NEAS[.]2dc759c431e5a9a3ade9c5b9f91d91a0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.2dc759c431e5a9a3ade9c5b9f91d91a0.exe
Size

21KB
MD5

2dc759c431e5a9a3ade9c5b9f91d91a0
SHA1

44c928a78a0241fc06f9894b881a720869c692a3
SHA256

cf60969fbcbdc005d05c31df244bc10347828eb0146e5daee0475e30dc73e31f
SHA512

130a83d51c06d8e7221ea21cf29c8152f9e28fce271696bef6a0baf792ac33ca74f82dc5a61351288c4e9df614f6f036e45f0df7917b16e0ed469ef481456e08
SSDEEP

384:88OzZll0XCvRgR2l+obC8Ol3kGvrnfHbQkoAmfmBVF4C:88OdlGXCvRC2lvbC8Ol0GznfHbTRc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2dc759c431e5a9a3ade9c5b9f91d91a0.exe

Files

NEAS.2dc759c431e5a9a3ade9c5b9f91d91a0.exe
.exe windows:6 windows x86

5074c67caa9bc84f6d2830a7db52babc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
LoadLibraryA
lstrcatA
GetModuleFileNameA
lstrcmpA
GetCurrentThreadId
GetCurrentProcessId
Sleep
InterlockedCompareExchange
GetStartupInfoA
RtlUnwind
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetUserDefaultLangID
GetPrivateProfileStringW
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange

user32

DrawIcon
IsIconic
GetClientRect
SetForegroundWindow
GetForegroundWindow
LoadStringA
LoadIconA
EnableWindow
GetSystemMetrics
AttachThreadInput
GetWindowThreadProcessId
SendMessageA

mfc42

ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord815
ord641
ord825
ord2514
ord2621
ord4234
ord2645
ord4376
ord4853
ord5981
ord1168
ord5307
ord2379
ord1146
ord324
ord3597
ord4425
ord4627
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1775
ord4078
ord6052
ord4998
ord5265
ord6215
ord3092
ord6199
ord4710
ord755
ord470
ord5289
ord5714
ord2982
ord3147
ord3259
ord1576
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord4274
ord4673
ord2864

msvcrt

_unlock
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_acmdln
exit
_ismbblead
_exit
_cexit
__getmainargs
__CxxFrameHandler
memset
atoi
_controlfp
?terminate@@YAXXZ
wcsncmp
_setmbcp
_XcptFilter
_onexit
_lock
_initterm
__dllonexit

shell32

SHGetFolderPathW

shlwapi

PathRemoveBackslashW
PathRemoveFileSpecW
PathCombineW

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5074c67caa9bc84f6d2830a7db52babc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

mfc42

msvcrt

shell32

shlwapi

Sections

.text Size: 13KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 2KB

.text
Size: 13KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 2KB