NEAS[.]0e6ad36ba790d59e2dbab6bf73845f00[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0e6ad36ba790d59e2dbab6bf73845f00.exe
Size

312KB
MD5

0e6ad36ba790d59e2dbab6bf73845f00
SHA1

5198a9360a87c9517fcbaa88c6b55ea8cb61b7d1
SHA256

f73cef798454e46c8044b4014026dec37d33f319a705accae088f35be7443705
SHA512

b941a887cf5de8486d61f4a177f7060e4e4c28849b1a5339a2439e293a5b64b85b70c197252d1848196a6ef3ac8d047c643fc25a3532bcfa3aeff3b6d8869180
SSDEEP

6144:O8AVcgmcC8tosDUXyEu7K5LLrV35g0niiMYKQ5+/Ye+5ylcsOZMhTuQ:O8ymcC8tosDUXyyLATdcJ5FsAMhTuQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0e6ad36ba790d59e2dbab6bf73845f00.exe

Files

NEAS.0e6ad36ba790d59e2dbab6bf73845f00.exe
.dll windows:4 windows x64

251081480d708ff9acd45608bca0363d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

libffi-7

ffi_call
ffi_prep_cif
ffi_type_double
ffi_type_float
ffi_type_pointer
ffi_type_sint32
ffi_type_sint64
ffi_type_uint32
ffi_type_uint64
ffi_type_void

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
exit
free
fwrite
memcmp
memcpy
memmove
memset
qsort
realloc
strcat
strchr
strcmp
strlen
strncmp
strncpy
vfprintf

libglib-2.0-0

g_array_append_vals
g_array_free
g_array_new
g_array_ref
g_array_unref
g_assertion_message_expr
g_atomic_rc_box_acquire
g_atomic_rc_box_alloc0
g_atomic_rc_box_release_full
g_byte_array_ref
g_byte_array_unref
g_bytes_ref
g_bytes_unref
g_checksum_copy
g_checksum_free
g_child_watch_funcs
g_datalist_clear
g_datalist_get_data
g_datalist_get_flags
g_datalist_id_dup_data
g_datalist_id_get_data
g_datalist_id_remove_no_notify
g_datalist_id_replace_data
g_datalist_id_set_data_full
g_datalist_set_flags
g_datalist_unset_flags
g_date_copy
g_date_free
g_date_time_ref
g_date_time_unref
g_direct_hash
g_error_copy
g_error_free
g_free
g_getenv
g_hash_table_add
g_hash_table_contains
g_hash_table_foreach
g_hash_table_insert
g_hash_table_lookup
g_hash_table_new
g_hash_table_ref
g_hash_table_remove
g_hash_table_unref
g_hook_alloc
g_hook_destroy
g_hook_destroy_link
g_hook_first_valid
g_hook_insert_before
g_hook_list_clear
g_hook_list_init
g_hook_next_valid
g_idle_funcs
g_intern_static_string
g_intern_string
g_io_channel_ref
g_io_channel_unref
g_io_watch_funcs
g_key_file_ref
g_key_file_unref
g_list_free
g_list_prepend
g_log
g_main_context_ref
g_main_context_unref
g_main_loop_ref
g_main_loop_unref
g_malloc
g_malloc0
g_malloc0_n
g_malloc_n
g_mapped_file_ref
g_mapped_file_unref
g_markup_parse_context_ref
g_markup_parse_context_unref
g_match_info_ref
g_match_info_unref
g_memdup2
g_mutex_clear
g_mutex_init
g_mutex_lock
g_mutex_unlock
g_nullify_pointer
g_once_init_enter
g_once_init_leave
g_option_group_ref
g_option_group_unref
g_parse_debug_string
g_ptr_array_ref
g_ptr_array_unref
g_qsort_with_data
g_quark_from_static_string
g_quark_from_string
g_quark_to_string
g_quark_try_string
g_realloc
g_realloc_n
g_rec_mutex_lock
g_rec_mutex_unlock
g_regex_ref
g_regex_unref
g_return_if_fail_warning
g_rw_lock_reader_lock
g_rw_lock_reader_unlock
g_rw_lock_writer_lock
g_rw_lock_writer_unlock
g_slice_alloc
g_slice_alloc0
g_slice_free1
g_slist_append
g_slist_copy
g_slist_delete_link
g_slist_find
g_slist_free
g_slist_length
g_slist_prepend
g_slist_remove
g_slist_sort
g_source_destroy
g_source_ref
g_source_set_callback_indirect
g_source_unref
g_str_equal
g_str_hash
g_strcmp0
g_strconcat
g_strdup
g_strdup_printf
g_strdupv
g_strescape
g_strfreev
g_string_append
g_string_append_printf
g_string_free
g_string_new
g_string_new_len
g_thread_ref
g_thread_unref
g_time_zone_ref
g_time_zone_unref
g_timeout_funcs
g_tree_ref
g_tree_unref
g_unichar_validate
g_uri_ref
g_uri_unref
g_variant_builder_ref
g_variant_builder_unref
g_variant_classify
g_variant_compare
g_variant_dict_ref
g_variant_dict_unref
g_variant_equal
g_variant_get_type
g_variant_is_of_type
g_variant_ref_sink
g_variant_take_ref
g_variant_type_copy
g_variant_type_equal
g_variant_type_free
g_variant_unref
glib__private__
glib_gettext

Exports

Exports

g_array_get_type
g_binding_dup_source
g_binding_dup_target
g_binding_flags_get_type
g_binding_get_flags
g_binding_get_source
g_binding_get_source_property
g_binding_get_target
g_binding_get_target_property
g_binding_get_type
g_binding_unbind
g_boxed_copy
g_boxed_free
g_boxed_type_register_static
g_byte_array_get_type
g_bytes_get_type
g_cclosure_marshal_BOOLEAN__BOXED_BOXED
g_cclosure_marshal_BOOLEAN__BOXED_BOXEDv
g_cclosure_marshal_BOOLEAN__FLAGS
g_cclosure_marshal_BOOLEAN__FLAGSv
g_cclosure_marshal_STRING__OBJECT_POINTER
g_cclosure_marshal_STRING__OBJECT_POINTERv
g_cclosure_marshal_VOID__BOOLEAN
g_cclosure_marshal_VOID__BOOLEANv
g_cclosure_marshal_VOID__BOXED
g_cclosure_marshal_VOID__BOXEDv
g_cclosure_marshal_VOID__CHAR
g_cclosure_marshal_VOID__CHARv
g_cclosure_marshal_VOID__DOUBLE
g_cclosure_marshal_VOID__DOUBLEv
g_cclosure_marshal_VOID__ENUM
g_cclosure_marshal_VOID__ENUMv
g_cclosure_marshal_VOID__FLAGS
g_cclosure_marshal_VOID__FLAGSv
g_cclosure_marshal_VOID__FLOAT
g_cclosure_marshal_VOID__FLOATv
g_cclosure_marshal_VOID__INT
g_cclosure_marshal_VOID__INTv
g_cclosure_marshal_VOID__LONG
g_cclosure_marshal_VOID__LONGv
g_cclosure_marshal_VOID__OBJECT
g_cclosure_marshal_VOID__OBJECTv
g_cclosure_marshal_VOID__PARAM
g_cclosure_marshal_VOID__PARAMv
g_cclosure_marshal_VOID__POINTER
g_cclosure_marshal_VOID__POINTERv
g_cclosure_marshal_VOID__STRING
g_cclosure_marshal_VOID__STRINGv
g_cclosure_marshal_VOID__UCHAR
g_cclosure_marshal_VOID__UCHARv
g_cclosure_marshal_VOID__UINT
g_cclosure_marshal_VOID__UINT_POINTER
g_cclosure_marshal_VOID__UINT_POINTERv
g_cclosure_marshal_VOID__UINTv
g_cclosure_marshal_VOID__ULONG
g_cclosure_marshal_VOID__ULONGv
g_cclosure_marshal_VOID__VARIANT
g_cclosure_marshal_VOID__VARIANTv
g_cclosure_marshal_VOID__VOID
g_cclosure_marshal_VOID__VOIDv
g_cclosure_marshal_generic
g_cclosure_marshal_generic_va
g_cclosure_new
g_cclosure_new_object
g_cclosure_new_object_swap
g_cclosure_new_swap
g_checksum_get_type
g_clear_object
g_clear_signal_handler
g_closure_add_finalize_notifier
g_closure_add_invalidate_notifier
g_closure_add_marshal_guards
g_closure_get_type
g_closure_invalidate
g_closure_invoke
g_closure_new_object
g_closure_new_simple
g_closure_ref
g_closure_remove_finalize_notifier
g_closure_remove_invalidate_notifier
g_closure_set_marshal
g_closure_set_meta_marshal
g_closure_sink
g_closure_unref
g_date_get_type
g_date_time_get_type
g_enum_complete_type_info
g_enum_get_value
g_enum_get_value_by_name
g_enum_get_value_by_nick
g_enum_register_static
g_enum_to_string
g_error_get_type
g_flags_complete_type_info
g_flags_get_first_value
g_flags_get_value_by_name
g_flags_get_value_by_nick
g_flags_register_static
g_flags_to_string
g_gstring_get_type
g_gtype_get_type
g_hash_table_get_type
g_initially_unowned_get_type
g_io_channel_get_type
g_io_condition_get_type
g_key_file_get_type
g_main_context_get_type
g_main_loop_get_type
g_mapped_file_get_type
g_markup_parse_context_get_type
g_match_info_get_type
g_normalize_mode_get_type
g_object_add_toggle_ref
g_object_add_weak_pointer
g_object_bind_property
g_object_bind_property_full
g_object_bind_property_with_closures
g_object_class_find_property
g_object_class_install_properties
g_object_class_install_property
g_object_class_list_properties
g_object_class_override_property
g_object_compat_control
g_object_connect
g_object_disconnect
g_object_dup_data
g_object_dup_qdata
g_object_force_floating
g_object_freeze_notify
g_object_get
g_object_get_data
g_object_get_property
g_object_get_qdata
g_object_get_type
g_object_get_valist
g_object_getv
g_object_interface_find_property
g_object_interface_install_property
g_object_interface_list_properties
g_object_is_floating
g_object_new
g_object_new_valist
g_object_new_with_properties
g_object_newv
g_object_notify
g_object_notify_by_pspec
g_object_ref
g_object_ref_sink
g_object_remove_toggle_ref
g_object_remove_weak_pointer
g_object_replace_data
g_object_replace_qdata
g_object_run_dispose
g_object_set
g_object_set_data
g_object_set_data_full
g_object_set_property
g_object_set_qdata
g_object_set_qdata_full
g_object_set_valist
g_object_setv
g_object_steal_data
g_object_steal_qdata
g_object_thaw_notify
g_object_unref
g_object_watch_closure
g_object_weak_ref
g_object_weak_unref
g_option_group_get_type
g_param_spec_boolean
g_param_spec_boxed
g_param_spec_char
g_param_spec_double
g_param_spec_enum
g_param_spec_flags
g_param_spec_float
g_param_spec_get_blurb
g_param_spec_get_default_value
g_param_spec_get_name
g_param_spec_get_name_quark
g_param_spec_get_nick
g_param_spec_get_qdata
g_param_spec_get_redirect_target
g_param_spec_gtype
g_param_spec_int
g_param_spec_int64
g_param_spec_internal
g_param_spec_is_valid_name
g_param_spec_long
g_param_spec_object
g_param_spec_override
g_param_spec_param
g_param_spec_pointer
g_param_spec_pool_insert
g_param_spec_pool_list
g_param_spec_pool_list_owned
g_param_spec_pool_lookup
g_param_spec_pool_new
g_param_spec_pool_remove
g_param_spec_ref
g_param_spec_ref_sink
g_param_spec_set_qdata
g_param_spec_set_qdata_full
g_param_spec_sink
g_param_spec_steal_qdata
g_param_spec_string
g_param_spec_types
g_param_spec_uchar
g_param_spec_uint
g_param_spec_uint64
g_param_spec_ulong
g_param_spec_unichar
g_param_spec_unref
g_param_spec_value_array
g_param_spec_variant
g_param_type_register_static
g_param_value_convert
g_param_value_defaults
g_param_value_set_default
g_param_value_validate
g_param_values_cmp
g_pointer_type_register_static
g_pollfd_get_type
g_ptr_array_get_type
g_regex_get_type
g_signal_accumulator_first_wins
g_signal_accumulator_true_handled
g_signal_add_emission_hook
g_signal_chain_from_overridden
g_signal_chain_from_overridden_handler
g_signal_connect_closure
g_signal_connect_closure_by_id
g_signal_connect_data
g_signal_connect_object
g_signal_emit
g_signal_emit_by_name
g_signal_emit_valist
g_signal_emitv
g_signal_get_invocation_hint
g_signal_handler_block
g_signal_handler_disconnect
g_signal_handler_find
g_signal_handler_is_connected
g_signal_handler_unblock
g_signal_handlers_block_matched
g_signal_handlers_destroy
g_signal_handlers_disconnect_matched
g_signal_handlers_unblock_matched
g_signal_has_handler_pending
g_signal_is_valid_name
g_signal_list_ids
g_signal_lookup
g_signal_name
g_signal_new
g_signal_new_class_handler
g_signal_new_valist
g_signal_newv
g_signal_override_class_closure
g_signal_override_class_handler
g_signal_parse_name
g_signal_query
g_signal_remove_emission_hook
g_signal_set_va_marshaller
g_signal_stop_emission
g_signal_stop_emission_by_name
g_signal_type_cclosure_new
g_source_get_type
g_source_set_closure
g_source_set_dummy_callback
g_strdup_value_contents
g_strv_get_type
g_thread_get_type
g_time_zone_get_type
g_tree_get_type
g_type_add_class_cache_func
g_type_add_class_private
g_type_add_instance_private
g_type_add_interface_check
g_type_add_interface_dynamic
g_type_add_interface_static
g_type_check_class_cast
g_type_check_class_is_a
g_type_check_instance
g_type_check_instance_cast
g_type_check_instance_is_a
g_type_check_instance_is_fundamentally_a
g_type_check_is_value_type
g_type_check_value
g_type_check_value_holds
g_type_children
g_type_class_add_private
g_type_class_adjust_private_offset
g_type_class_get_instance_private_offset
g_type_class_get_private
g_type_class_peek
g_type_class_peek_parent
g_type_class_peek_static
g_type_class_ref
g_type_class_unref
g_type_class_unref_uncached
g_type_create_instance
g_type_default_interface_peek
g_type_default_interface_ref
g_type_default_interface_unref
g_type_depth
g_type_ensure
g_type_free_instance
g_type_from_name
g_type_fundamental
g_type_fundamental_next
g_type_get_instance_count
g_type_get_plugin
g_type_get_qdata
g_type_get_type_registration_serial
g_type_init
g_type_init_with_debug_flags
g_type_instance_get_private
g_type_interface_add_prerequisite
g_type_interface_get_plugin
g_type_interface_instantiatable_prerequisite
g_type_interface_peek
g_type_interface_peek_parent
g_type_interface_prerequisites
g_type_interfaces
g_type_is_a
g_type_module_add_interface
g_type_module_get_type
g_type_module_register_enum
g_type_module_register_flags
g_type_module_register_type
g_type_module_set_name
g_type_module_unuse
g_type_module_use
g_type_name
g_type_name_from_class
g_type_name_from_instance
g_type_next_base
g_type_parent
g_type_plugin_complete_interface_info
g_type_plugin_complete_type_info
g_type_plugin_get_type
g_type_plugin_unuse
g_type_plugin_use
g_type_qname
g_type_query
g_type_register_dynamic
g_type_register_fundamental
g_type_register_static
g_type_register_static_simple
g_type_remove_class_cache_func
g_type_remove_interface_check
g_type_set_qdata
g_type_test_flags
g_type_value_table_peek
g_unicode_break_type_get_type
g_unicode_script_get_type
g_unicode_type_get_type
g_uri_get_type
g_value_array_append
g_value_array_copy
g_value_array_free
g_value_array_get_nth
g_value_array_get_type
g_value_array_insert
g_value_array_new
g_value_array_prepend
g_value_array_remove
g_value_array_sort
g_value_array_sort_with_data
g_value_copy
g_value_dup_boxed
g_value_dup_object
g_value_dup_param
g_value_dup_string
g_value_dup_variant
g_value_fits_pointer
g_value_get_boolean
g_value_get_boxed
g_value_get_char
g_value_get_double
g_value_get_enum
g_value_get_flags
g_value_get_float
g_value_get_gtype
g_value_get_int
g_value_get_int64
g_value_get_long
g_value_get_object
g_value_get_param
g_value_get_pointer
g_value_get_schar
g_value_get_string
g_value_get_type
g_value_get_uchar
g_value_get_uint
g_value_get_uint64
g_value_get_ulong
g_value_get_variant
g_value_init
g_value_init_from_instance
g_value_peek_pointer
g_value_register_transform_func
g_value_reset
g_value_set_boolean
g_value_set_boxed
g_value_set_boxed_take_ownership
g_value_set_char
g_value_set_double
g_value_set_enum
g_value_set_flags
g_value_set_float
g_value_set_gtype
g_value_set_instance
g_value_set_int
g_value_set_int64
g_value_set_interned_string
g_value_set_long
g_value_set_object
g_value_set_object_take_ownership
g_value_set_param
g_value_set_param_take_ownership
g_value_set_pointer
g_value_set_schar
g_value_set_static_boxed
g_value_set_static_string
g_value_set_string
g_value_set_string_take_ownership
g_value_set_uchar
g_value_set_uint
g_value_set_uint64
g_value_set_ulong
g_value_set_variant
g_value_take_boxed
g_value_take_object
g_value_take_param
g_value_take_string
g_value_take_variant
g_value_transform
g_value_type_compatible
g_value_type_transformable
g_value_unset
g_variant_builder_get_type
g_variant_dict_get_type
g_variant_get_gtype
g_variant_type_get_gtype
g_weak_ref_clear
g_weak_ref_get
g_weak_ref_init
g_weak_ref_set

Sections

.text
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

251081480d708ff9acd45608bca0363d

Headers

DLL Characteristics

File Characteristics

Imports

libffi-7

kernel32

msvcrt

libglib-2.0-0

Exports

Exports

Sections

.text Size: 189KB - Virtual size: 188KB

.data Size: 512B - Virtual size: 288B

.rdata Size: 64KB - Virtual size: 63KB

.pdata Size: 11KB - Virtual size: 10KB

.xdata Size: 10KB - Virtual size: 9KB

.bss Size: - Virtual size: 3KB

.edata Size: 15KB - Virtual size: 14KB

.idata Size: 8KB - Virtual size: 8KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 904B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 189KB - Virtual size: 188KB

.data
Size: 512B - Virtual size: 288B

.rdata
Size: 64KB - Virtual size: 63KB

.pdata
Size: 11KB - Virtual size: 10KB

.xdata
Size: 10KB - Virtual size: 9KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 15KB - Virtual size: 14KB

.idata
Size: 8KB - Virtual size: 8KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 904B

.reloc
Size: 2KB - Virtual size: 1KB