NEAS[.]6f752d6e81fa05cad5535ba397543e80[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.6f752d6e81fa05cad5535ba397543e80.exe
Size

16KB
MD5

6f752d6e81fa05cad5535ba397543e80
SHA1

06083707a5ffe3dfb7f6b0732c4c09de3ba60969
SHA256

a22443da5e636068fbcb9bf3625443fa58d78dcf50f465d92a5b2f769d33facf
SHA512

d83f676d86c74139876dca21d3fafdf834480029a302fc68335ff375df5d81cf95221e3c599491cb96b4868f517a26d91ac7b8ed09f85cc6f8cef0414a6f1bb2
SSDEEP

384:GBeUkx9mxyaQUjxBxbmTOsqGVio6NzRMKfN:G6xSQUjxBxbW/erzRMKf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.6f752d6e81fa05cad5535ba397543e80.exe

Files

NEAS.6f752d6e81fa05cad5535ba397543e80.exe
.dll windows:4 windows x86

35d32ed3f9ac01c2b958cbb947adafe8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
GetProcAddress
LoadLibraryA
OutputDebugStringA
CreateMutexA
ExitProcess
lstrcpyA
CloseHandle
GetCurrentProcess
lstrlenA
SetLastError
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
MoveFileA
lstrcatA
ExpandEnvironmentStringsA
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameA
GetWindowsDirectoryA
InterlockedExchange
RaiseException
LocalAlloc

user32

wsprintfA

shlwapi

PathRemoveFileSpecA
StrStrIA

msvcrt

_strnicmp
??3@YAXPAX@Z
??2@YAPAXI@Z
_except_handler3
strchr
strncat
free
_initterm
malloc
_adjust_fdiv
_strcmpi
_stricmp

wininet

InternetCheckConnectionA

Exports

Exports

CAPDUtoSM
Cal3DES
ClearPinFromMem
GetSN
HDCSP_CloseDev
HDCSP_ListAllDev
HDCSP_OpenDev
HDM1_ChangePIN
HDM1_GetSn
HDPro_COSType
HDPro_GetSn
HD_APDUDev
HD_CPAcquireContext
HD_CPCreateHash
HD_CPDecrypt
HD_CPDeriveKey
HD_CPDestroyHash
HD_CPDestroyKey
HD_CPDuplicateHash
HD_CPDuplicateKey
HD_CPEncrypt
HD_CPExportKey
HD_CPGenKey
HD_CPGenRandom
HD_CPGetHashParam
HD_CPGetKeyParam
HD_CPGetProvParam
HD_CPGetUserKey
HD_CPHashData
HD_CPHashSessionKey
HD_CPImportKey
HD_CPReleaseContext
HD_CPSetHashParam
HD_CPSetKeyParam
HD_CPSetProvParam
HD_CPSignHash
HD_CPVerifySignature
HD_ChangeOpenPageFlag
HD_CloseDev
HD_Finalize
HD_GetDevInfo
HD_Initialize
HD_IsDefaultPin
HD_IsOpenPage
HD_ListAllDev
HD_OpenDev
HD_ResetDev
HD_SelectDev
HD_ToKenChangeSo
HD_ToKenChangeUser
HD_ToKenGenRSAKeyPair
HD_ToKenVerifySo
HD_ToKenVerifySoSm
HD_ToKenVerifyUser
HD_TokeGetPubKey
HD_TokenCreateCon
HD_TokenDelBinFile_SM
HD_TokenFindCon
HD_TokenGetCert
HD_TokenGetCertSize
HD_TokenImportRsaKeyObj
HD_TokenListContainer
HD_TokenSignData
HD_TokenWrtCert
HDpro_GetPinTime
HDpro_InitDynamicCode
HDpro_IsSupportDynamicCode
HDpro_ReloadPin
HDpro_RemoveDynamicCode
HDpro_UpdataContainerInfo
LockUKey
UnlockUKey
hmac_sha

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35d32ed3f9ac01c2b958cbb947adafe8

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

msvcrt

wininet

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 2KB - Virtual size: 2KB

.reloc Size: 1024B - Virtual size: 940B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 2KB - Virtual size: 2KB

.reloc
Size: 1024B - Virtual size: 940B