NEAS[.]34009840762ffcd7c8c80832f319ce40[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.34009840762ffcd7c8c80832f319ce40.exe
Size

167KB
MD5

34009840762ffcd7c8c80832f319ce40
SHA1

592ab7c77cc0ed5ec08ca39fac06d308767ccb95
SHA256

2f55a0beef4e9ca69b14b69994d20072a4ff26ba42fe99431bfccb3f95164dc2
SHA512

3a30e15e1f80b8f3237dd9eaad709bd3ebb5d2d54413d9ac7abf0433be04d6d903cf4686c2558aabb28b271455705b55a8264e5ceb44d4a2e0cc6ba5e3350765
SSDEEP

3072:lQUcrL6KmL783vtpkBAoH66Gop/q/rQms3cp6L8EcSufWr7+HvZZsXILNeu9vcY2:lQfSKm/6kBoRop/q/rQm6k6QEcSzr6H0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.34009840762ffcd7c8c80832f319ce40.exe

Files

NEAS.34009840762ffcd7c8c80832f319ce40.exe
.exe windows:6 windows x86

cab71e19c04a41cbdb2e1b1d531fce98

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW

bthprops.cpl

BluetoothSdpGetAttributeValue
BluetoothSdpGetContainerElementData
BluetoothFindFirstDevice
BluetoothFindNextDevice
BluetoothSdpGetString
BluetoothFindDeviceClose

ws2_32

WSALookupServiceNextW
WSALookupServiceBeginW
WSAStartup
WSALookupServiceEnd
setsockopt
freeaddrinfo
htons
recv
send
getaddrinfo
select
closesocket
bind
__WSAFDIsSet
getsockopt
socket
WSAGetLastError
WSAAddressToStringW
connect

winmm

waveOutPrepareHeader
waveOutOpen
waveOutClose
waveOutUnprepareHeader
timeBeginPeriod
timeGetDevCaps
timeKillEvent
timeEndPeriod
timeSetEvent
waveOutWrite

cfgmgr32

CM_Get_Device_Interface_ListW
CM_Get_Device_Interface_List_SizeW

kernel32

QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExW
GetModuleHandleW
GlobalUnlock
GlobalLock
GlobalAlloc
SetThreadExecutionState
CreateThread
GetCurrentProcessId
GetLastError
Sleep
GetCurrentThreadId
SetThreadPriority
GetTickCount
WideCharToMultiByte
MultiByteToWideChar
CreateSemaphoreW
ReleaseSemaphore
ReleaseMutex
CreateMutexW
GetProcessHeap
HeapAlloc
CreateFileW
DeviceIoControl
CreatePipe
WriteFile
HeapFree
CreateProcessW
CloseHandle
GetSystemTimeAsFileTime
InitializeSListHead
ReadFile
WaitForSingleObject

user32

IsIconic
UpdateWindow
EnableMenuItem
PostQuitMessage
CheckMenuItem
FlashWindowEx
LoadCursorW
FindWindowW
TranslateMessage
EndPaint
DispatchMessageW
GetSubMenu
LoadAcceleratorsW
RegisterClassExW
DeleteMenu
GetMenu
LoadMenuW
DefWindowProcW
GetMessageW
TrackPopupMenu
CreatePopupMenu
TranslateAcceleratorW
LoadIconW
BeginPaint
wsprintfW
DialogBoxParamW
GetDlgItem
EndDialog
SendMessageW
SetWindowPos
GetWindowRect
EnableWindow
IsDlgButtonChecked
ShowWindow
LoadStringW
MessageBoxW
DestroyWindow
CreateDialogParamW
SetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
CreateWindowExW
GetCursorPos
SetForegroundWindow
InsertMenuW

shell32

Shell_NotifyIconW

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__std_exception_copy
__std_exception_destroy
memchr
__std_terminate
wcsstr
_purecall
memset
memmove
memcpy
_CxxThrowException
__current_exception
__current_exception_context
_except_handler4_common
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_controlfp_s
abort
_initialize_onexit_table
_register_onexit_function
_errno
_cexit
_seh_filter_exe
_set_app_type
_invalid_parameter_noinfo_noreturn
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
terminate
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
_invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf
_set_fmode
__p__commode
__acrt_iob_func
fread
__stdio_common_vfwprintf
fclose
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
fopen

api-ms-win-crt-convert-l1-1-0

wcstombs
_wtoi

api-ms-win-crt-string-l1-1-0

wcscpy_s

api-ms-win-crt-heap-l1-1-0

free
_callnewh
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_get_version_string
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_parse
opus_pcm_soft_clip
opus_strerror

Sections

.text
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cab71e19c04a41cbdb2e1b1d531fce98

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bthprops.cpl

ws2_32

winmm

cfgmgr32

kernel32

user32

shell32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 114KB - Virtual size: 114KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 10KB - Virtual size: 15KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 114KB - Virtual size: 114KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 10KB - Virtual size: 15KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 4KB - Virtual size: 4KB