NEAS[.]ba616c2ce26bed17523eb2c19b3b50a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ba616c2ce26bed17523eb2c19b3b50a0.exe
Size

66KB
MD5

ba616c2ce26bed17523eb2c19b3b50a0
SHA1

ed9ade8da8b1662b68ffbdf7610431d51aa337c7
SHA256

2a7dcff7f07a1b21c6541683f96310e36143a1c3f150fd4f3a39581a3f2d57fe
SHA512

2ec60a113ff9e7d59e13895b151e3d1d7e660645a4b94e7fc843cf1f58edd93a69e64bfe53858bba811cf152babffea33b12539a9712f5a123a18495997a8539
SSDEEP

1536:SiCrZpjpORVMevSWpHPzEObsgBc/FM95nHAd0Z3Q:SiCVp1FkSWqCBn/HAd0Z3Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ba616c2ce26bed17523eb2c19b3b50a0.exe

Files

NEAS.ba616c2ce26bed17523eb2c19b3b50a0.exe
.exe windows:5 windows x64

4229ea7766f97c2f89b532b393b457e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ciril64

EDIClose
SQLRelease
debug
MEMFree
MEMSourceLine
MEMSourceName
SQLClose
SQLCode
SQLError
SQLConnect
EDIEtiquette
EDINiveau
EDIPrintf
DATFormate
EDIEdite
SQLOpen
PARSprintf
PARFiltre
EDIRupture
SQLExecute
PARPresent
EDIOpen
PARGet
EDIPrintSyntax
PARInit

kernel32

GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetCommandLineA
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
GetLastError
FlsAlloc
HeapSize
WriteFile
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CloseHandle
CreateFileA

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4229ea7766f97c2f89b532b393b457e6

Headers

DLL Characteristics

File Characteristics

Imports

ciril64

kernel32

Sections

.text Size: 41KB - Virtual size: 40KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 6KB - Virtual size: 59KB

.pdata Size: 2KB - Virtual size: 2KB

.text
Size: 41KB - Virtual size: 40KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 6KB - Virtual size: 59KB

.pdata
Size: 2KB - Virtual size: 2KB