NEAS[.]158dd8e2ef99bfd86fa8bd69f245a940[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.158dd8e2ef99bfd86fa8bd69f245a940.exe
Size

127KB
MD5

158dd8e2ef99bfd86fa8bd69f245a940
SHA1

0cd8eabd89c26a3fb120ac9b2b8fc774fcb42012
SHA256

b799ff712de2cb3c8130b6a24c11e353e329fbdba2c187d6d8ce7d14344a47ee
SHA512

2363c5c40312ef1d4a2d2754e9fd5244dd62edaf83c28aa7643e0f9f34e7e54969c8abd96bd79c8429cc78c9fc31eb73b33ec97cc86213ff900894a84fbfccb0
SSDEEP

1536:2ZP/K+kgzUVPgOc7ufsJycS2UrVN24GtyObeBX+F8359wAFeP6MtL:43K+7UVPRcS2Urg0XFePz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.158dd8e2ef99bfd86fa8bd69f245a940.exe

Files

NEAS.158dd8e2ef99bfd86fa8bd69f245a940.exe
.exe windows:5 windows x86

c12b1f6ed7f13484e61b36f9342bf5c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

plib200r

inimap
wc_flsh
wc_wset
smcols
winmtf
putusr
wrtnbk
fotnbk
iniprg
qorcnt
qahide
qadisp
blkshw
exfil
filtyp
settrg
blkhid
smclr
qashow
remvrs
qqtgln
fr4in
inin
setpas
blddef
errgo
get1nm
getonm
strpst
mskpas
inprud
smsend
cncat
chekit
inprou
asks
settog
pasbch
endmsk
qquest
txardc
blkdec
getusr
dished
smtitl
fncbut
nwmask
mapbch
daw512
dacgpt
dar512
clun
seteda
cbchek
amtcm3
amtcm2
optqit
amtcm1
clsfil
filerr
lenstr
opnda
distxt
i2asc
r4asc
opnnbk
puteda

libifcoremd

for_write_seq_fmt
for_cpstr
for_cpystr
for_write_seq_fmt_xmit

libmmd

__libm_sse2_logf
__libm_sse2_expf
__libm_sse2_atanf
coshf
__libm_sse2_powf
__libm_sse2_cosf
__libm_sse2_sinf
__libm_sse2_sincosf

msvcr100

_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit

kernel32

UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
SetUnhandledExceptionFilter
EncodePointer
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c12b1f6ed7f13484e61b36f9342bf5c0

Headers

DLL Characteristics

File Characteristics

Imports

plib200r

libifcoremd

libmmd

msvcr100

kernel32

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 129KB

.rsrc Size: 80KB - Virtual size: 79KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 129KB

.rsrc
Size: 80KB - Virtual size: 79KB

.reloc
Size: 4KB - Virtual size: 4KB