NEAS[.]8feee3802dffd8b1cba67968d8dd56f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.8feee3802dffd8b1cba67968d8dd56f0.exe
Size

688KB
MD5

8feee3802dffd8b1cba67968d8dd56f0
SHA1

a6b8a19d6f2091f756c2435884ffa6f1ad377e08
SHA256

595c71cb1f9ff77d2611a2dcb326d0f3dd753cd11a826a38a6f85bbc827f8395
SHA512

d5ab042aff4b0cbed9fe507518d26db1b8bcbb392eff9e5c43d80bdeb29320e0aff830458f65a15402906e31e13ea450ed5074b6119d2bf628340b30cc592455
SSDEEP

12288:ulWo0Ges/YFzVg72zfLpdImHH5GIThwH3UNxpiZR8XiNv97S4BchOon6F6ASUhgN:aPyzvhHThfNqZR8SNvI4BpwRUhe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.8feee3802dffd8b1cba67968d8dd56f0.exe

Files

NEAS.8feee3802dffd8b1cba67968d8dd56f0.exe
.exe windows:4 windows x86

5a2cd260004be3183de65ecee4b9e92a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
MultiByteToWideChar
ReleaseMutex
CreateMutexA
FindClose
FindFirstFileA
FindNextFileA
CreateEventA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetVersionExA
GetUserDefaultLCID
SetEvent
GetLocaleInfoA
IsValidCodePage
IsValidLocale
SetEndOfFile
SetConsoleCtrlHandler
FlushFileBuffers
SetStdHandle
CreateFileA
LoadLibraryA
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
InterlockedIncrement
InterlockedDecrement
ReadFile
SetFilePointer
SetProcessShutdownParameters
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
OpenProcess
WaitForSingleObject
CloseHandle
EnumSystemLocalesA
GetModuleFileNameA
IsBadWritePtr
VirtualAlloc
GetStringTypeW
GetStringTypeA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetSystemTime
Sleep
GetTickCount
GetVolumeInformationA
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapAlloc
HeapFree
HeapReAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
HeapSize
GetProcAddress
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
WriteFile

user32

PeekMessageA
LoadAcceleratorsA
EndDialog
DefWindowProcA
BeginPaint
GetClientRect
DrawTextA
EndPaint
MessageBeep
PostQuitMessage
CreateWindowExA
LoadIconA
LoadCursorA
RegisterClassExA
LoadStringA
FindWindowA
SendMessageA
DestroyWindow
RegisterClassA
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetWindowThreadProcessId
PostMessageA
IsWindow
GetClassNameA

advapi32

RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetUserNameA
RegQueryValueExA
RegQueryInfoKeyA

shlwapi

PathAppendA

iphlpapi

GetAdaptersInfo

winmm

timeKillEvent
waveOutOpen
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutPause
waveOutRestart
waveOutClose
waveOutReset

Exports

Exports

CloseDict
CreateTaggerResult
CreateTaggerStruct
FreeTaggerResult
FreeTaggerStruct
OpenDict
VTDTTS_MakeInfo_KOR
VT_AllocSyncInfo_New_KOR
VT_CheckLicense_KOR
VT_CheckUserDictEntry_KOR
VT_CheckUserDict_TargetNorm_KOR
VT_CheckUserDict_TargetPhon_KOR
VT_CheckUserDict_Target_KOR
VT_CopySyncInfo_New_KOR
VT_DestroyWindow_KOR
VT_FreeSyncInfo_New_KOR
VT_GetDefUserDictAbsoluteName_KOR
VT_GetDefUserDictRelativeName_KOR
VT_GetDefVersion_KOR
VT_GetLicenseComment_KOR
VT_GetLicenseInfo_KOR
VT_GetPitchSpeedVolumePause_KOR
VT_GetSpeakerName_KOR
VT_GetTTSInfo_KOR
VT_GetUserDictLimit_KOR
VT_INIT_KOR
VT_InitSyncInfo_New_KOR
VT_LOADTTS_EXT_KOR
VT_LOADTTS_KOR
VT_LOAD_UserDict_EXT_KOR
VT_LOAD_UserDict_KOR
VT_PAUSETTS_KOR
VT_PLAYTTS_KOR
VT_RESTARTTTS_KOR
VT_STOPTTS_KOR
VT_SetEmphasisFactor_KOR
VT_SetParenthesisCharNumber_KOR
VT_SetPitchSpeedVolumePause_KOR
VT_SetSoundCardID_KOR
VT_SetTextTypeForHighlight_KOR
VT_SetUnitSelectHistoryMode_KOR
VT_SetVirtualTagMode_KOR
VT_TextToBufferEX_KOR
VT_TextToBuffer_KOR
VT_TextToFile_KOR
VT_TextToLipSyncLog_KOR
VT_TextToPcmBuffer_ProgressBar_KOR
VT_TextToPreprocessInfoFile_KOR
VT_UNLOADTTS_EXT_KOR
VT_UNLOADTTS_KOR
VT_UNLOAD_UserDict_EXT_KOR
VT_UNLOAD_UserDict_KOR
VT_VerifyTTS_KOR
VT_gHeapStartAddress_KOR
VT_gVersionFirst_KOR
VT_gVersionFourth_KOR
VT_gVersionSecond_KOR
VT_gVersionThird_KOR

Sections

.text
Size: 412KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 188KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a2cd260004be3183de65ecee4b9e92a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

iphlpapi

winmm

Exports

Exports

Sections

.text Size: 412KB - Virtual size: 411KB

.rdata Size: 36KB - Virtual size: 33KB

.data Size: 188KB - Virtual size: 1.1MB

.rsrc Size: 48KB - Virtual size: 47KB

.text
Size: 412KB - Virtual size: 411KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 188KB - Virtual size: 1.1MB

.rsrc
Size: 48KB - Virtual size: 47KB