NEAS[.]1f94d2781fd7e184b4fca1ae044b5d80[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.1f94d2781fd7e184b4fca1ae044b5d80.exe
Size

2.7MB
MD5

1f94d2781fd7e184b4fca1ae044b5d80
SHA1

b8459558f7583a73f85a9a49798601e1745d4a87
SHA256

4e1bdbf2df182385baf59882f365834745e3f323d2aa55e57180b2d9b65f73c0
SHA512

0d1e5adca20063f524153bcbedd3c105be0dcc8c336b0b0d84f1767d8cdb626b63e842267ab7f96f562eb030107d6ab7d9164579603372b21c017bcf1ed2826d
SSDEEP

49152:KxrceI/lIRYraisQhFCUK8vYYYYYYYYYYYRYYYYYYYYYYE3iA7/eFUJN9ojoso2W:8rcPlIWZvYYYYYYYYYYYRYYYYYYYYYY4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.1f94d2781fd7e184b4fca1ae044b5d80.exe

Files

NEAS.1f94d2781fd7e184b4fca1ae044b5d80.exe
.exe windows:6 windows x64

6422e341c67ba0880e012f8c7c634c21

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegCreateKeyW
RegCloseKey
RegOpenKeyExW
RegGetValueW
EventWrite
EventEnabled
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueExW
GetLengthSid
GetTokenInformation
OpenProcessToken
RegCreateKeyExW
RegSetValueExW
EventRegister
RegDeleteKeyExW
EventUnregister
TraceMessage
RegOpenKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumValueW
LsaOpenPolicy
GetSidSubAuthorityCount
LsaClose
IsValidSid
LsaFreeMemory
StartTraceW
EnableTraceEx
StopTraceW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
StartServiceW
CreateWellKnownSid
RegEnumKeyExW
GetSidSubAuthority
LsaLookupSids
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CheckTokenMembership
QueryServiceStatus
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ConvertStringSidToSidW
OpenThreadToken

kernel32

DelayLoadFailureHook
LoadLibraryExA
ReadFile
GetFileSize
CreateFileW
FlushInstructionCache
RaiseException
SetLastError
OpenThread
GetSystemTimeAsFileTime
GetLocaleInfoW
GetDateFormatW
GetTimeFormatW
GetLocalTime
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
OpenEventW
InterlockedPopEntrySList
FindClose
FindNextFileW
GetLongPathNameW
SetProcessShutdownParameters
GetStartupInfoW
ReleaseMutex
CreateMutexW
InitializeCriticalSection
DeleteCriticalSection
VirtualAlloc
InterlockedPushEntrySList
SetUnhandledExceptionFilter
QueryPerformanceCounter
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
VirtualFree
RtlCaptureContext
lstrcmpiW
CompareStringOrdinal
FindFirstFileW
SetErrorMode
CreateEventW
GetSystemDirectoryW
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryW
GetUserDefaultUILanguage
WaitForSingleObject
SetTermsrvAppInstallMode
GetFileAttributesW
RegisterApplicationRestart
GlobalGetAtomNameW
ExpandEnvironmentStringsW
SystemTimeToFileTime
GetSystemTime
MulDiv
GetTickCount64
GetThreadPriority
LeaveCriticalSection
EnterCriticalSection
SetEvent
GetCurrentThread
SetThreadPriority
GetTickCount
GetUserDefaultLangID
ExitProcess
HeapDestroy
UnmapViewOfFile
MapViewOfFile
SearchPathW
GetDynamicTimeZoneInformation
GetTimeZoneInformation
GetBinaryTypeW
QueryPerformanceFrequency
QueueUserWorkItem
LoadLibraryExW
GetProductInfo
TerminateThread
CreateIoCompletionPort
GetQueuedCompletionStatus
LoadLibraryA
DeleteFileW
GetProcessId
GetModuleHandleA
GetWindowsDirectoryW
CompareStringW
lstrcmpA
CompareFileTime
QueryFullProcessImageNameW
CreateFileMappingW
ResetEvent
WideCharToMultiByte
GlobalFree
DuplicateHandle
GetCurrentDirectoryW
WaitForMultipleObjects
GetComputerNameW
GlobalLock
GlobalUnlock
GlobalAlloc
lstrlenA
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
LockResource
LoadResource
FindResourceExW
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcess
GetCommandLineW
GetPrivateProfileStringW
GetModuleFileNameW
CreateProcessW
lstrlenW
OpenProcess
LocalFree
LocalAlloc
QueryInformationJobObject
Sleep
CreateThread
SetPriorityClass
GetPriorityClass
ResumeThread
AssignProcessToJobObject
SetInformationJobObject
GetLastError
CreateJobObjectW
CloseHandle

gdi32

LPtoDP
GetRgnBox
OffsetViewportOrgEx
GetStockObject
GdiFlush
CombineRgn
OffsetRgn
SetLayout
SetWindowOrgEx
StretchBlt
GetTextExtentPoint32W
CreatePen
Polyline
GetRegionData
GetTextColor
GetLayout
GetTextMetricsW
ExtCreateRegion
SetDIBits
SelectClipRgn
SetViewportOrgEx
GetViewportOrgEx
IntersectClipRect
GetClipRgn
CreateRectRgn
GetBkColor
PatBlt
CreateBitmap
SetBkMode
SetTextColor
SetBkColor
OffsetWindowOrgEx
CreateCompatibleBitmap
GetTextExtentPointW
GetClipBox
GetObjectW
GdiAlphaBlend
BitBlt
GetDeviceCaps
CreateFontIndirectW
CreateRectRgnIndirect
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
ExtTextOutW

user32

CopyRect
SetRect
CreateWindowExW
DialogBoxParamW
GetClassInfoW
GetClassInfoExW
GetMenuItemInfoW
GetMenuItemCount
DefWindowProcW
ActivateKeyboardLayout
GetCursorPos
InsertMenuW
GetMenuStringW
SetMenuItemInfoW
InsertMenuItemW
IsChild
IsWinEventHookInstalled
IsProcessDPIAware
IsRectEmpty
UnionRect
GetClassLongW
SetClassLongW
GetGUIThreadInfo
GetDlgCtrlID
GetNextDlgGroupItem
GetNextDlgTabItem
MoveWindow
ChildWindowFromPointEx
GetWindowDC
CharUpperW
UnregisterClassW
FrameRect
WindowFromDC
SendMessageCallbackW
UpdateLayeredWindow
GetUserObjectInformationW
GetProcessWindowStation
GetThreadDesktop
ShowWindowAsync
BringWindowToTop
GetClassLongPtrW
GetIconInfo
RegisterShellHookWindow
DeregisterShellHookWindow
FlashWindowEx
SetThreadDesktop
EndTask
OpenInputDesktop
CloseDesktop
GetMenuState
IsZoomed
SetScrollInfo
GetScrollInfo
SetScrollPos
InternalGetWindowText
GetWindowInfo
GetCaretBlinkTime
SetLayeredWindowAttributes
GetLayeredWindowAttributes
GetUpdateRect
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetFocus
GetAncestor
ReleaseCapture
GetDoubleClickTime
RegisterWindowMessageW
SetWindowTextW
SetWindowPlacement
SetRectEmpty
EnumDisplayMonitors
InflateRect
EqualRect
UpdateWindow
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
CharPrevW
GetMessageW
TranslateMessage
DispatchMessageW
CreatePopupMenu
GetMenuDefaultItem
SendNotifyMessageW
LockSetForegroundWindow
ChangeWindowMessageFilterEx
IntersectRect
MonitorFromWindow
IsWindowVisible
GetForegroundWindow
EnumWindows
GetParent
IsWindow
TranslateAcceleratorW
WaitMessage
GetWindowTextW
GetClientRect
TrackPopupMenuEx
SetActiveWindow
GetKeyState
GhostWindowFromHungWindow
RegisterClassW
LoadCursorW
SubtractRect
RedrawWindow
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
InvalidateRect
OffsetRect
SendMessageTimeoutW
SetWindowRgn
UpdateLayeredWindowIndirect
GetWindowRgnBox
LoadImageW
GetWindowPlacement
SetForegroundWindow
GetLastInputInfo
RemovePropW
GetLastActivePopup
SwitchToThisWindow
MessageBeep
GetActiveWindow
GetFocus
SetCursor
UnregisterHotKey
RegisterHotKey
SendDlgItemMessageW
EndDialog
GetDesktopWindow
GetAsyncKeyState
ChildWindowFromPoint
SetCursorPos
GetMessagePos
BeginPaint
FillRect
DrawEdge
EndPaint
GetSystemMenu
EnableMenuItem
ExitWindowsEx
LoadIconW
DestroyIcon
IsIconic
DeleteMenu
CheckMenuItem
ModifyMenuW
WindowFromPoint
ClientToScreen
TrackPopupMenu
IsHungAppWindow
GetWindowThreadProcessId
AppendMenuW
CascadeWindows
TileWindows
LockWorkStation
ScreenToClient
RegisterClipboardFormatW
NotifyWinEvent
GetSysColor
DrawFocusRect
AdjustWindowRectEx
CopyIcon
MsgWaitForMultipleObjects
SetWinEventHook
RegisterClassExW
GetDlgItem
EnableWindow
GetDlgItemInt
SetDlgItemInt
IsDlgButtonChecked
IsWindowEnabled
CheckDlgButton
CallWindowProcW
SetCapture
DrawTextW
AdjustWindowRect
CalculatePopupWindowPosition
GetMessageExtraInfo
GetCapture
SetGestureConfig
DrawIconEx
RemoveMenu
SetMenuDefaultItem
LoadMenuW
GetSubMenu
AllowSetForegroundWindow
LoadAcceleratorsW
TrackMouseEvent
CharNextW
GetWindow
GetSysColorBrush
GetPropW
HungWindowFromGhostWindow
SetWindowCompositionAttribute
GetWindowLongW
MsgWaitForMultipleObjectsEx
EnumChildWindows
SendMessageW
PtInRect
GetKeyboardLayout
GetWindowRect
DestroyMenu
SystemParametersInfoW
ShowWindow
MapWindowPoints
SetTimer
SetPropW
KillTimer
SetWindowPos
GetWindowLongPtrW
PostQuitMessage
SetWindowLongPtrW
DestroyWindow
ShutdownBlockReasonCreate
LoadStringW
PostMessageW
PeekMessageW
ReleaseDC
GetDC
FindWindowW
GetSystemMetrics
GetShellWindow
GetClassNameW

msvcrt

_vsnwprintf
free
wcsstr
iswalpha
wcschr
realloc
_wcsicmp
cosf
_wtoi
memcmp
sqrt
ceil
bsearch
__wgetmainargs
__C_specific_handler
_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_commode
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
__set_app_type
memmove
memcpy
memset
_fmode
malloc
sin

ntdll

WinSqmSetString
WinSqmSetDWORD
WinSqmAddToStreamEx
NtSetSystemInformation
WinSqmAddToStream
WinSqmEventEnabled
WinSqmIsOptedIn
NtSetInformationProcess
NtQueryInformationToken
NtOpenProcessToken
NtClose
NtOpenThreadToken
RtlGetProductInfo
EtwEventEnabled
EtwEventWrite
NtQueryInformationProcess

shlwapi

StrStrIW
ord219
ord467
AssocQueryStringW
PathQuoteSpacesW
ord433
SHDeleteKeyW
ord560
ord24
SHRegGetUSValueW
ord548
ord630
ord212
ord184
ord164
ord175
ord559
PathIsNetworkPathW
ord213
SHOpenRegStream2W
ord631
SHRegGetBoolUSValueW
ord172
SHStrDupW
StrChrIW
ord413
ord478
ord460
PathFileExistsW
PathGetDriveNumberW
ord204
ord165
ord197
ord157
ord292
PathRemoveFileSpecW
PathIsDirectoryW
ord199
ord176
SHRegGetValueW
ord270
ChrCmpIW
ord510
AssocQueryKeyW
PathStripPathW
ord509
PathIsRootW
ord156
PathParseIconLocationW
StrCmpIW
ord437
StrCmpW
PathIsPrefixW
ord571
ord225
ord237
ord177
ord178
ord484
SHCreateStreamOnFileW
SHQueryInfoKeyW
StrCmpNW
StrTrimW
ord12
ord168
ord256
PathStripToRootW
StrRetToBufW
PathCommonPrefixW
ord479
ord503
ord502
ord236
SHStrDupA
ord154
PathRemoveExtensionW
ord487
PathIsFileSpecW
ord439
ord215
AssocCreate
ord632
ord476
ord217
StrRetToStrW
StrToIntW
StrChrW
ord8
ord9
ord158
PathCombineW
ord10
SHCreateThreadRef
SHSetThreadRef
ord174
SHGetValueW
PathFindFileNameW
PathRemoveArgsW
PathRemoveBlanksW
StrCmpNIW
PathGetArgsW
ord635
ord618
SHSetValueW
SHDeleteValueW
PathAppendW
ord16
ord278
ord240
ord629
ord193
ord163
PathFindExtensionW
ord279
ord388

shell32

ord814
ord885
ord165
SHCreateDataObject
SHGetLocalizedName
ord787
ord790
ord193
ord88
ord154
ord840
Shell_GetCachedImageIndexW
ord74
ord818
ord902
ord895
ord6
ord241
SHGetStockIconInfo
ord265
ord181
SHGetPropertyStoreForWindow
ord894
ord162
ord152
ord95
ord850
ord23
SHGetSpecialFolderLocation
SHCreateItemWithParent
SHBindToFolderIDListParent
SHBindToFolderIDListParentEx
ord28
SHChangeNotify
ord747
ord727
SHGetFileInfoW
ord100
ord85
ord18
SHParseDisplayName
ord155
ord190
SHGetFolderLocation
ord176
SHGetSpecialFolderPathW
SHBindToObject
ord89
ord245
ord200
ord723
ord68
ord680
SHGetKnownFolderIDList
ShellExecuteExW
ord899
ord188
ord660
ord201
SHGetNameFromIDList
ord892
SHCreateShellItem
ord67
ord17
ord2
ord711
SHChangeNotifyRegisterThread
ord19
ord16
ord25
ord21
ord137
ord733
ord753
ord644
ord645
ord4
SHGetPathFromIDListW
ord731
ord244
SHFileOperationW
SHGetFolderPathEx
SHUpdateRecycleBinIcon
ord60
ord896
ord64
ord61
SHBindToParent
SHGetFolderPathW
SHGetPathFromIDListA
ShellExecuteW
SHEnableServiceObject
ord54
ord254
ord91
ord132
SHGetIDListFromObject
ord886
SHCreateItemFromIDList
ord893
SHAddToRecentDocs
Shell_NotifyIconW
Shell_NotifyIconGetRect
ExtractIconExW
SHEvaluateSystemCommandTemplate
ord102
SHCreateShellItemArrayFromIDLists
ord22
ord134
DragQueryFileW
SHGetKnownFolderPath
SHCreateShellItemArrayFromShellItem
SHCreateItemFromParsingName
ord849

ole32

CoInitializeEx
CLSIDFromString
CoGetMalloc
CoGetInterfaceAndReleaseStream
RevokeDragDrop
RegisterDragDrop
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoFreeUnusedLibraries
CoRegisterMessageFilter
StringFromGUID2
OleUninitialize
OleInitialize
CoRevokeClassObject
CoRegisterClassObject
CoCreateInstance
CoTaskMemFree
CreateStreamOnHGlobal
ReleaseStgMedium
PropVariantClear
CreateBindCtx
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler

oleaut32

VariantInit
VariantClear
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString

explorerframe

ord110
ord111

uxtheme

GetThemeBackgroundExtent
GetThemeBackgroundRegion
GetThemeColor
IsThemePartDefined
GetThemeRect
DrawThemeIcon
GetBufferedPaintBits
BufferedPaintClear
IsAppThemed
IsCompositionActive
OpenThemeData
CloseThemeData
SetWindowTheme
GetThemeMetric
DrawThemeBackground
GetThemeTextExtent
DrawThemeText
GetThemeBool
DrawThemeParentBackground
GetWindowTheme
GetThemeBackgroundContentRect
GetThemePartSize
BeginBufferedPaint
DrawThemeTextEx
EndBufferedPaint
GetThemeMargins
BufferedPaintInit
BufferedPaintUnInit
IsThemeActive
ord86

powrprof

CallNtPowerInformation
PowerDeterminePlatformRole
GetPwrCapabilities

dwmapi

ord105
ord113
DwmEnableBlurBehindWindow
DwmSetWindowAttribute
DwmIsCompositionEnabled
DwmQueryThumbnailSourceSize
ord124
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
ord114
ord127

slc

SLGetWindowsInformationDWORD

gdiplus

GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipFree
GdipAlloc
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetCompositingMode

secur32

GetUserNameExW

rpcrt4

NdrClientCall3
I_RpcExceptionFilter
RpcStringFreeW
RpcBindingFree
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcBindingFromStringBindingW

propsys

PSCreateMemoryPropertyStore
VariantToStringAlloc
VariantToStringWithDefault
PropVariantToString
VariantToBooleanWithDefault
PropVariantToInt64
VariantToInt32WithDefault
PropVariantToBoolean
PropVariantToUInt64
PropVariantToUInt32
PropVariantToStringAlloc

Sections

.text
Size: 735KB - Virtual size: 734KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 187KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6422e341c67ba0880e012f8c7c634c21

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

shlwapi

shell32

ole32

oleaut32

explorerframe

uxtheme

powrprof

dwmapi

slc

gdiplus

secur32

rpcrt4

propsys

Sections

.text Size: 735KB - Virtual size: 734KB

.rdata Size: 187KB - Virtual size: 187KB

.data Size: 15KB - Virtual size: 16KB

.pdata Size: 52KB - Virtual size: 51KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 735KB - Virtual size: 734KB

.rdata
Size: 187KB - Virtual size: 187KB

.data
Size: 15KB - Virtual size: 16KB

.pdata
Size: 52KB - Virtual size: 51KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 10KB - Virtual size: 9KB