NEAS[.]e3fca4fd7416b0d633f07752dc66c8b0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.e3fca4fd7416b0d633f07752dc66c8b0.exe
Size

3.3MB
MD5

e3fca4fd7416b0d633f07752dc66c8b0
SHA1

563a4ff3972e9520cf30f36b470e0c08b2f1b4c1
SHA256

b2c242e17df52add52c64fb9b07fbfcd76bffb2c1527e4587266d1ecf195f769
SHA512

9c9f3a365bf11210759f471bdc9c177d77796cde8cc4b46027a3300a3644c044a4a6717a526676d9579b2bcf98f336ab04104871ea57781c9d8e9942ac90fcca
SSDEEP

49152:PiRF2FdsltJ2Y9PGs8IeF7Bts1WhOza4KD/VMgieynRp6DoTQj1Gr70TzrlGC3jO:KRoFdqtJTPGs8IeF7jobY/agieye

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e3fca4fd7416b0d633f07752dc66c8b0.exe

Files

NEAS.e3fca4fd7416b0d633f07752dc66c8b0.exe
.dll windows:5 windows x86

e2797ba93c4a7d0bb982d3d3944a5d5f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OutputDebugStringA
GlobalFree
GetModuleHandleW
CompareStringW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
GetCurrentProcessId
GlobalFlags
lstrcmpW
GlobalGetAtomNameW
GlobalAddAtomW
CreateFileW
FindClose
FindFirstFileW
FlushFileBuffers
GetFileSize
GetFullPathNameW
GetVolumeInformationW
LockFile
ReadFile
SetEndOfFile
SetFilePointer
UnlockFile
WriteFile
DuplicateHandle
LoadLibraryExW
lstrcmpiW
SetEvent
CreateEventW
GetCurrentThreadId
SetThreadPriority
ResumeThread
EncodePointer
GetSystemDirectoryW
FreeResource
GlobalDeleteAtom
GlobalFindAtomW
GetCurrentThread
GetVersionExW
FileTimeToLocalFileTime
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFileTime
GetLocaleInfoW
GetUserDefaultUILanguage
VirtualProtect
GetCurrentDirectoryW
lstrcpyW
FindResourceExW
GetWindowsDirectoryW
VerSetConditionMask
VerifyVersionInfoW
GetTempPathW
GetTickCount
GetProfileIntW
SearchPathW
Sleep
GetTempFileNameW
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetStringTypeW
TryEnterCriticalSection
SwitchToThread
GetExitCodeThread
QueryPerformanceFrequency
GetCPInfo
LCMapStringW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetSystemInfo
VirtualAlloc
VirtualQuery
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
HeapQueryInformation
CreateThread
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
SetStdHandle
ExitProcess
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CreateTimerQueue
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
lstrcmpA
CopyFileW
MulDiv
LoadLibraryW
FreeLibrary
GetUserDefaultLCID
GetUserDefaultLangID
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
LocalFree
FormatMessageW
GetModuleFileNameW
GetCurrentProcess
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
SetLastError
WTSGetActiveConsoleSessionId
GetLastError
CloseHandle
CreateMutexW
ReleaseMutex
WaitForSingleObject
GetModuleHandleA
MultiByteToWideChar

user32

PostQuitMessage
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
InflateRect
IntersectRect
DestroyMenu
GetMenuItemInfoW
SystemParametersInfoW
CopyImage
SendDlgItemMessageA
SetRectEmpty
OffsetRect
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
GetAsyncKeyState
MapDialogRect
ShowOwnedPopups
SetCursor
DeleteMenu
SetTimer
KillTimer
InvalidateRect
TrackMouseEvent
LoadImageW
GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
DrawFocusRect
IsRectEmpty
DrawIconEx
GetIconInfo
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
MapVirtualKeyW
GetKeyNameTextW
LoadMenuW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongW
SetWindowRgn
SetParent
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateW
DrawEdge
DrawFrameControl
IsZoomed
GetSystemMenu
BringWindowToTop
SetCursorPos
CopyIcon
FrameRect
DrawIcon
UnionRect
UpdateLayeredWindow
MonitorFromPoint
LoadAcceleratorsW
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
GetComboBoxInfo
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
SetActiveWindow
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
MonitorFromWindow
CreateMenu
GetWindowRgn
DestroyCursor
IsDialogMessageW
SetWindowLongW
SetWindowTextW
GetFocus
GetDlgCtrlID
CheckDlgButton
GetDlgItem
SetWindowPos
MoveWindow
ShowWindow
IsWindow
GetWindow
GetScrollPos
SetScrollPos
SetFocus
GetLastActivePopup
GetWindowThreadProcessId
GetParent
GetWindowLongW
MessageBoxW
IsWindowEnabled
EnableWindow
SendMessageW
LoadCursorW
GetSysColorBrush
GetSysColor
ReleaseDC
GetDC
GetSystemMetrics
UnhookWindowsHookEx
GetWindowTextLengthW
GetWindowTextW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
UpdateWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageTime
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
GetTopWindow
GetMessagePos
RegisterWindowMessageW
FillRect
ScreenToClient
GetClassLongW
EqualRect
CopyRect
MapWindowPoints
AdjustWindowRectEx
GetClientRect
RemovePropW
GetPropW
SetPropW
EndPaint
LoadStringW
GetProcessWindowStation
GetUserObjectInformationW
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
GetWindowRect
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
ShowScrollBar
GetScrollRange
SetScrollRange
ScrollWindow
RedrawWindow
SetForegroundWindow
GetMessageW
CharUpperW
DestroyIcon
GetForegroundWindow
RealChildWindowFromPoint
GetClassNameW
GetDesktopWindow
PtInRect
MapVirtualKeyExW
ClientToScreen
CallNextHookEx

advapi32

RegDeleteKeyW
RegOpenKeyExW
CryptEnumProvidersA
RegCloseKey
RegOpenKeyW
CryptSignHashA
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptGetKeyParam
CryptGetUserKey
CryptCreateHash
CryptGetProvParam
CryptAcquireContextA
CryptEnumProvidersW
CryptSetProvParam
CryptVerifySignatureW
CryptAcquireContextW
CryptDestroyKey
CryptReleaseContext
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW

ole32

CoInitializeEx
CreateStreamOnHGlobal
DoDragDrop
OleGetClipboard
CoLockObjectExternal
RevokeDragDrop
OleLockRunning
CoUninitialize
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
CoDisconnectObject
CoCreateInstance
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoInitialize
RegisterDragDrop

oleaut32

SafeArrayCopy
VariantInit
SafeArrayLock
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnlock
SysAllocStringLen
SetErrorInfo
SysStringByteLen
SysAllocStringByteLen
SafeArrayCreate
SafeArrayDestroy
VariantClear
SystemTimeToVariantTime
SysFreeString
SysAllocString
GetErrorInfo
VariantChangeType
VariantCopy
SafeArrayGetVartype
SysStringLen
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
VarBstrFromDate
LoadTypeLi
VariantTimeToSystemTime

msimg32

AlphaBlend
TransparentBlt

shlwapi

PathFindExtensionW
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
StrFormatKBSizeW
PathFindFileNameW

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
DrawThemeParentBackground
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetThemePartSize
DrawThemeText
GetWindowTheme

crypt32

CertFreeCertificateContext
CertFreeCRLContext
CryptFindOIDInfo
CertDuplicateCertificateContext
CertDuplicateCRLContext
CertCreateCertificateContext
CryptMsgClose
CryptMsgOpenToEncode
CryptMsgOpenToDecode
CryptMsgUpdate
CryptMsgGetParam
CryptMsgControl
CertGetCertificateContextProperty
CertGetCRLContextProperty
CertFindCRLInStore
CertNameToStrW
CryptImportPublicKeyInfo
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CryptVerifyMessageSignatureWithKey
CertSetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetSubjectCertificateFromStore
CryptAcquireCertificatePrivateKey
CryptImportPublicKeyInfoEx

winscard

SCardReleaseContext
SCardListReadersW
SCardDisconnect
SCardEstablishContext

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoSizeW

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

gdiplus

GdiplusShutdown
GdipAlloc
GdipFree
GdiplusStartup
GdipCloneImage
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

gdi32

SelectObject
ExtSelectClipRgn
SelectClipRgn
SelectPalette
GetTextFaceW
SaveDC
GetViewportOrgEx
GetWindowOrgEx
SetPixelV
SetPaletteEntries
ExtFloodFill
PtInRegion
GetBoundsRect
FrameRgn
FillRgn
RoundRect
OffsetRgn
GetRgnBox
Rectangle
LPtoDP
CreateRoundRectRgn
Polyline
Polygon
CreatePolygonRgn
GetTextColor
Ellipse
CreateEllipticRgn
SetDIBColorTable
CreateDIBSection
StretchBlt
SetPixel
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
CreateBitmap
BitBlt
DeleteObject
GetDeviceCaps
CopyMetaFileW
GetTextCharsetInfo
EnumFontFamiliesW
CreateDIBitmap
CreateCompatibleBitmap
GetBkColor
RealizePalette
GetSystemPaletteEntries
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
EnumFontFamiliesExW
GetTextMetricsW
GetTextExtentPoint32W
DPtoLP
SetRectRgn
PatBlt
CreateRectRgnIndirect
CreateFontIndirectW
CombineRgn
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
ExtTextOutW
TextOutW
MoveToEx
GetObjectW
SetBkColor
SetBkMode
SetTextAlign
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
CreateDCW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

shell32

SHAppBarMessage
SHBrowseForFolderW
DragFinish
DragQueryFileW
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder

Exports

Exports

ByteArrayToBASE64SAA
ByteArrayToBASE64SAW
CMSCreateAttachedMessageSignature
CMSCreateDetachedMessageSignature
CMSVerifyAttachedMessageSignature
CMSVerifyDetachedMessageSignature
DllDecryptMessage
DllEncryptMessageBER
DllEncryptMessageDER
DllFinalRelease
DllGetClassObject
DllGetVersion
DllOpenCertificateStore
DllValidateCryptoProvider
DllVerifyMRTD
DllVerifyMessage
EVerifyMRTDCertificate

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 592KB - Virtual size: 591KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 202KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2797ba93c4a7d0bb982d3d3944a5d5f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

msimg32

shlwapi

uxtheme

crypt32

winscard

wtsapi32

version

oleacc

gdiplus

imm32

winmm

gdi32

winspool.drv

shell32

Exports

Exports

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 592KB - Virtual size: 591KB

.data Size: 47KB - Virtual size: 66KB

.rsrc Size: 20KB - Virtual size: 20KB

.reloc Size: 202KB - Virtual size: 201KB

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 592KB - Virtual size: 591KB

.data
Size: 47KB - Virtual size: 66KB

.rsrc
Size: 20KB - Virtual size: 20KB

.reloc
Size: 202KB - Virtual size: 201KB