NEAS[.]edccf720431285bf3b0e24b89b590a80[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.edccf720431285bf3b0e24b89b590a80.exe
Size

1.7MB
MD5

edccf720431285bf3b0e24b89b590a80
SHA1

ae6d64d488c7a028ee7470617212de073b1bcf5d
SHA256

1cbe79c64ad77d0a268a469fe297c21086f6e6c0906482de9224ecb3b05295b5
SHA512

ba2402d5e6612ce5cbec0d4c96f39c4e0ba11ec4226729b2f8214258ca77f3db3765a24a591e208b80cd3a046e1fe83e64b0d31b5a75898e8e3952c00f2c387b
SSDEEP

49152:dEvVVCMqkPs3sTq5rsgQ2ZmQyLfYnp7h:5hdh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.edccf720431285bf3b0e24b89b590a80.exe

Files

NEAS.edccf720431285bf3b0e24b89b590a80.exe
.dll regsvr32 windows:6 windows x64

bee12122c8218d8de9a671fa2249ad08

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

RtlUnwind
GetCommandLineW
GetModuleHandleW
GetCurrentProcess
SetFileAttributesW
GetFileAttributesW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetStdHandle
TerminateProcess
LocalFree
GetSystemInfo
CreateToolhelp32Snapshot
Process32First
Process32Next
GlobalSize
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
GetModuleFileNameW
GetDriveTypeW
DeleteFileW
LoadLibraryExW
FreeLibrary
GetLongPathNameW
GetLocalTime
GetDateFormatW
GetTimeFormatW
TerminateThread
GetThreadPriority
ResumeThread
RaiseException
GetVersionExW
WideCharToMultiByte
WriteFile
FlushFileBuffers
GetCurrentProcessId
GetCurrentThreadId
FindFirstFileW
FindClose
FindNextFileW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
MulDiv
GetLocaleInfoW
GetUserDefaultLCID
CreateThread
QueryPerformanceCounter
QueryPerformanceFrequency
GetStringTypeW
FlsAlloc
FlsSetValue
FlsFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
EncodePointer
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
SetLastError
GetFullPathNameW
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetCurrentDirectoryW
CreateDirectoryW
ExitThread
FreeLibraryAndExitThread
HeapFree
HeapAlloc
GetFileType
IsValidCodePage
GetACP
GetOEMCP
IsValidLocale
EnumSystemLocalesW
LCMapStringW
HeapReAlloc
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
GetFileSizeEx
HeapSize
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
WriteConsoleW
LoadLibraryExA
VirtualQuery
VirtualProtect
SetThreadPriority
GetCurrentThread
DecodePointer
InitializeCriticalSectionEx
OutputDebugStringW
GetProcAddress
LoadLibraryW
ResetEvent
SetEvent
WaitForMultipleObjects
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CloseHandle
CreateEventW
WaitForSingleObject
DeviceIoControl
GetLastError
CreateFileW
MultiByteToWideChar
OpenFile
GetDiskFreeSpaceW
FlsGetValue
Sleep

user32

EnumWindows
WaitMessage
FindWindowExW
GetClassNameW
GetWindow
WindowFromPoint
LoadCursorW
GetWindowTextLengthW
GetWindowTextW
GetCursorPos
SetCursor
EnumDisplayMonitors
MonitorFromRect
GetSystemMetrics
GetMonitorInfoW
MapVirtualKeyW
GetKeyState
SendInput
GetKeyboardLayout
MapVirtualKeyExW
GetWindowPlacement
SetWindowPlacement
GetMessagePos
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SystemParametersInfoW
RegisterClipboardFormatW
SetClipboardData
DestroyCursor
DrawIcon
CreateIconFromResource
CreateCursor
RedrawWindow
ClientToScreen
GetClientRect
GetWindowRect
PostMessageW
SetWindowLongW
GetWindowLongW
SetWindowPos
SetWindowTextW
ShowWindow
IsWindowEnabled
EnableWindow
IsIconic
IsZoomed
DestroyWindow
IsWindow
ValidateRect
FlashWindowEx
PeekMessageW
SetWindowLongPtrW
GetWindowLongPtrW
DefWindowProcW
MessageBeep
EndPaint
BeginPaint
GetDoubleClickTime
GetGUIThreadInfo
MsgWaitForMultipleObjects
CloseClipboard
GetClipboardData
LoadImageW
GetDesktopWindow
CharLowerBuffA
UnregisterClassW
ChangeClipboardChain
SetClipboardViewer
CreateWindowExW
DestroyIcon
KillTimer
FindWindowW
GetClassInfoW
RegisterClassW
SetTimer
SetForegroundWindow
AttachThreadInput
GetForegroundWindow
LockSetForegroundWindow
ReleaseCapture
SetCapture
GetCapture
GetLastActivePopup
SetParent
GetParent
SetWindowRgn
UpdateWindow
EmptyClipboard
IsClipboardFormatAvailable
OpenClipboard
GetWindowThreadProcessId
SendMessageW
MessageBoxW
InvalidateRect

advapi32

RegEnumKeyA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoCreateGuid
PropVariantClear
OleUninitialize
CoUninitialize
CoInitialize
CoTaskMemFree
CLSIDFromString
CoCreateInstance

oleaut32

SysAllocString
SysFreeString

imm32

ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext

gdi32

Ellipse
CreateSolidBrush
CreateEllipticRgn
SelectObject
DeleteObject
RestoreDC
SaveDC
CreateRectRgn

Exports

Exports

DllRegisterServer
GetOutputPlugin

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 445KB - Virtual size: 445KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bee12122c8218d8de9a671fa2249ad08

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

imm32

gdi32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 445KB - Virtual size: 445KB

.data Size: 85KB - Virtual size: 100KB

.pdata Size: 46KB - Virtual size: 46KB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 1024B - Virtual size: 864B

.reloc Size: 40KB - Virtual size: 39KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 445KB - Virtual size: 445KB

.data
Size: 85KB - Virtual size: 100KB

.pdata
Size: 46KB - Virtual size: 46KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 1024B - Virtual size: 864B

.reloc
Size: 40KB - Virtual size: 39KB