NEAS[.]649d9e8a5699416c6776e57c68045570[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.649d9e8a5699416c6776e57c68045570.exe
Size

2.5MB
MD5

649d9e8a5699416c6776e57c68045570
SHA1

29a3dd72b0fb40d2e981a1c28d33bdaa98f721aa
SHA256

3e29aecfbc51fcb1e882ea9bcbb843ae5ce3f75253d9cee2ea3dea08e047b3b2
SHA512

fca3b7e64c24291749859c376998ef4c00b383b74454801a5ae2b2fc370fc7402830912b89957bb7ea1db86332ec7779155f005a0070e6f3acc2f8414830a3ce
SSDEEP

49152:NGJxNcd1UsDc0mdvZTodTBt7QjhOplfirgbYN+ibV3JhVWV3OtVx4Aidp/T9NLwG:NGJEdisDc0mWO54fNEex+u5Ck9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.649d9e8a5699416c6776e57c68045570.exe

Files

NEAS.649d9e8a5699416c6776e57c68045570.exe
.exe windows:6 windows x86

50fc325e4fc72753531885c715a52ee6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorA

kernel32

GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
HeapSize
WriteConsoleW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
WaitForSingleObject
GetModuleHandleA
GetModuleHandleExA
GetLastError
SetDllDirectoryA
GetProcAddress
CreateProcessA
CreateDirectoryA
GetExitCodeProcess
CloseHandle
SizeofResource
FindResourceA
LockResource
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindFirstFileA
SetLastError
FindNextFileA
InitializeCriticalSectionAndSpinCount
FindClose
GetFileAttributesA
MoveFileExA
CreateFileA
DeleteFileA
RaiseException
SetFileAttributesA
DecodePointer
RemoveDirectoryA
DeleteCriticalSection
GetTickCount
GetModuleFileNameA
GetCommandLineW
GetCurrentProcess
GetModuleHandleExW
GetTempPathA
GetSystemDirectoryA
GetNativeSystemInfo
LocalFree
GetCurrentThreadId
Sleep
FormatMessageW
GetLocalTime
GetCurrentProcessId
LoadLibraryW
FreeLibrary
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
HeapAlloc
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
SetEndOfFile
SetStdHandle
RtlUnwind
LoadLibraryExW
GetCommandLineA
CreateFileW
GetFileType
WriteFile
GetConsoleCP
GetConsoleMode
GetStdHandle
GetModuleFileNameW
ExitProcess
HeapFree
ReadConsoleW

Sections

.text
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

50fc325e4fc72753531885c715a52ee6

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

Sections

.text Size: 172KB - Virtual size: 171KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 4KB - Virtual size: 8KB

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 576KB - Virtual size: 580KB

.text
Size: 172KB - Virtual size: 171KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 576KB - Virtual size: 580KB