NEAS[.]3bf6e6165e53ef5afe6833764b8f3180[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3bf6e6165e53ef5afe6833764b8f3180.exe
Size

529KB
MD5

3bf6e6165e53ef5afe6833764b8f3180
SHA1

d82e0a2f9822d02e893bc991d2976f5c8353f3ac
SHA256

98f950a530c5b4df81fca77b191818dbd9c8f6a94e002dfef4dda60b8e358e40
SHA512

e2681618968b695c77f5562376fe81b4b70d947c8e06cc50685059688cf8d047a25049023005a7f4a70d665519b15775867d78a7fbfd66be40bdf298b029ae54
SSDEEP

6144:gPuhD9pRLlu7eFeYOlZvGgiKF1qZeLihprwPx:Uu9uSFeYOlUgbXqZDwp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3bf6e6165e53ef5afe6833764b8f3180.exe

Files

NEAS.3bf6e6165e53ef5afe6833764b8f3180.exe
.exe windows:6 windows x86

679804aa004d229f87f8c88a69c84a0e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueExW
RegCreateKeyW
RegEnumValueW
RegDeleteValueW
RegOpenKeyW
RegEnumKeyW
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegRenameKey
GetSecurityDescriptorControl
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSetKeySecurity
GetSecurityInfo
RegConnectRegistryW
RegRestoreKeyW
RegSaveKeyW
RegFlushKey
RegSetValueW
RegOpenKeyExW
RegUnLoadKeyW
RegLoadKeyW
MapGenericMask
GetNamedSecurityInfoW
SetSecurityDescriptorGroup
GetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetNamedSecurityInfoW
SetSecurityInfo
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSidSubAuthority
GetSidSubAuthorityCount
LookupAccountSidW
GetInheritanceSourceW
InitializeAcl
IsValidSecurityDescriptor
RegSetValueExA
RegCloseKey

kernel32

LoadLibraryExA
InterlockedCompareExchange
GetProcAddress
DelayLoadFailureHook
MulDiv
LoadLibraryW
FreeLibrary
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
MultiByteToWideChar
GetFileSize
SetFilePointer
GetLastError
OutputDebugStringW
ReadFile
CreateFileW
RegOpenKeyExA
RegQueryValueExA
ExpandEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
Sleep
InterlockedExchange
lstrcmpW
GetCurrentProcess
CloseHandle
HeapSetInformation
GetThreadLocale
GetModuleHandleW
RegisterApplicationRestart
ExitProcess
WideCharToMultiByte
WriteFile
DeleteFileW
GetCommandLineW
GetLongPathNameW
GetProcessHeap
FormatMessageW
GetWindowsDirectoryW
lstrcmpiW
LocalFree
LocalAlloc
GetComputerNameW
lstrlenW
LocalReAlloc
GlobalAlloc
GlobalLock
GlobalUnlock
SearchPathW
LoadLibraryA

gdi32

GetTextExtentPoint32W
SetAbortProc
StartDocW
StartPage
SetViewportOrgEx
EndPage
EndDoc
AbortDoc
DeleteDC
CreateBitmap
CreatePatternBrush
PatBlt
ExcludeClipRect
SelectClipRgn
DeleteObject
SetBkColor
SetTextColor
GetTextMetricsW
SelectObject
CreateFontIndirectW
GetDeviceCaps
ExtTextOutW
GetStockObject

user32

EnableWindow
DialogBoxParamW
DrawMenuBar
InsertMenuItemW
DeleteMenu
GetKeyState
GetMenu
GetMenuItemInfoW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsIconic
DestroyIcon
LoadImageW
GetSysColor
SetCursor
ShowCursor
ShowWindow
SetWindowPlacement
CreateWindowExW
GetProcessDefaultLayout
LoadStringW
GetMessageW
ScreenToClient
SetCursorPos
DispatchMessageW
ClientToScreen
GetDesktopWindow
LoadIconW
PostMessageW
SetMenuDefaultItem
InsertMenuW
GetMenuItemID
CheckMenuItem
UpdateWindow
RegisterClassExW
CheckDlgButton
DestroyWindow
CreateDialogParamW
DrawAnimatedRects
IntersectRect
GetClientRect
SetWindowTextW
GetMessagePos
CharNextW
TranslateMessage
TranslateAcceleratorW
LoadAcceleratorsW
SetForegroundWindow
GetLastActivePopup
BringWindowToTop
FindWindowW
GetWindow
IsDialogMessageW
PeekMessageW
CharUpperBuffW
CharUpperW
IsCharAlphaNumericW
SetWindowPos
MapWindowPoints
MoveWindow
GetSystemMetrics
GetWindowRect
GetDlgItem
SendDlgItemMessageW
SetDlgItemTextW
SetWindowLongW
DefWindowProcW
ReleaseDC
GetDC
SetScrollInfo
DestroyCaret
ReleaseCapture
KillTimer
SetCaretPos
ScrollWindowEx
InvalidateRect
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetWindowPlacement
PostQuitMessage
GetDlgItemInt
SetMenuItemInfoW
GetWindowTextLengthW
CallWindowProcW
IsDlgButtonChecked
GetDlgItemTextW
GetClipboardData
EndDialog
GetWindowLongW
GetParent
GetWindowTextW
SendMessageW
CheckRadioButton
RegisterClipboardFormatW
LoadCursorW
ModifyMenuW
RegisterClassW
SetCapture
SetTimer
BeginPaint
EndPaint
SetFocus
LoadMenuW
GetSubMenu
EnableMenuItem
IsClipboardFormatAvailable
TrackPopupMenuEx
DestroyMenu
HideCaret
MessageBeep
CharLowerW
CreateCaret
ShowCaret

msvcrt

_controlfp
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_vsnwprintf
memcpy
atoi
memset
iswctype
wcschr
wcsncmp
wcsrchr
_wcsnicmp
_resetstkoflw
iswprint
_purecall
__getmainargs
_cexit
_except_handler4_common
memmove

shlwapi

StrChrIW
StrChrW
StrRChrW
ord388
StrToIntW
StrStrIW
ord219

comctl32

ord338
ord334
ord337
ord340
InitCommonControlsEx
ord329
CreateStatusWindowW
ImageList_SetBkColor
ImageList_Create
ImageList_ReplaceIcon
ord236
ord2
ord4
ImageList_Destroy

comdlg32

GetSaveFileNameW
GetOpenFileNameW
PrintDlgExW

shell32

SHGetStockIconInfo
DragQueryFileW
DragFinish
ShellAboutW

authz

AuthzInitializeResourceManager
AuthzInitializeContextFromSid
AuthzAccessCheck
AuthzFreeContext
AuthzFreeResourceManager

aclui

ord2

ole32

CoCreateInstance
ReleaseStgMedium
CoInitializeEx
CoUninitialize

ulib

?NewBuf@DSTRING@@UAEEK@Z
??1OBJECT@@UAE@XZ
?Compare@OBJECT@@UBEJPBV1@@Z
??0OBJECT@@IAE@XZ
??0DSTRING@@QAE@XZ
?Initialize@WSTRING@@QAEEPBV1@KK@Z
?Strcat@WSTRING@@QAEEPBV1@@Z
?Initialize@WSTRING@@QAEEPBGK@Z
??1DSTRING@@UAE@XZ
?SPrintfAppend@DSTRING@@UAAEPBGZZ
?Initialize@ARRAY@@QAEEKK@Z
??0ARRAY@@QAE@XZ
?Resize@DSTRING@@UAEEK@Z
?SPrintf@DSTRING@@UAAEPBGZZ

clb

ClbAddData
ClbSetColumnWidths

ntdll

RtlInitUnicodeString
RtlIoDecodeMemIoResource
RtlCmDecodeMemIoResource
RtlFreeUnicodeString
RtlCreateUnicodeString
RtlAllocateHeap
RtlFreeHeap

uxtheme

SetWindowTheme

Sections

.text
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 258KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

679804aa004d229f87f8c88a69c84a0e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

shlwapi

comctl32

comdlg32

shell32

authz

aclui

ole32

ulib

clb

ntdll

uxtheme

Sections

.text Size: 109KB - Virtual size: 109KB

.data Size: 258KB - Virtual size: 260KB

.rsrc Size: 13KB - Virtual size: 13KB

.reloc Size: 147KB - Virtual size: 146KB

.text
Size: 109KB - Virtual size: 109KB

.data
Size: 258KB - Virtual size: 260KB

.rsrc
Size: 13KB - Virtual size: 13KB

.reloc
Size: 147KB - Virtual size: 146KB