NEAS[.]2f34d5d5d5f0b8e29db6d7cb1e9359a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2f34d5d5d5f0b8e29db6d7cb1e9359a0.exe
Size

71KB
MD5

2f34d5d5d5f0b8e29db6d7cb1e9359a0
SHA1

5b36de3c7a6e76845ade89ed5095385fe314147d
SHA256

cf7a51ea8d03a452ba42e62e24fb0ba3563b2da5f2d310822586411ff52aea1f
SHA512

4fbfd68bedc9e03121e6e57dc4e28c0af383704acc8592a6d9ab7637db9a6e10c42a16af6a3450fe43bc43e0ffecba8c54b55a9ef502838ba1a8f2755323dab1
SSDEEP

1536:N3PEEftFT32itBOHreju0EaglyOmF8IQqu:N31+0alyN8f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2f34d5d5d5f0b8e29db6d7cb1e9359a0.exe

Files

NEAS.2f34d5d5d5f0b8e29db6d7cb1e9359a0.exe
.exe windows:4 windows x86

234cd051a24190ae132905598c9168e0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiA
lstrlenA
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
lstrcpyA
WinExec
GetWindowsDirectoryA
DeleteFileA
CloseHandle
WriteFile
GetCurrentProcessId
lstrcatA
CreateFileA
ReadFile
GetFileSize
GetModuleFileNameA
CreateProcessA
CopyFileA
ExitProcess
Sleep
GetModuleHandleA
HeapAlloc
GetProcessHeap
HeapFree
GetProcAddress
LoadLibraryA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
GetCPInfo
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
GetTickCount
InterlockedExchange
GetOEMCP
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcess
TerminateProcess
IsBadWritePtr
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapReAlloc
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
GetStartupInfoA
GetCommandLineA
HeapCreate
VirtualFree

user32

DispatchMessageA
wsprintfA
SetTimer
RegisterClassA
CreateWindowExA
DefWindowProcA
GetMessageA
TranslateMessage
FindWindowA
SendMessageA

advapi32

RegOpenKeyA
RegDeleteValueA
RegCloseKey
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
OpenServiceA
StartServiceA
CloseServiceHandle
RegQueryValueExA

wininet

InternetOpenUrlA
InternetOpenA
InternetCloseHandle

ws2_32

gethostbyname
inet_ntoa
WSAStartup

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

234cd051a24190ae132905598c9168e0

Headers

File Characteristics

Imports

kernel32

user32

advapi32

wininet

ws2_32

Sections

.text Size: 40KB - Virtual size: 38KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 3KB

.text
Size: 40KB - Virtual size: 38KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 3KB