NEAS[.]71bd6a66d7b0d1c8ffd144c6794acee0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.71bd6a66d7b0d1c8ffd144c6794acee0.exe
Size

627KB
MD5

71bd6a66d7b0d1c8ffd144c6794acee0
SHA1

03c79a836e6cddadae1e0fbaf46ef1ffe166076f
SHA256

4a62d1e027810dabde0c33331752fde6511ef00bc5de71e8d4cb888ac6dc6f24
SHA512

f8645cfdb5f5318cfb757480749adf65a5b382ab7ff87d06afa74241737a0349acd5806b324aebee160eff886dd52e56f31ca3f2c70e389a50017661c023aca7
SSDEEP

12288:19u31CJFZqAhDEquo8lhha5qLURDyygLJ:19u31C1rDEquo8lu5q+WT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.71bd6a66d7b0d1c8ffd144c6794acee0.exe

Files

NEAS.71bd6a66d7b0d1c8ffd144c6794acee0.exe
.dll windows:4 windows x64

8965c47de535e8067f5dadefb107b2a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

CryptAcquireContextA
CryptGenRandom
CryptReleaseContext

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount64
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
OpenProcess
OutputDebugStringA
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
__C_specific_handler

api-ms-win-crt-convert-l1-1-0

_ultoa
atoi
mbrtowc
strtol
strtoul
wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron
getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-heap-l1-1-0

_aligned_free
_aligned_malloc
_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr
asin
log10

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex
longjmp
memcpy
memmove
strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__p___wargv
_assert
_beginthreadex
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_endthreadex
_errno
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
exit
signal
strerror
_getpid

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
fputc
fputs
fwrite
_write
_open
_close

api-ms-win-crt-string-l1-1-0

_strnicmp
islower
isspace
isupper
memset
strcmp
strlen
strncmp
tolower
wcslen
_stricmp
_strdup

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_time64
_tzset

api-ms-win-crt-utility-l1-1-0

div

avutil-58

av_calloc
av_channel_layout_channel_from_index
av_channel_layout_check
av_channel_layout_compare
av_channel_layout_copy
av_channel_layout_default
av_channel_layout_describe
av_channel_layout_from_mask
av_channel_layout_index_from_channel
av_channel_layout_subset
av_channel_layout_uninit
av_channel_name
av_frame_get_buffer
av_free
av_freep
av_get_bytes_per_sample
av_get_channel_layout_nb_channels
av_get_cpu_flags
av_get_packed_sample_fmt
av_get_planar_sample_fmt
av_get_sample_fmt_name
av_log
av_malloc_array
av_mallocz
av_opt_set_chlayout
av_opt_set_defaults
av_opt_set_int
av_reduce
av_rescale
av_rescale_rnd
av_sample_fmt_is_planar

Exports

Exports

swr_alloc
swr_alloc_set_opts
swr_alloc_set_opts2
swr_build_matrix
swr_build_matrix2
swr_close
swr_config_frame
swr_convert
swr_convert_frame
swr_drop_output
swr_ffversion
swr_free
swr_get_class
swr_get_delay
swr_get_out_samples
swr_init
swr_inject_silence
swr_is_initialized
swr_next_pts
swr_set_channel_mapping
swr_set_compensation
swr_set_matrix
swresample_configuration
swresample_license
swresample_version

Sections

.text
Size: 528KB - Virtual size: 528KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 215KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 718B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8965c47de535e8067f5dadefb107b2a0

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

avutil-58

Exports

Exports

Sections

.text Size: 528KB - Virtual size: 528KB

.data Size: 2KB - Virtual size: 2KB

.rdata Size: 55KB - Virtual size: 54KB

.pdata Size: 12KB - Virtual size: 12KB

.xdata Size: 16KB - Virtual size: 15KB

.bss Size: - Virtual size: 215KB

.edata Size: 1024B - Virtual size: 718B

.idata Size: 7KB - Virtual size: 6KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 928B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 528KB - Virtual size: 528KB

.data
Size: 2KB - Virtual size: 2KB

.rdata
Size: 55KB - Virtual size: 54KB

.pdata
Size: 12KB - Virtual size: 12KB

.xdata
Size: 16KB - Virtual size: 15KB

.bss
Size: - Virtual size: 215KB

.edata
Size: 1024B - Virtual size: 718B

.idata
Size: 7KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 928B

.reloc
Size: 2KB - Virtual size: 1KB