ord104
ord176
ord150
ord906
ord167

mswstr10

ord3

Exports

Exports

AdvancedDialogProc
ConfigDSN
ConfigDSNExW
ConfigDSNW
ConfigDialogProc
ConfigDriverW
DefTxtFmtDlgProc
DllMain
InitDialogAgain
InitializeLoginDialog
InvisibleSelectDb
LoadByOrdinal
LoginDialogProc
OpenDirHook
RepairCompactProc
SQLAllocConnect
SQLAllocEnv
SQLAllocHandle
SQLAllocStmt
SQLBindCol
SQLBindParameter
SQLBulkOperations
SQLCancel
SQLCloseCursor
SQLColAttributeW
SQLColumnsW
SQLConnectW
SQLCopyDesc
SQLDescribeColW
SQLDisconnect
SQLDriverConnectW
SQLEndTran
SQLExecDirectW
SQLExecute
SQLExtendedFetch
SQLFetch
SQLFetchScroll
SQLFreeConnect
SQLFreeEnv
SQLFreeHandle
SQLFreeStmt
SQLGetConnectAttrW
SQLGetCursorNameW
SQLGetData
SQLGetDescFieldW
SQLGetDescRecW
SQLGetDiagFieldW
SQLGetDiagRecW
SQLGetFunctions
SQLGetInfoW
SQLGetStmtAttrW
SQLGetTypeInfoW
SQLMoreResults
SQLNativeSqlW
SQLNumParams
SQLNumResultCols
SQLParamData
SQLPrepareW
SQLProcedureColumnsW
SQLProceduresW
SQLPutData
SQLRowCount
SQLSetConnectAttrW
SQLSetCursorNameW
SQLSetDescFieldW
SQLSetDescRec
SQLSetEnvAttr
SQLSetPos
SQLSetScrollOptions
SQLSetStmtAttrW
SQLSpecialColumnsW
SQLStatisticsW
SQLTablesW
SelectIndexDlgProc
SelectUIdxDlgProc

Sections

.text
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sdbid
Size: 4KB - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

03b12c0752d525be89249ee5c43a3148

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

gdi32

comdlg32

msjet40

mswstr10

Exports

Exports

Sections

.text Size: 228KB - Virtual size: 227KB

.data Size: 28KB - Virtual size: 26KB

.sdbid Size: 4KB - Virtual size: 476B

.rsrc Size: 36KB - Virtual size: 33KB

.reloc Size: 148KB - Virtual size: 145KB

.text
Size: 228KB - Virtual size: 227KB

.data
Size: 28KB - Virtual size: 26KB

.sdbid
Size: 4KB - Virtual size: 476B

.rsrc
Size: 36KB - Virtual size: 33KB

.reloc
Size: 148KB - Virtual size: 145KB