NEAS[.]9b822dd069703c9cbd32fc661cc0e080[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9b822dd069703c9cbd32fc661cc0e080.exe
Size

309KB
MD5

9b822dd069703c9cbd32fc661cc0e080
SHA1

56cf36502ba7ea2405d14a94d36886909975d0c0
SHA256

e411b63de8092730631e6f4e7ebdc2a9ed4b8dd7d1670a2a2887f261a3520bf7
SHA512

f7f7c8df9cd9b64983221c648042df3aaf8745c1fef0305532bdd54e35261d0d2b62367de84859d793a357fedc3dce7dd202e67be99ac1deee5eec0ff1eae892
SSDEEP

6144:YmRnO/0TLshYBsGV1Ak4/qLaW3K6EAbFw9qnZjg64J+H:PnOMTL8Os+2DqLFK6BwonZMo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9b822dd069703c9cbd32fc661cc0e080.exe

Files

NEAS.9b822dd069703c9cbd32fc661cc0e080.exe
.dll windows:6 windows x86

a54e2180093e4b5d643a442c8cfea6fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_isatty
_write
_lseeki64
_fileno
__pioinfo
__badioinfo
wctomb
_itoa
_snprintf
isleadbyte
_ismbblead
_amsg_exit
_initterm
free
malloc
_XcptFilter
_iob
_errno
tolower
isspace
getenv
atoi
_stricmp
_strnicmp
strstr
memcpy
memset
strchr
strncmp
_strcmpi

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlUnwind
InterlockedCompareExchange
Sleep
InterlockedExchange
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
WaitForSingleObject
TerminateProcess
GetCurrentProcess
DuplicateHandle
GetPriorityClass
CreateProcessA
CreateThread
SetFilePointer
GetCurrentProcessId
CreateNamedPipeA
CreateFileA
CreateEventA
ReadFile
WriteFile
WaitForMultipleObjects
GetOverlappedResult
CloseHandle
GetCurrentDirectoryA
MultiByteToWideChar
WideCharToMultiByte
LocalFree
LocalReAlloc
LocalAlloc
RemoveDirectoryA
GetFileAttributesA
CreateDirectoryA
GetLastError
OutputDebugStringA
DebugBreak
SetEnvironmentVariableA
SetLastError
SetCurrentDirectoryA
GetEnvironmentVariableA
DeleteFileA
CopyFileA
GetPrivateProfileSectionA
GetModuleFileNameA

advapi32

RegCreateKeyA
RegSetValueA
RegCloseKey
RegQueryValueA

Exports

Exports

SrcSrvCleanup
SrcSrvEnumTokens
SrcSrvExecToken
SrcSrvExecTokenA
SrcSrvExecTokenW
SrcSrvGetFile
SrcSrvGetFileA
SrcSrvGetFileW
SrcSrvGetOptions
SrcSrvGetToken
SrcSrvGetTokenA
SrcSrvGetTokenW
SrcSrvInit
SrcSrvInitA
SrcSrvInitW
SrcSrvIsModuleLoaded
SrcSrvLoadModule
SrcSrvLoadModuleA
SrcSrvLoadModuleW
SrcSrvRegisterCallback
SrcSrvResolveTokenVar
SrcSrvResolveTokenVarA
SrcSrvResolveTokenVarW
SrcSrvSetOptions
SrcSrvSetParentWindow
SrcSrvSetTargetPath
SrcSrvSetTargetPathA
SrcSrvSetTargetPathW
SrcSrvUnloadModule

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a54e2180093e4b5d643a442c8cfea6fd

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

advapi32

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 42KB

.data Size: 30KB - Virtual size: 173KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 228KB - Virtual size: 228KB

.text
Size: 43KB - Virtual size: 42KB

.data
Size: 30KB - Virtual size: 173KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 228KB - Virtual size: 228KB