NEAS[.]72dc3d9c6beba123b7d0d1bbd24c44f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.72dc3d9c6beba123b7d0d1bbd24c44f0.exe
Size

242KB
MD5

72dc3d9c6beba123b7d0d1bbd24c44f0
SHA1

9172d02afba4fafe655bba381c272bf745f17290
SHA256

a090e6541d30dc848f5304ec222bdb8f5918bc31c3d2b2605b3ff0e713531f40
SHA512

4086f75f217d5a59cb1461c2ba844bc1ee75d84454e623c028f3958d8ee6b383a8ac69b5b27c53a431664e5f50e4bcb7aea2f0ac9377f3b657f83dbb29fa14b7
SSDEEP

3072:yP2ah7BSuqGnlqVs+by+jE5gkMghkA+RODoKFRzeoRbSMBbwpqgYCmoQ6ihpECAn:CF7BrqG9+G/aFskbODoK1WAoihpE7wy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.72dc3d9c6beba123b7d0d1bbd24c44f0.exe

Files

NEAS.72dc3d9c6beba123b7d0d1bbd24c44f0.exe
.dll windows:10 windows x86

14ad0cea7e3a036d6fa337ae2c997913

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler4_common
_vsnwprintf
_initterm
_amsg_exit
malloc
free
_mbscpy
wcsncpy_s
wcsncmp
memmove_s
strrchr
wcsstr
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
wcscat_s
wcscpy_s
iswspace
iswcntrl
_wcsdup
_wcsicmp
memcpy_s
__CxxFrameHandler3
wcsrchr
wcschr
_XcptFilter
_wcsnicmp
_wsplitpath_s
iswalpha
swscanf_s
_CxxThrowException
_callnewh
_ftol2_sse
_wcsnset
memset

fxsapi

FaxSendDocumentExW
FaxGetRecipientsLimit
FaxFreeSenderInformation
FaxGetSenderInformation
FaxGetReceiptsOptions
FaxConnectFaxServerW
FaxClose
FaxGetPersonalCoverPagesOption
FaxAccessCheckEx

kernel32

ReadFile
ExpandEnvironmentStringsW
GetProcAddress
FreeLibrary
CreateDirectoryW
GetFileAttributesW
MultiByteToWideChar
GetComputerNameW
WideCharToMultiByte
GetLocaleInfoEx
GetUserPreferredUILanguages
SetFilePointer
OutputDebugStringW
GetFileSize
GetVersionExW
GetFullPathNameW
SetEndOfFile
UnmapViewOfFile
CopyFileW
GetFileType
CreateFileMappingW
MapViewOfFileEx
GetCurrentThread
LocalFree
GetModuleFileNameW
FindNextFileW
FindClose
GetLastError
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
GetProcessHeap
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
OpenMutexW
MapViewOfFile
CreateProcessW
CreateEventW
ReleaseMutex
CreateMutexW
SetEnvironmentVariableW
WaitForMultipleObjects
VirtualAlloc
VirtualFree
MulDiv
SetLastError
WriteFile
GetProfileIntW
QueryPerformanceCounter
GetTempPathW
CreateFileW
DeleteFileW
FindFirstFileW
CloseHandle
GetTempFileNameW
MoveFileW
DisableThreadLibraryCalls
LoadLibraryW
lstrlenA
OutputDebugStringA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
GetSystemTime
SystemTimeToFileTime

advapi32

OpenProcessToken
ReportEventW
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
SetSecurityDescriptorOwner
AllocateAndInitializeSid
SetEntriesInAclW
GetSecurityDescriptorOwner
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorGroup
GetTokenInformation
CopySid
IsValidSid
GetLengthSid
OpenThreadToken
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueW
TraceMessage

winspool.drv

GetPrinterW
OpenPrinterW
EnumPrintersW
DocumentPropertiesW
GetJobW
SetJobW
ClosePrinter
FindFirstPrinterChangeNotification
FindNextPrinterChangeNotification
FindClosePrinterChangeNotification

gdi32

GetTextMetricsW
TextOutW
SetBkMode
DeleteObject
SetMapMode
CreateFontIndirectW
StartDocW
EndPage
GetDeviceCaps
CreateDCW
GetTextExtentExPointW
StartPage
SelectObject
GetObjectW
GetStockObject
EndDoc
StretchDIBits
DeleteDC

user32

MessageBoxW
WinHelpW
MessageBeep
DialogBoxParamW
CreateWindowExW
GetWindowTextW
SendMessageW
EndDialog
SetWindowTextW
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
UpdateWindow
InvalidateRect
BeginPaint
EndPaint
GetWindowContextHelpId
EnableWindow
LoadStringW

shell32

SHGetFolderPathAndSubDirW
SHGetFolderPathW
ShellExecuteExW
SHSetLocalizedName

mapi32

ord62
ord82
ord140
ord185
ord17
ord75

comdlg32

ChooseFontW

tapi32

lineTranslateDialogW
lineGetTranslateCapsW
lineTranslateAddressW
lineInitializeExW
lineShutdown

Exports

Exports

ServiceEntry
XPProviderInit

Sections

.text
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14ad0cea7e3a036d6fa337ae2c997913

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

fxsapi

kernel32

advapi32

winspool.drv

gdi32

user32

shell32

mapi32

comdlg32

tapi32

Exports

Exports

Sections

.text Size: 87KB - Virtual size: 86KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 145KB - Virtual size: 145KB

.text
Size: 87KB - Virtual size: 86KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 145KB - Virtual size: 145KB