NEAS[.]cf86469717c0077635b619506fa09b00[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cf86469717c0077635b619506fa09b00.exe
Size

304KB
MD5

cf86469717c0077635b619506fa09b00
SHA1

998b61dcdc5bae5d8a3b49a832d64989c1d899ef
SHA256

8a1fe45ecf4b087f704b101349edf58ddb040b1f6817d8ea742d03458170cb81
SHA512

0ff19b0884392c74c6d002a6f4fe5953a11df49888da9dea47b0cf6b0d6275d580a9ddc223dbe68657a314aab08122eefbf3b554fc8375f7fcf92048d3019667
SSDEEP

3072:+gUkCtOxSoo5F7Iwxrm9tLnhkGeU5eeVyWKQa1uqWYEpHeU5eeVyWKQa1uqWYEj9:+gUkeOYFFpVkPZVyWKjyrZVyWKjyJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cf86469717c0077635b619506fa09b00.exe

Files

NEAS.cf86469717c0077635b619506fa09b00.exe
.dll windows:4 windows x86

a3e0a73015867b0750a93f7e05f6015d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mwrf32

rf_beep
rf_load_key
rf_exit
rf_init
rf_read
rf_card
rf_authentication
rf_reset
rf_halt
rf_write

kernel32

TlsSetValue
GetLocalTime
WideCharToMultiByte
Sleep
MultiByteToWideChar
GetTickCount
EscapeCommFunction
SetCommState
GetCommState
SetCommTimeouts
GetCommTimeouts
PurgeComm
SetupComm
SetCommMask
GetCommMask
CreateFileA
CloseHandle
ReadFile
WriteFile
LCMapStringW
LCMapStringA
RtlUnwind
SetEndOfFile
LoadLibraryA
GetProcAddress
GetCommandLineA
GetVersion
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetLastError
SetFilePointer
InitializeCriticalSection
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP

user32

FindWindowA
PostMessageA
PeekMessageA
TranslateMessage
DispatchMessageA

Exports

Exports

GB2Unicode
GSC02_GetProperity
GSC02_MachineInit
GSC02_SetProperity
GSC03_GetProperity
GSC03_SetProperity
GSCDLC_DownGs04Card
GSCDLC_GetCheckSum
GSC_AddOneCard
GSC_Alive
GSC_CMDRestart
GSC_ChargeF03Card
GSC_Connect
GSC_ConnectA
GSC_DelOneCard
GSC_DeleteRecord
GSC_Disconnect
GSC_DownMJGroup
GSC_DownMJPeriod
GSC_DownMJTime
GSC_DownMJWeekPlan
GSC_DownMJZone
GSC_DownloadKey
GSC_EmitF03Card
GSC_FakeRecord
GSC_Get03Record
GSC_GetALLRecord
GSC_GetAddress
GSC_GetRdAddr
GSC_GetRdSerial
GSC_GetRecordInfo
GSC_GetRegCard
GSC_GetRegCard2
GSC_GetTime
GSC_GetTime0
GSC_GetVersion
GSC_InitDealMoney
GSC_MachineInit
GSC_MemoryRead
GSC_MemoryWrite
GSC_QuerySale
GSC_ReadF03Card
GSC_ReadF03Record
GSC_ReadMJRecord
GSC_ReadNRecord
GSC_ReadRecord
GSC_ReadToFile
GSC_RegisterCard
GSC_RegisterCard2
GSC_RemoveF03Card
GSC_ResetBlackList
GSC_ResumeRecord
GSC_SetAddress
GSC_SetBlackList
GSC_SetDealMoney
GSC_SetEnableGroup
GSC_SetRdAddr
GSC_SetTime
GSC_SetTime0
GSC_SetTimeSection
GSC_TestMode
MWRF_Beep
MWRF_ChargeF03Card
MWRF_ChargePOSCard
MWRF_ConnectA
MWRF_Disconnect
MWRF_DownloadATTKey
MWRF_DownloadKey
MWRF_EmitATTCard
MWRF_EmitF03Card
MWRF_EmitF03Card2
MWRF_EmitPOSCard
MWRF_ReadATTCard
MWRF_ReadF03Card
MWRF_ReadPOSCard
MWRF_RemoveATTCard
MWRF_RemoveF03Card
MWRF_RemovePOSCard
Unicode2GB

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 236KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3e0a73015867b0750a93f7e05f6015d

Headers

File Characteristics

Imports

mwrf32

kernel32

user32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 46KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 236KB - Virtual size: 246KB

.reloc Size: 8KB - Virtual size: 5KB

.text
Size: 48KB - Virtual size: 46KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 236KB - Virtual size: 246KB

.reloc
Size: 8KB - Virtual size: 5KB