NEAS[.]5d414f7ef99d813c46dca8cbbed88ec0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5d414f7ef99d813c46dca8cbbed88ec0.exe
Size

1.7MB
MD5

5d414f7ef99d813c46dca8cbbed88ec0
SHA1

b53e966dbb40ca2b0cc34b9fc4f39d5f2b2ce41a
SHA256

c71dc4a3d68f26ff246cc08334b152ac86c8d4ca5920c896e1a7ca0ad63c4035
SHA512

0352e40b3557c3ae1186c9f27a7ba7acd52ab05b3188233a76abd189cf479ac449acc9a0f65b815209a37b9c590bf63a3c9d8e2cde64091c02ecdbf0f50ada65
SSDEEP

24576:UcQX/hr02Zfk3iPyvrtKGpf2VfWlcKu6Gavkg3NydIbbbI4IBAUZLYz7TJA:QP6tuscKu6GaXUT4IBAUZLY/Ty

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5d414f7ef99d813c46dca8cbbed88ec0.exe

Files

NEAS.5d414f7ef99d813c46dca8cbbed88ec0.exe
.exe windows:4 windows x86

01239aaba8a02471fb245d42a33e17c8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

libeay32

ord754
ord227
ord223
ord624
ord641
ord333
ord222
ord464
ord323
ord477
ord479
ord962
ord267
ord269
ord268
ord2438
ord784
ord808
ord581
ord657
ord253
ord225
ord231
ord680
ord224
ord298
ord3106
ord3040
ord486
ord484
ord128
ord1846
ord252
ord497
ord501
ord1800
ord109
ord963
ord964
ord965
ord2784
ord467
ord95
ord78
ord52
ord89
ord1015
ord1016
ord1017
ord585

ssleay32

ord28
ord74
ord183
ord58
ord98
ord142
ord141
ord21
ord6
ord5
ord166
ord38
ord78
ord242
ord161
ord90
ord108
ord25
ord154
ord24
ord30
ord17
ord235
ord83
ord61
ord12
ord170
ord8
ord48
ord96
ord45
ord75
ord94
ord43

ws2_32

listen
closesocket
select
send
recv
getsockopt
__WSAFDIsSet
connect
ioctlsocket
socket
gethostbyname
WSAStartup
htons
bind
getsockname
ntohs
WSAGetLastError
ntohl
htonl
inet_addr

crypt32

CertFindCertificateInStore
CryptProtectData
CertFreeCertificateChain
CertGetCertificateChain
CertOpenStore
CertCloseStore
CertNameToStrA
CertGetNameStringA
CertEnumCertificatesInStore
CryptAcquireCertificatePrivateKey
CertCreateCertificateContext
CertAddCertificateContextToStore
CertFreeCertificateContext
CertGetNameStringW
CryptUnprotectData

iphlpapi

NotifyAddrChange
GetAdaptersInfo
IpReleaseAddress
GetAdapterIndex
IpRenewAddress
GetAdaptersAddresses

shlwapi

PathAddBackslashA
PathRemoveFileSpecA

wtsapi32

WTSQueryUserToken

winscard

SCardListReadersA
SCardReleaseContext
SCardConnectA
SCardStatusA
SCardTransmit
g_rgSCardT0Pci
g_rgSCardT1Pci
SCardDisconnect
SCardEstablishContext

kernel32

CreateNamedPipeA
Sleep
ConnectNamedPipe
GetLastError
CreateThread
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetACP
TlsGetValue
DuplicateHandle
TlsSetValue
InterlockedIncrement
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObjectEx
GetCurrentProcessId
IsBadStringPtrA
GetCurrentThread
GetCurrentProcess
SetUnhandledExceptionFilter
VirtualQuery
DeviceIoControl
CreateEventA
ReadFile
FlushFileBuffers
DisconnectNamedPipe
WaitForSingleObject
LoadLibraryA
GetProcAddress
WriteFile
CloseHandle
OutputDebugStringA
GetModuleFileNameA
GetModuleHandleA
SetLastError
FormatMessageA
LocalFree
CreateFileA
ResetEvent
SetCurrentDirectoryA
WideCharToMultiByte
CancelIo
GetTickCount
MultiByteToWideChar
GetVersionExA
SetConsoleCtrlHandler
CreateMutexA
GetCurrentThreadId
ReleaseMutex
GetOverlappedResult
WaitForMultipleObjectsEx
FileTimeToSystemTime
WTSGetActiveConsoleSessionId
GetComputerNameExA
FreeLibrary
GetLocalTime
SetFilePointer
DeleteFileA

advapi32

GetUserNameA
LsaRetrievePrivateData
LsaOpenPolicy
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
CryptSignHashA
CryptSetHashParam
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
CryptReleaseContext
ImpersonateLoggedOnUser
DuplicateTokenEx
RevertToSelf
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegEnumKeyExA

shell32

SHGetFolderPathA

ole32

CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket

oleaut32

SafeArrayPutElement
SafeArrayUnaccessData
SafeArrayCreateVector
SysFreeString
SysAllocString
VariantClear
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayAccessData

msvcr80

fseek
_dup
_stat32
_stricmp
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_mbsstr
_fdopen
fputc
strlen
strchr
getenv
_vsnprintf
memcmp
strcmp
abort
_iob
memmove
printf
free
memset
sprintf
memcpy
atoi
fprintf
__iob_func
_strdup
strstr
strncpy_s
_endthread
_beginthread
rand
_vswprintf_c_l
_wcsdup
mbstowcs
malloc
wcsstr
strncmp
_snprintf
_time64
realloc
calloc
strncpy
fclose
fopen
_strupr
toupper
_mkdir
_errno
_chdir
_wassert
exit
isspace
strcpy_s
strncat_s
rename
fflush
isprint
_stat64
_unlink
sscanf
strtol
strerror
vfprintf
fread
ferror
fwrite
ftell
_getcwd

dbghelp

SymSetContext
SymEnumSymbols
SymInitialize
StackWalk
MiniDumpWriteDump
SymGetModuleBase
SymFunctionTableAccess
SymCleanup
SymGetLineFromAddr
SymGetTypeInfo
SymSetOptions
SymFromAddr

Exports

Exports

TNC_28383_TNCC_Add_To_Batch
TNC_28383_TNCC_Get_Posture_Preferences
TNC_28383_TNCC_Renew_DHCP
TNC_28383_TNCC_Request_Answer_From_UI_by_ID
TNC_28383_TNCC_Reset_Connection
TNC_28383_TNCC_Send_Batch
TNC_28383_TNCC_Send_Error_Message
TNC_28383_TNCC_Send_UI_Notification_by_ID
TNC_28383_TNCC_Set_Disconnect_Callback
TNC_28383_TNCC_Set_UI_Connect_Callback
TNC_28383_TNCC_Set_User_Logon_Callback
TNC_28383_TNCC_Single_Shot_Batch
TNC_28383_TNCC_debug_log
TNC_9048_LogMessage
TNC_9048_UserMessage

Sections

.text
Size: 680KB - Virtual size: 676KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

01239aaba8a02471fb245d42a33e17c8

Headers

File Characteristics

Imports

libeay32

ssleay32

ws2_32

crypt32

iphlpapi

shlwapi

wtsapi32

winscard

kernel32

advapi32

shell32

ole32

oleaut32

msvcr80

dbghelp

Exports

Exports

Sections

.text Size: 680KB - Virtual size: 676KB

.rdata Size: 1.0MB - Virtual size: 1.0MB

.data Size: 32KB - Virtual size: 76KB

.rsrc Size: 4KB - Virtual size: 428B

.text
Size: 680KB - Virtual size: 676KB

.rdata
Size: 1.0MB - Virtual size: 1.0MB

.data
Size: 32KB - Virtual size: 76KB

.rsrc
Size: 4KB - Virtual size: 428B