NEAS[.]3c9bafc90445384bba17ce66c419cd00[.]exe

General

Target

NEAS.3c9bafc90445384bba17ce66c419cd00.exe
Size

48KB
MD5

3c9bafc90445384bba17ce66c419cd00
SHA1

8561c19c6455fad2580d96bbd63820c158411e8b
SHA256

af5308d6d40377d4881ab328d896477a1eedacca870c1fbc9b43790fd42f75cb
SHA512

f09a2bbea463dd6efa3e97d1470ba4304b48f72c352e09b7dd73558aee6426c81bd8e6958a54cee46a9e4333b74bab61b8293ea57a5ab5881a86517cc745f49d
SSDEEP

768:o/3/spJK2zPshffmyJdS+MJcCnLkdAMasSVvn:a3/sp/shTJdgcCnLkdNasSJn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3c9bafc90445384bba17ce66c419cd00.exe

Files

NEAS.3c9bafc90445384bba17ce66c419cd00.exe
.dll windows:4 windows x86

a5049b84d47d09c19faafd0e69f94d06

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

pncrt

tolower
isupper
strncpy
_stricmp
__dllonexit
_onexit
_initterm
_adjust_fdiv
_ftol
memmove
_purecall
malloc
??2@YAPAXI@Z
free
??3@YAXPAX@Z
strchr
_putenv

kernel32

DisableThreadLibraryCalls
GetProcAddress
FreeLibrary
SetErrorMode
LoadLibraryA
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemInfo

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Exports

Exports

PNCodec_Close
PNCodec_GetMediaFormats
PNCodec_GetUIName
PNCodec_GetVersion
PNCodec_Input
PNCodec_Open
PNCodec_PreferredMediaFormat
PNCodec_QueryMediaFormat
PNCodec_StreamOpen
PNStream_Close
PNStream_GetIPNUnknown
PNStream_GetInputBufferSize
PNStream_GetProperty
PNStream_GetStreamHeader
PNStream_GetStreamHeaderSize
PNStream_Input
PNStream_OpenSettingsBox
PNStream_PostProcess
PNStream_ReleaseFrame
PNStream_SetDataCallback
PNStream_SetOutputPacketSize
PNStream_SetProperty
SetDLLAccessPath
_PNCodec_GetIPNUnknown@4

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5049b84d47d09c19faafd0e69f94d06

Headers

File Characteristics

Imports

pncrt

kernel32

advapi32

Exports

Exports

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 696B

.rsrc Size: 4KB - Virtual size: 984B

.reloc Size: 4KB - Virtual size: 932B

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 696B

.rsrc
Size: 4KB - Virtual size: 984B

.reloc
Size: 4KB - Virtual size: 932B