NEAS[.]f5ebae3c0293aa077f5b524a1a6c27f0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.f5ebae3c0293aa077f5b524a1a6c27f0.exe
Size

520KB
MD5

f5ebae3c0293aa077f5b524a1a6c27f0
SHA1

72719d8128b44fcf7f5cba24ee50aa568a8b4bc9
SHA256

0a47b8c1bf6a6d6b500671660576e53e43598faaeae5995817553c63578b3bb0
SHA512

6bed621f26b32c41a8e3dc0c2b5bf5df6e28311e15de37194ef9d6f9d39a81f792057f00171e0c279499694aaaf936794aac2611511b945449f901832a3c41e3
SSDEEP

12288:ucaIwI04l7NNMrShPQ3VbK68jYQ+jAC7HRRK:j04lS3VbK68krAYK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f5ebae3c0293aa077f5b524a1a6c27f0.exe

Files

NEAS.f5ebae3c0293aa077f5b524a1a6c27f0.exe
.exe windows:4 windows x86

523485a21a78f17953137af611a96d1c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

lz32

LZOpenFileA
LZClose
LZCopy

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

imagehlp

MakeSureDirectoryPathExists

kernel32

SetEndOfFile
GetVolumeInformationA
GetFullPathNameA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GlobalFlags
GetProcessVersion
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
SizeofResource
GetCPInfo
GetOEMCP
SetErrorMode
FileTimeToSystemTime
FileTimeToLocalFileTime
RtlUnwind
HeapAlloc
HeapFree
GetStartupInfoA
GetCommandLineA
ExitProcess
UnlockFile
RaiseException
TerminateProcess
SetStdHandle
GetFileType
HeapSize
HeapReAlloc
GetTimeZoneInformation
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
CompareStringA
CompareStringW
SetEnvironmentVariableA
LockFile
FlushFileBuffers
DuplicateHandle
GetFileTime
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
LockResource
FindResourceA
LoadResource
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
GlobalLock
GlobalUnlock
MulDiv
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
FreeLibrary
GetPrivateProfileSectionNamesA
LoadLibraryA
lstrlenW
lstrcpyW
lstrcmpW
GetPrivateProfileIntA
GetTickCount
GetProfileStringA
Sleep
CompareFileTime
CopyFileA
MultiByteToWideChar
WriteProfileStringA
GlobalAlloc
GlobalFree
GetSystemDirectoryA
GetWindowsDirectoryA
lstrcmpA
FindNextFileA
GetPrivateProfileStringA
ReadFile
WriteFile
SetFilePointer
GetFileSize
SetLastError
GetLocalTime
MoveFileExA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
WritePrivateProfileStringA
DeleteFileA
lstrcpyA
RemoveDirectoryA
LocalAlloc
GetFileAttributesA
GetDiskFreeSpaceA
GetDriveTypeA
GetTempPathA
GetTempFileNameA
GetModuleFileNameA
lstrcatA
lstrcpynA
CreateDirectoryA
CreateFileA
CloseHandle
SetFileAttributesA
CreateProcessA
GetExitCodeProcess
FindFirstFileA
FindClose
GetLastError
FormatMessageA
LocalFree
GetVersionExA
GetModuleHandleA
GetProcAddress
GetCurrentProcess
lstrcmpiA
lstrlenA
GetACP

user32

GetMenuItemCount
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
UpdateWindow
DestroyMenu
InflateRect
CharUpperA
LoadStringA
GetClassNameA
PtInRect
LoadCursorA
GetSysColorBrush
InvalidateRect
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetForegroundWindow
GetWindow
RegisterWindowMessageA
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
EndDialog
SetActiveWindow
CreateWindowExA
GetSubMenu
CreateDialogIndirectParamA
DestroyWindow
SetCursor
PostQuitMessage
PostMessageA
UnhookWindowsHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
GetCursorPos
SetWindowsHookExA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GetParent
SetFocus
IsWindowEnabled
ShowWindow
SetWindowPos
MoveWindow
SetWindowLongA
GetDlgCtrlID
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetWindowLongA
IsDialogMessageA
SetDlgItemTextA
SendDlgItemMessageA
GetDlgItem
wsprintfW
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DrawFocusRect
DefDlgProcA
CharNextA
IsWindowUnicode
GetClassLongA
GetMenuItemID
GetSystemMetrics
DefWindowProcA
IsWindow
SetPropA
GetWindowRect
SetForegroundWindow
FindWindowA
LoadIconA
SendMessageA
AppendMenuA
GetSystemMenu
EnableWindow
GetClientRect
ScreenToClient
OffsetRect
MessageBoxA
GetActiveWindow
SendMessageTimeoutA
ExitWindowsEx
wsprintfA
PeekMessageA
GetLastActivePopup

gdi32

SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
IntersectClipRect
SetTextColor
GetDeviceCaps
CreateSolidBrush
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreateBitmap
PatBlt
CreateFontIndirectA
DPtoLP
SetBkMode
SetBkColor
SelectObject
RestoreDC
SaveDC
GetTextExtentPointA
BitBlt
CreateCompatibleDC
DeleteDC
GetStockObject
DeleteObject
CreateDIBitmap
GetObjectA

comdlg32

GetFileTitleA

winspool.drv

EnumFormsW
DocumentPropertiesA
SetPrinterA
DeletePrinterDriverA
DeletePrinterConnectionA
GetPrinterA
DeletePrinter
EnumPrinterDriversA
OpenPrinterW
AddFormA
SetFormA
OpenPrinterA
AddPrinterA
ClosePrinter
AddPortA
GetPrinterDataA
EnumPortsA
EnumMonitorsA
GetPrinterDriverDirectoryA
DeleteMonitorA
AddMonitorA
AddPrinterDriverA
EnumPrintersA

advapi32

StartServiceA
ControlService
QueryServiceStatus
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegDeleteValueA
RegEnumKeyExA
EnumDependentServicesA
OpenSCManagerA
RegDeleteKeyA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenServiceA

comctl32

ord17

Sections

.text
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 184KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

523485a21a78f17953137af611a96d1c

Headers

File Characteristics

Imports

lz32

version

imagehlp

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

Sections

.text Size: 256KB - Virtual size: 252KB

.rdata Size: 36KB - Virtual size: 34KB

.data Size: 40KB - Virtual size: 69KB

.rsrc Size: 184KB - Virtual size: 180KB

.text
Size: 256KB - Virtual size: 252KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 40KB - Virtual size: 69KB

.rsrc
Size: 184KB - Virtual size: 180KB