NEAS[.]4859966e558a63a05cb31265fa750780[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4859966e558a63a05cb31265fa750780.exe
Size

89KB
MD5

4859966e558a63a05cb31265fa750780
SHA1

377ced7d8a045688c9d4363d75940abc64e08711
SHA256

6a553f3d0e7c9b97f57609d2a0ddf9b5795ce63ad5abcd036d354bf102f89fed
SHA512

72bd07d325f42d85c0c8a43f484193511000d52346eae0bd329b8e000eb9ab3193fbd005b5084ea624ec6838bebc5d9ccfa188857375657281ed04593c337cac
SSDEEP

1536:rSwQRdOrLVlkfft7nwOZQ6Q1POEjGEDgMeZxIMGqA2Q228RroXn0JvuFZEQpUz:rydyL8f1TTAOEqtZAgQ228RroX0J2FZa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4859966e558a63a05cb31265fa750780.exe

Files

NEAS.4859966e558a63a05cb31265fa750780.exe
.exe windows:5 windows x64

dfdb3f30ba821a7e342fef67ea5da65f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ciril64

PARGet
EDIPrintf
EDIEtiquette
EDIGetVersion
debug
SQLError
SQLCode
SQLExecute
SQLFetch
SQLOpen
SQLCommit
SQLRollback
SQLBegin
MEMFree
EDIPrintFilter
PARFiltre
MEMMalloc
MEMSourceLine
MEMSourceName
EDIOpen
PARInit
SQLRelease
SQLClose
EDIClose
SQLConnect
PARPresent

kernel32

GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetCommandLineA
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
FlsAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
CloseHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapSize
GetLocaleInfoA
CreateFileA
SetStdHandle
FlushFileBuffers
MultiByteToWideChar
HeapAlloc
HeapReAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfdb3f30ba821a7e342fef67ea5da65f

Headers

DLL Characteristics

File Characteristics

Imports

ciril64

kernel32

Sections

.text Size: 59KB - Virtual size: 58KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 7KB - Virtual size: 15KB

.pdata Size: 2KB - Virtual size: 2KB

.text
Size: 59KB - Virtual size: 58KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 7KB - Virtual size: 15KB

.pdata
Size: 2KB - Virtual size: 2KB