NEAS[.]5bc3d3947e58cce84e8c3734f63a02b0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.5bc3d3947e58cce84e8c3734f63a02b0.exe
Size

1.6MB
MD5

5bc3d3947e58cce84e8c3734f63a02b0
SHA1

6e3d5ab26f7af38485b8ff3a3cf873fb56c1556e
SHA256

fa1b63e0577e24a7b087aee252d4359b8876cc2449e6e3c372f428a895bf496f
SHA512

7a36eb6b5d07f02a9c26955a40fbe6806beb66f6e21b111f5d1d9050637848399a6a5dbf2a56c86a91fd493bbd67eac48d521c8bf20884291b3ae67022fc73e5
SSDEEP

49152:xSNFBDi0PNGejJZNLwex+8ck5Ckb3SyD:x2FBDi03jbNEex+u5Ck9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5bc3d3947e58cce84e8c3734f63a02b0.exe

Files

NEAS.5bc3d3947e58cce84e8c3734f63a02b0.exe
.exe windows:4 windows x86

db0ae0a2314aeed7b48c6da3794c408e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileW
RemoveDirectoryW
GetCurrentDirectoryW
CreateFileW
GetFileSize
ReadFile
MultiByteToWideChar
GetFileTime
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
LoadLibraryW
GetPrivateProfileStringW
CreateMutexW
CreateThread
GetLocalTime
GetCommandLineW
GetTickCount
SetFilePointer
WriteFile
EnumResourceLanguagesW
GetUserDefaultLangID
GetUserDefaultUILanguage
GetVersion
ConvertDefaultLocale
GetLocaleInfoW
GetVersionExW
GetCurrentProcess
GetSystemInfo
GetSystemWow64DirectoryW
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateProcess
GetExitCodeProcess
CreateEventW
SetEvent
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileAttributesW
ExitProcess
SetErrorMode
SetEndOfFile
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
LoadLibraryA
GetOEMCP
GetACP
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStartupInfoA
SetHandleCount
GetCurrentThreadId
GetFileType
GetModuleFileNameA
GetStdHandle
HeapCreate
CompareFileTime
CopyFileW
GetTempFileNameW
GetTempPathW
GetEnvironmentVariableW
GetSystemDirectoryW
FreeLibrary
GetProcAddress
GlobalFree
LoadLibraryExW
Sleep
SetFileAttributesW
MoveFileExW
DeleteFileW
WaitForSingleObject
CreateProcessW
SetLastError
VerifyVersionInfoW
VerSetConditionMask
GetWindowsDirectoryW
FindNextFileW
FindClose
TlsAlloc
FindFirstFileW
LocalFree
GetModuleFileNameW
GetLastError
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
TlsSetValue
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
TlsGetValue
HeapDestroy
HeapReAlloc
VirtualAlloc
VirtualFree
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCPInfo
WideCharToMultiByte
CloseHandle
CreateFileA
TlsFree
RtlUnwind
RaiseException
GetStartupInfoW
GetProcessHeap
GetVersionExA
GetModuleHandleA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetConsoleMode
GetConsoleCP
HeapFree
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InterlockedCompareExchange
LocalAlloc

user32

SetFocus
GetDlgItem
SendMessageW
ShowWindow
EndDialog
SetDlgItemTextW
SetTimer
SendDlgItemMessageW
DialogBoxIndirectParamW
MonitorFromWindow
GetMonitorInfoW
OffsetRect
GetWindowLongW
AdjustWindowRect
GetWindowRect
DrawTextW
LoadIconW
SetRectEmpty
PostMessageW
EnableWindow
ReleaseDC
GetDC
wsprintfW
SetWindowPos
GetClientRect
SetWindowTextW
MessageBoxIndirectW
LoadImageW
SendMessageTimeoutW
ExitWindowsEx
EnumWindows
GetWindowThreadProcessId
GetWindowModuleFileNameW
LoadStringW
DialogBoxParamW
MessageBoxW
KillTimer

gdi32

SetBkMode
SetTextColor
DeleteDC
GetTextExtentPoint32W
SelectObject
CreateCompatibleDC
DeleteObject
CreateFontW
GetStockObject

advapi32

RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegEnumValueW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegCreateKeyExW
RegSetValueExW
IsTextUnicode
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
DeleteService
ControlService
QueryServiceConfigW
StartServiceW
CloseServiceHandle
ChangeServiceConfigW
ChangeServiceConfig2W
CreateServiceW
OpenServiceW
OpenSCManagerW
QueryServiceStatus
RegDeleteValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW

shell32

CommandLineToArgvW
SHCreateDirectoryExA
SHCreateDirectoryExW
SHGetFolderPathW

ole32

CoCreateInstance
CLSIDFromString
CoUninitialize
CoInitialize

cabinet

ord22
ord23
ord20
ord21

setupapi

SetupGetLineTextW
SetupGetStringFieldW
SetupFindNextLine
SetupDiGetINFClassW
SetupDiGetClassDevsW
SetupFindFirstLineW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiGetDeviceInstallParamsW
SetupCloseInfFile
SetupOpenInfFileW
SetupDiEnumDeviceInfo

shlwapi

PathAppendA
PathFindFileNameA
PathAddBackslashA
PathRemoveFileSpecA
PathAppendW
PathRenameExtensionW
PathMatchSpecA
PathStripToRootW
PathIsDirectoryW
PathAddBackslashW
PathCombineW
PathRemoveBackslashW
PathIsRootW
PathIsSystemFolderW
PathRemoveFileSpecW
PathFindExtensionW
PathStripPathW
SHDeleteKeyW
PathFileExistsW
PathFindFileNameW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW
EnumProcessModules

Sections

.text
Size: 348KB - Virtual size: 344KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

db0ae0a2314aeed7b48c6da3794c408e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

cabinet

setupapi

shlwapi

version

psapi

Sections

.text Size: 348KB - Virtual size: 344KB

.rdata Size: 76KB - Virtual size: 74KB

.data Size: 8KB - Virtual size: 20KB

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.text
Size: 348KB - Virtual size: 344KB

.rdata
Size: 76KB - Virtual size: 74KB

.data
Size: 8KB - Virtual size: 20KB

.rsrc
Size: 1.1MB - Virtual size: 1.1MB