NEAS[.]2274d4a0bb1354032485b5565aa8af70[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2274d4a0bb1354032485b5565aa8af70.exe
Size

1.8MB
MD5

2274d4a0bb1354032485b5565aa8af70
SHA1

41e3426a0a0f5515285c6fe3abf806cea5eb461a
SHA256

2506beaefb21dfda9b6c61d364a95fc833449914981c04990b9633c1529e30e3
SHA512

b0d068bb774f65ef7857b311d38ff4cb09d2aa3baf204bfe9ad431112bccc96a05ad5054207609445b94bb3037e5d38bceb4dd76d1803ed7a33be05d7b606c16
SSDEEP

24576:mSL5A4+QpJfvTycD2jbYPWoyzLBamzYYK:vL5ATQpRvTycKooLx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2274d4a0bb1354032485b5565aa8af70.exe

Files

NEAS.2274d4a0bb1354032485b5565aa8af70.exe
.exe windows:6 windows x64

87dc575ad3770bbc18580fe6d8eaf56d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

python36

PyObject_CallObject
PyImport_ImportModule
PyImport_AddModule
Py_Finalize
Py_Initialize
PyErr_Print
PyRun_SimpleStringFlags
Py_BuildValue
PyModule_GetDict
PyBytes_AsString
PyObject_GetAttrString

kernel32

GetLastError
CreateFileW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
WideCharToMultiByte
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
RaiseException
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
RtlPcToFileHeader
RtlUnwindEx
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
HeapSize
HeapValidate
GetSystemInfo
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetCurrentThread
HeapReAlloc
HeapQueryInformation
GetFileType
OutputDebugStringA
OutputDebugStringW
WriteConsoleW
CreateThread
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage

Sections

.textbss
Size: - Virtual size: 652KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 362KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87dc575ad3770bbc18580fe6d8eaf56d

Headers

DLL Characteristics

File Characteristics

Imports

python36

kernel32

Sections

.textbss Size: - Virtual size: 652KB

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 362KB - Virtual size: 361KB

.data Size: 9KB - Virtual size: 20KB

.pdata Size: 75KB - Virtual size: 75KB

.idata Size: 5KB - Virtual size: 4KB

.gfids Size: 3KB - Virtual size: 3KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 283B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 11KB

.textbss
Size: - Virtual size: 652KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 362KB - Virtual size: 361KB

.data
Size: 9KB - Virtual size: 20KB

.pdata
Size: 75KB - Virtual size: 75KB

.idata
Size: 5KB - Virtual size: 4KB

.gfids
Size: 3KB - Virtual size: 3KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 283B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 11KB