NEAS[.]cd24297ffd67ef202e3be1c8323e9fa0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cd24297ffd67ef202e3be1c8323e9fa0.exe
Size

4.3MB
MD5

cd24297ffd67ef202e3be1c8323e9fa0
SHA1

fd2f20aec7a5754477e616f08a9ef52c4014cb30
SHA256

1042114be60b3877a031076c9ad5990fd3b4e8a7aa68c479d9e06ad0fef72b62
SHA512

99cf91ecde9f802f6943aad311eaff13f0ab5055c0dd020022d13c07a57be284c2d4bddfea8fb6ff9502d4ed1b5115278417586f6dd273f2fa1c797a1eae6826
SSDEEP

98304:GYFAKFLZ7lxvjjSVDqnv7V8iq54rD+yAxKb5HY+AwbfdmQoJsv6tWKFdu9CLlW:nsVDk2iq5EXtVHYodmJJsv6tWKFdu9CL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cd24297ffd67ef202e3be1c8323e9fa0.exe

Files

NEAS.cd24297ffd67ef202e3be1c8323e9fa0.exe
.exe windows:4 windows x86

17d6e857fb615787e1d82b1a9a922cce

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CopySid
FreeSid
GetLengthSid
GetTokenInformation
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegNotifyChangeKeyValue
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW

kernel32

CancelIo
CloseHandle
CompareStringW
ConnectNamedPipe
CopyFileW
CreateDirectoryW
CreateEventA
CreateEventW
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetCommandLineW
GetConsoleWindow
GetCurrencyFormatW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileType
GetFullPathNameW
GetGeoInfoW
GetHandleInformation
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalDrives
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetNativeSystemInfo
GetOverlappedResult
GetProcAddress
GetProcessAffinityMask
GetQueuedCompletionStatus
GetStartupInfoA
GetStartupInfoW
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultUILanguage
GetUserGeoID
GetVersionExW
GlobalFree
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenProcess
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
ResumeThread
SetCriticalSectionSpinCount
SetCurrentDirectoryW
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetFilePointerEx
SetHandleInformation
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
SwitchToThread
SystemTimeToTzSpecificLocalTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile

msvcrt

__argc
__argv
__dllonexit
__doserrno
__getmainargs
__initenv
__lconv_init
__mb_cur_max
__pioinfo
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_beginthreadex
_cexit
_clearfp
_close
_control87
_endthreadex
_environ
_errno
_filelengthi64
_fileno
_fmode
_ftime
_get_osfhandle
_getdrive
_initterm
_iob
_lock
_lseeki64
_onexit
_open_osfhandle
_putenv
_read
_setjmp3
_snwprintf
_strdup
_timezone
_tzname
_tzset
_unlock
_waccess
_wchmod
_wgetdcwd
_write
_write
abort
acos
asin
atan2
atoi
calloc
exit
fclose
feof
fflush
fgetpos
fgets
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getenv
islower
isspace
isupper
isxdigit
localtime
localeconv
longjmp
malloc
mktime
memchr
memcmp
memcpy
memmove
memset
printf
puts
rand
realloc
setlocale
signal
sprintf
srand
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strrchr
strtol
strtoul
tolower
ungetc
vfprintf
wcschr
wcscmp
wcslen

ole32

CoCreateGuid
CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

shell32

CommandLineToArgvW
SHGetSpecialFolderPathW

user32

CallNextHookEx
CharNextExA
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EnumWindows
GetQueueStatus
GetWindowLongW
GetWindowThreadProcessId
KillTimer
MsgWaitForMultipleObjectsEx
PeekMessageW
PostMessageW
PostThreadMessageW
RegisterClassW
SetTimer
SetWindowLongW
SetWindowsHookExW
TranslateMessage
UnhookWindowsHookEx
UnregisterClassW

ws2_32

WSAAccept
WSAAsyncSelect
WSACleanup
WSAConnect
WSAGetLastError
WSAHtonl
WSAHtons
WSAIoctl
WSANtohl
WSANtohs
WSARecv
WSARecvFrom
WSASend
WSASendTo
WSASocketW
WSAStartup
__WSAFDIsSet
bind
closesocket
gethostbyaddr
gethostbyname
gethostname
getpeername
getsockname
getsockopt
htonl
inet_addr
listen
ntohl
select
setsockopt

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.qtmetad
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 417KB - Virtual size: 417KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

17d6e857fb615787e1d82b1a9a922cce

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

ole32

shell32

user32

ws2_32

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.data Size: 22KB - Virtual size: 21KB

.rdata Size: 1.4MB - Virtual size: 1.4MB

.qtmetad Size: 1024B - Virtual size: 640B

.eh_fram Size: 417KB - Virtual size: 417KB

.bss Size: - Virtual size: 24KB

.idata Size: 9KB - Virtual size: 9KB

.CRT Size: 512B - Virtual size: 56B

.tls Size: 512B - Virtual size: 32B

.text
Size: 2.5MB - Virtual size: 2.5MB

.data
Size: 22KB - Virtual size: 21KB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.qtmetad
Size: 1024B - Virtual size: 640B

.eh_fram
Size: 417KB - Virtual size: 417KB

.bss
Size: - Virtual size: 24KB

.idata
Size: 9KB - Virtual size: 9KB

.CRT
Size: 512B - Virtual size: 56B

.tls
Size: 512B - Virtual size: 32B