NEAS[.]c17d85ee9372e2b7f8c92fd678a6b5a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c17d85ee9372e2b7f8c92fd678a6b5a0.exe
Size

1.5MB
MD5

c17d85ee9372e2b7f8c92fd678a6b5a0
SHA1

b6aed885c2d45762315f74f8df23df2ea03dd843
SHA256

cab39bf5db5cc1c0f28baba507927fed0d54859f8f74b246d63b1f86e6a0c0d9
SHA512

209eb9ee4e91b23b7590e802fc83e839bedd2128e4b7af51c4561411afc7a6d534312f0b5efcd7bf5bfef4d3db646647be19c18c7566dded8f543bd91563f962
SSDEEP

12288:VKWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VKWsqjnhMgeiCl7G0nehbGZpbD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c17d85ee9372e2b7f8c92fd678a6b5a0.exe

Files

NEAS.c17d85ee9372e2b7f8c92fd678a6b5a0.exe
.exe windows:6 windows x64

90a10b8254b5d0f88fc090cdff286f3a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

prm

?Initialize@PRM@@YAXW4ApplicationType@1@PEBD11_N@Z

aslfoundation

?ThrowError@DVAErrorManager@ASL@@UEBAXW4ErrorLevel@config@dvacore@@PEBDIH_NAEBVReplacementValue@45@333@Z
?ExecuteFunctionWithTopLevelExceptionHandler@DVAErrorManager@ASL@@UEAAHV?$function0@H@boost@@@Z

displaysurface

?GPUSnifferMain@DS@@YAIAEAV?$basic_ostream@DU?$char_traits@D@std@@@std@@I@Z

dvacore

?SetFileWritesDisabled@DebugDatabase@debug@dvacore@@QEAAX_N@Z
?RegisterCurrentThreadAsMainThread@threads@dvacore@@YA?AV?$shared_ptr@VAsyncEventLoopAdaptor@threads@dvacore@@@boost@@XZ
?Instance@DebugDatabase@debug@dvacore@@SAAEAV123@XZ
??1Localizer@config@dvacore@@UEAA@XZ
?PurgeMemory@ErrorManager@config@dvacore@@UEAA_N_K@Z
?ExecuteFunctionAndConvertException@ErrorManager@config@dvacore@@UEAAHV?$function0@H@boost@@@Z
?Set@Localizer@config@dvacore@@SAXPEAV123@AEBVDir@filesupport@3@@Z
?IncrementLazilyDisplayErrors@ErrorManager@config@dvacore@@UEAAXXZ
??0Localizer@config@dvacore@@QEAA@XZ
??1Dir@filesupport@dvacore@@QEAA@XZ
??0Dir@filesupport@dvacore@@QEAA@XZ
?Set@ErrorManager@config@dvacore@@SAXPEAV123@@Z
??1ErrorManager@config@dvacore@@UEAA@XZ
??0ErrorManager@config@dvacore@@QEAA@XZ
?SetAssertWriteToStdOut@debug@dvacore@@YAX_N@Z
?SetDisableFileWrites@debug@dvacore@@YAX_N@Z
?AsciiToUTF16@utility@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@PEBD_K@Z
?UTF8to16@utility@dvacore@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@AEBV?$basic_string@EU?$char_traits@E@std@@V?$STLAllocator@E@SmallBlockAllocator@utility@dvacore@@@4@PEAW4UnicodeErrorCode@12@PEA_K@Z
?SetClientSuiteVersion@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?SetCompanyName@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?SetClientBuildNumber@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?SetClientInternalVersion@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?SetClientVersion@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?SetApplicationName@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?SetClientName@config@dvacore@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$STLAllocator@_W@SmallBlockAllocator@utility@dvacore@@@std@@@Z
?Dispose@SmallBlockAllocator@utility@dvacore@@YAXPEAX_K@Z
?Allocate@SmallBlockAllocator@utility@dvacore@@YAPEAX_K@Z
?NewDeferredErrorReporter@ErrorManager@config@dvacore@@UEAA?AV?$intrusive_ptr@VDeferredErrorReporter@config@dvacore@@@boost@@_N@Z
?DecrementLazilyDisplayErrors@ErrorManager@config@dvacore@@UEAAXXZ

kernel32

InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
CloseHandle
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
DecodePointer
RaiseException
GetLastError
SetErrorMode
HeapDestroy
HeapAlloc

user32

UnregisterClassW

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity

oleaut32

SysFreeString

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ

vcruntime140

__std_exception_destroy
__std_type_info_destroy_list
__CxxFrameHandler3
__std_exception_copy
__C_specific_handler
__vcrt_InitializeCriticalSectionEx
memset
memcpy
__std_terminate
memchr
memmove
_CxxThrowException
memcmp

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_errno
_invalid_parameter_noinfo_noreturn
terminate
_register_thread_local_exe_atexit_callback
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_exe
_set_app_type
_c_exit
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argv
__p___argc

api-ms-win-crt-heap-l1-1-0

_callnewh
_recalloc
_set_new_mode
malloc
free

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

90a10b8254b5d0f88fc090cdff286f3a

Headers

DLL Characteristics

File Characteristics

Imports

prm

aslfoundation

displaysurface

dvacore

kernel32

user32

ole32

oleaut32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 18KB - Virtual size: 18KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 1024B - Virtual size: 8KB

.pdata Size: 2KB - Virtual size: 1KB

.tls Size: 512B - Virtual size: 9B

.gfids Size: 512B - Virtual size: 68B

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 18KB - Virtual size: 18KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 1024B - Virtual size: 8KB

.pdata
Size: 2KB - Virtual size: 1KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 68B

.rsrc
Size: 1.4MB - Virtual size: 1.4MB