NEAS[.]bf820034e6965aa6c43485592ba03160[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.bf820034e6965aa6c43485592ba03160.exe
Size

3.9MB
MD5

bf820034e6965aa6c43485592ba03160
SHA1

d806db7ded05a07166f1da79f4005fbe5d8b611a
SHA256

befd03987599f71e3417020436bffccd56f7a07845d4a269bc6cc6add191d095
SHA512

4b9daef986fed73e1b6ad033b911721d51d8315fc874ccc3ee69f256fb50e9df11b2bfa17286bfbe0ac4ed88b250f5e12320f152683d5280cfa86ac42fc9ad54
SSDEEP

24576:SjdosCEb8bR/9ULTRJpLiSIIqUaA2StHuomcpdheK/Mhu2oNrEH7u:YhTjp5ulA2WHzAg2oh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.bf820034e6965aa6c43485592ba03160.exe

Files

NEAS.bf820034e6965aa6c43485592ba03160.exe
.dll windows:6 windows x86

8a567f443175a645d55b3e4de3431bb7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetClassDevsW
SetupDiSetDevicePropertyW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDevicePropertyW

bcrypt

BCryptDecrypt
BCryptEncrypt
BCryptOpenAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptGenerateKeyPair
BCryptFinishHash
BCryptSignHash
BCryptRemoveContextFunctionProvider
BCryptRegisterProvider
BCryptAddContextFunctionProvider
BCryptUnregisterProvider
BCryptSetProperty
BCryptVerifySignature
BCryptDestroySecret
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptDeriveKey
BCryptCreateHash
BCryptExportKey
BCryptSecretAgreement
BCryptDestroyKey
BCryptImportKeyPair
BCryptFinalizeKeyPair
BCryptAddContextFunction

ncrypt

NCryptSignHash
NCryptFreeObject

advapi32

OpenProcessToken
CryptGenRandom
CryptReleaseContext
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorSacl
FreeSid
GetSecurityDescriptorOwner
AllocateAndInitializeSid
MakeAbsoluteSD
GetNamedSecurityInfoW
GetAce
SetNamedSecurityInfoW
EqualSid
GetSecurityDescriptorControl
GetAclInformation
GetTokenInformation
OpenThreadToken
IsValidSecurityDescriptor
GetSecurityDescriptorLength
CryptAcquireContextW
RevertToSelf
ImpersonateLoggedOnUser
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

crypt32

CryptFindOIDInfo
CryptAcquireCertificatePrivateKey
CryptProtectMemory
CryptUnregisterOIDInfo
CryptRegisterOIDInfo
CryptUnprotectMemory
CertCloseStore
CertFreeCertificateChain
CertGetCertificateChain
CertDuplicateCertificateContext
CryptProtectData
CryptUnprotectData
CryptStringToBinaryW
CryptBinaryToStringW
CertOpenSystemStoreW
CertFreeCertificateContext
CertFindCertificateInStore

rpcrt4

UuidCreate

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsW

kernel32

FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
GlobalMemoryStatus
LocalFree
SetEvent
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
ResetEvent
CreateEventW
DeleteCriticalSection
CloseHandle
CreateThread
lstrlenW
WaitForSingleObject
GetModuleFileNameW
LoadLibraryExW
CreateTimerQueueTimer
WTSGetActiveConsoleSessionId
DeleteTimerQueueTimer
ResumeThread
LCMapStringW
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
HeapSize
RtlUnwind
SetFilePointerEx
GetConsoleMode
GetConsoleCP
AreFileApisANSI
FreeEnvironmentStringsW
GetEnvironmentStringsW
LoadLibraryA
HeapReAlloc
OutputDebugStringW
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetVersionExA
FlushFileBuffers
WriteConsoleW
ChangeTimerQueueTimer
SetStdHandle
ReadConsoleW
SetEndOfFile
GetTickCount
GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
GetFileSize
GetCurrentProcess
CreateDirectoryW
GetCurrentThread
WriteFile
ReadFile
CreateFileW
DeleteFileW
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
WideCharToMultiByte
GetCommandLineA
GetCurrentThreadId
RaiseException
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA

ole32

CoCreateInstance
PropVariantClear
CoInitializeEx
CoUninitialize

oleaut32

SysFreeString
SysStringByteLen
VariantInit
VariantClear
SysAllocString

userenv

GetAllUsersProfileDirectoryW
GetUserProfileDirectoryW

Exports

Exports

Dot11ExtIhvGetVersionInfo
Dot11ExtIhvInitService
GetKeyStorageInterface
GetSecretAgreementInterface
GetSignatureInterface

Sections

.text
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8a567f443175a645d55b3e4de3431bb7

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

bcrypt

ncrypt

advapi32

crypt32

rpcrt4

wtsapi32

kernel32

ole32

oleaut32

userenv

Exports

Exports

Sections

.text Size: 276KB - Virtual size: 275KB

.rdata Size: 89KB - Virtual size: 88KB

.data Size: 42KB - Virtual size: 64KB

.rsrc Size: 3.4MB - Virtual size: 3.4MB

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 276KB - Virtual size: 275KB

.rdata
Size: 89KB - Virtual size: 88KB

.data
Size: 42KB - Virtual size: 64KB

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

.reloc
Size: 23KB - Virtual size: 22KB