NEAS[.]b276655b200751f89a90c8feb2a45030[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b276655b200751f89a90c8feb2a45030.exe
Size

4.2MB
MD5

b276655b200751f89a90c8feb2a45030
SHA1

0d46c45ce39b5ccbce0680bc7f503f4d1f77a11e
SHA256

b61f76baf8edcacb9624d2fb098e2e25fd59a9c06487adee75d385aa786f26f1
SHA512

a65eee5ad70a7a4c61f00622229f98c43091a9995e5e92e4fc945cca7e38cde37f476e3e1a35b3c1a5d6be5ab80f6aa9921aec388ad89ce4062aa84834e97a77
SSDEEP

49152:pzO+cVYqPLRQ16o5zx2UDxB+Oqg5X03YDASp36uMvoYk:pzTcaqlQ1tB+OqgJKN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b276655b200751f89a90c8feb2a45030.exe

Files

NEAS.b276655b200751f89a90c8feb2a45030.exe
.exe windows:6 windows x86

00ad7c1a2d0cb70561840da5c006c063

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcp140

?_Xlength_error@std@@YAXPBD@Z

mfc140

ord3396
ord3395
ord3159
ord1389
ord890
ord2210
ord2241
ord6290
ord4085
ord1141
ord501
ord1526
ord3844
ord11671
ord5631
ord10240
ord10236
ord10238
ord10239
ord10237
ord14699
ord8173
ord10207
ord3295
ord3298
ord6507
ord462
ord12116
ord9192
ord7461
ord1044
ord316
ord6540
ord3874
ord9166
ord10202
ord8182
ord5388
ord7677
ord7688
ord7687
ord5210
ord5390
ord5231
ord5742
ord10421
ord9305
ord5739
ord5528
ord5228
ord1765
ord6463
ord7282
ord1111
ord4807
ord952
ord4084
ord6848
ord6831
ord993
ord13830
ord6323
ord14582
ord6324
ord14583
ord6322
ord14581
ord7964
ord10963
ord14380
ord11928
ord11927
ord2027
ord7905
ord12888
ord4082
ord4143
ord9353
ord14507
ord7886
ord14509
ord12485
ord12484
ord2484
ord10330
ord5336
ord8285
ord7961
ord4580
ord12806
ord12869
ord10383
ord5504
ord11343
ord12190
ord8347
ord1468
ord7618
ord8429
ord13378
ord12162
ord12194
ord8180
ord12182
ord5894
ord1739
ord8997
ord9167
ord2758
ord13677
ord6193
ord1717
ord12201
ord12074
ord10986
ord12111
ord3258
ord3363
ord12205
ord3364
ord3933
ord11672
ord2680
ord8713
ord5401
ord13798
ord14508
ord14054
ord5911
ord3259
ord7887
ord14510
ord3050
ord4485
ord9647
ord5769
ord4493
ord4972
ord4911
ord4896
ord4958
ord10950
ord5003
ord4926
ord4981
ord4997
ord4938
ord13628
ord4944
ord4950
ord6947
ord8922
ord11663
ord4932
ord4987
ord14502
ord4920
ord1772
ord11881
ord12474
ord3830
ord13407
ord12032
ord1109
ord1751
ord2298
ord9096
ord2407
ord12067

kernel32

WaitForSingleObject
GetCurrentDirectoryA
CreateToolhelp32Snapshot
GetExitCodeThread
LoadLibraryA
Process32Next
GetProcAddress
VirtualAllocEx
VirtualFreeEx
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
DeleteCriticalSection
GetStartupInfoW
OutputDebugStringW
SizeofResource
MoveFileA
FindResourceA
GetModuleHandleA
GetLastError
LockResource
CloseHandle
LoadResource
InitializeCriticalSectionEx
Process32First

user32

GetClientRect
DrawIcon
SendMessageA
EnableWindow
IsIconic
GetSystemMetrics
LoadIconW

shell32

SHGetFolderPathA

vcruntime140

__std_exception_copy
_CxxThrowException
__current_exception
__std_exception_destroy
memset
_except_handler4_common
memmove
__current_exception_context
__CxxFrameHandler3
memcpy

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
_callnewh

api-ms-win-crt-runtime-l1-1-0

_controlfp_s
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_setmbcp
_configthreadlocale

Sections

VLicense
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

VLicense
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

VLicense
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

VLicense
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

VLicense
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

VLicense
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

VLicense
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_MEM_EXECUTE

Sharing

General

Malware Config

Signatures

Files

00ad7c1a2d0cb70561840da5c006c063

Headers

DLL Characteristics

File Characteristics

Imports

msvcp140

mfc140

kernel32

user32

shell32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

VLicense Size: 10KB - Virtual size: 10KB

VLicense Size: 9KB - Virtual size: 9KB

VLicense Size: 512B - Virtual size: 1KB

VLicense Size: 78KB - Virtual size: 77KB

VLicense Size: 2KB - Virtual size: 1KB

VLicense Size: 3.1MB - Virtual size: 3.1MB

VLicense Size: 1.0MB - Virtual size: 1.0MB

VLicense
Size: 10KB - Virtual size: 10KB

VLicense
Size: 9KB - Virtual size: 9KB

VLicense
Size: 512B - Virtual size: 1KB

VLicense
Size: 78KB - Virtual size: 77KB

VLicense
Size: 2KB - Virtual size: 1KB

VLicense
Size: 3.1MB - Virtual size: 3.1MB

VLicense
Size: 1.0MB - Virtual size: 1.0MB