NEAS[.]3ecc485d755824f8fa2d40476adf11a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.3ecc485d755824f8fa2d40476adf11a0.exe
Size

185KB
MD5

3ecc485d755824f8fa2d40476adf11a0
SHA1

da4d6ddea00ff6e79a3db9ef2a0e73496a728cd4
SHA256

34eb842b4128a487afce7b5edca1a67dceba5998631a980b9ab700c3fe8c2926
SHA512

8703e0e775bae09c8c01857d19cd277268c8e3e9406f6ddd8e87635a500ebc3e5ec9db6703f4f7041e06e9e7a5ad6d596bcbddb4505cd4967e0bb07b9572fce2
SSDEEP

3072:n+sk7AxQndd+Vprr9SJ/Ax/FIrSvN4/HqbzhaOmrpe2II:nhIAxQnHC6J/UFImvN4izUOmrpt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.3ecc485d755824f8fa2d40476adf11a0.exe

Files

NEAS.3ecc485d755824f8fa2d40476adf11a0.exe
.dll windows:5 windows x86

9781d0287432d55ddc934f47d743c589

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

sesscomm

?currentSystemTime@ProtoTime@@SAIXZ
?UnZipString@ProtoHelper@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@I@Z
?net2app@ProtoA2U@@SA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
?getSid@ProtoUInfo@@QAEIXZ
?getUid@ProtoUInfo@@QAEIXZ
?getPid@ProtoUInfo@@QAEIXZ
?setUid@ProtoUInfo@@QAEXI@Z
?setUdb@ProtoUInfo@@QAEXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setCookie@ProtoUInfo@@QAEXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setAsid@ProtoUInfo@@QAEXI@Z
?setPid@ProtoUInfo@@QAEXI@Z
?ProtoToString@ProtoHelper@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IABUMarshallable@sox@@@Z
??0ProtoUInfo@@QAE@XZ
?setSid@ProtoUInfo@@QAEXI@Z

dwbase

?queryDatabase@Data@@YA?AV?$comptr@UIDatabase@Data@@@@K@Z
?DoLog@@YAXGPBD0G0PBG@Z
?IsLogLevelEnabled@@YA_NG@Z
insert_name_id

kernel32

GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
MultiByteToWideChar

msvcp90

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Throw@std@@YAXABVexception@stdext@@@Z
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

msvcr90

__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
_except_handler4_common
??3@YAXPAX@Z
??_V@YAXPAX@Z
memcpy
??2@YAPAXI@Z
_purecall
__CxxFrameHandler3
_snwprintf_s
_CxxThrowException
_invalid_parameter_noinfo
free
memmove_s
malloc
memset
memmove
?terminate@@YAXXZ
_encode_pointer
_malloc_crt
_encoded_null
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ

Exports

Exports

??0CPerfRecord@Perf@@QAE@XZ
??0IAudioMod@@QAE@ABV0@@Z
??0IAudioMod@@QAE@XZ
??0IProtoPacket@@QAE@ABV0@@Z
??0IProtoPacket@@QAE@XZ
??0IProtoTaskThread@@QAE@ABV0@@Z
??0IProtoTaskThread@@QAE@XZ
??0ISInfoMod@@QAE@ABV0@@Z
??0ISInfoMod@@QAE@XZ
??0IServiceMod@@QAE@ABV0@@Z
??0IServiceMod@@QAE@XZ
??0ISessionMod@@QAE@ABV0@@Z
??0ISessionMod@@QAE@XZ
??0ProtoUInfo@@QAE@ABV0@@Z
??1IAudioMod@@UAE@XZ
??1IProtoPacket@@UAE@XZ
??1IProtoTaskThread@@UAE@XZ
??1ISInfoMod@@UAE@XZ
??1IServiceMod@@UAE@XZ
??1ISessionMod@@UAE@XZ
??1ProtoUInfo@@QAE@XZ
??4CPerfRecord@Perf@@QAEAAV01@ABV01@@Z
??4IAudioMod@@QAEAAV0@ABV0@@Z
??4IProtoPacket@@QAEAAV0@ABV0@@Z
??4IProtoTaskThread@@QAEAAV0@ABV0@@Z
??4ISInfoMod@@QAEAAV0@ABV0@@Z
??4IServiceMod@@QAEAAV0@ABV0@@Z
??4ISessionMod@@QAEAAV0@ABV0@@Z
??4ProtoA2U@@QAEAAV0@ABV0@@Z
??4ProtoHelper@@QAEAAV0@ABV0@@Z
??4ProtoPacketPool@@QAEAAV0@ABV0@@Z
??4ProtoTime@@QAEAAV0@ABV0@@Z
??4ProtoUInfo@@QAEAAV0@ABV0@@Z
??_7IAudioMod@@6B@
??_7IProtoPacket@@6B@
??_7IProtoTaskThread@@6B@
??_7ISInfoMod@@6B@
??_7IServiceMod@@6B@
??_7ISessionMod@@6B@
?GetInstance@CPerfRecord@Perf@@SAPAV12@XZ
?s_pImpl@?1??GetInstance@CPerfRecord@Perf@@SAPAV23@XZ@4PAV23@A
_getModule@4
releaseModule

Sections

.text
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9781d0287432d55ddc934f47d743c589

Headers

DLL Characteristics

File Characteristics

Imports

sesscomm

dwbase

kernel32

msvcp90

msvcr90

Exports

Exports

Sections

.text Size: 135KB - Virtual size: 134KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 2KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 688B

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 135KB - Virtual size: 134KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 2KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 18KB - Virtual size: 18KB