NEAS[.]e711199dbb306540e0c2cc1fa5b0a5c0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.e711199dbb306540e0c2cc1fa5b0a5c0.exe
Size

1.6MB
MD5

e711199dbb306540e0c2cc1fa5b0a5c0
SHA1

bcb8d1eeaeb1d628dffc828204255fb67f036a22
SHA256

5ffee33447930419adf03629c1775edb4a032b31bbe910869837b3b0a5b9ad42
SHA512

16b4efc014dbfaf43d6dc01914e2937516842443ee06d5bb33f277556e672f1c3aaf7900267e69202046fe02cdf42c29cbf1d753a46901019a0ceeac878b2fe6
SSDEEP

24576:XUDHO74NtTFhRbeEmHg6SMs5Ufx0JlPa:XUj/TFZmA9vU4lPa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e711199dbb306540e0c2cc1fa5b0a5c0.exe

Files

NEAS.e711199dbb306540e0c2cc1fa5b0a5c0.exe
.exe windows:6 windows x64

93b9a4e23845d1ff40764bae61b9e289

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

MapViewOfFile
CreateDirectoryW
SizeofResource
SetLastError
GetCurrentProcess
GetModuleFileNameW
GetFileAttributesW
OpenProcess
MultiByteToWideChar
GetPrivateProfileStringW
Sleep
FormatMessageW
LockResource
GlobalFree
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
VirtualQueryEx
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
FindFirstFileW
GetFileSizeEx
GetFullPathNameW
FindNextFileW
FindClose
K32GetProcessImageFileNameW
FileTimeToSystemTime
GetLocalTime
ReadProcessMemory
GetSystemTime
GetProcessTimes
GetCommandLineW
GetCurrentThreadId
lstrcmpiW
LoadLibraryExW
ReadFile
WriteFile
GetSystemInfo
CreateMutexW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CreateThread
GetCurrentProcessId
GlobalMemoryStatusEx
CreateProcessW
HeapDestroy
GetSystemTimeAsFileTime
SetEndOfFile
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
GetConsoleMode
GetConsoleCP
SetFilePointerEx
QueryPerformanceCounter
K32GetProcessMemoryInfo
DeleteCriticalSection
RaiseException
HeapReAlloc
GetLastError
HeapSize
UnmapViewOfFile
OpenFileMappingW
InitializeCriticalSectionEx
VerifyVersionInfoW
GetProcessHeap
VerSetConditionMask
GetProcAddress
HeapAlloc
CloseHandle
CreateFileW
HeapFree
WritePrivateProfileStringW
WriteConsoleW
InitializeSListHead
GetTimeZoneInformation
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetExitCodeProcess
DecodePointer
RtlPcToFileHeader
RtlUnwindEx
TerminateProcess
RtlUnwind
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringW

user32

IsWindow
EnumDisplayDevicesW
GetGuiResources
CharNextW
DestroyWindow
PostMessageW
SetProcessDefaultLayout
SendMessageW
DefWindowProcW

advapi32

RegDeleteValueW
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
GetUserNameW
RegCloseKey
RegOpenKeyExW

shell32

CommandLineToArgvW

ole32

CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoInitialize

oleaut32

VarUI4FromStr

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

shlwapi

PathStripPathW

comctl32

InitCommonControlsEx

Sections

.text
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

93b9a4e23845d1ff40764bae61b9e289

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

wintrust

crypt32

shlwapi

comctl32

Sections

.text Size: 203KB - Virtual size: 203KB

.rdata Size: 66KB - Virtual size: 66KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 10KB - Virtual size: 9KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 83KB - Virtual size: 82KB

.reloc Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 203KB - Virtual size: 203KB

.rdata
Size: 66KB - Virtual size: 66KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 10KB - Virtual size: 9KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 83KB - Virtual size: 82KB

.reloc
Size: 1.3MB - Virtual size: 1.3MB