NEAS[.]65728aaf5a7b8c1aeafc789a2b13c300[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.65728aaf5a7b8c1aeafc789a2b13c300.exe
Size

240KB
MD5

65728aaf5a7b8c1aeafc789a2b13c300
SHA1

c75ae77797c463dfcc6c090635948a94f1ec1282
SHA256

08c15a022e388427e3b4e9adf333d1436d0b9df29cadc0b1a355eda252acf4df
SHA512

6d13703b73c99fc1c8403811d61a09dcffacca6a42a2ed884daebe4d57d49d9ebbd5b92a863eac337fac1d61ffd1adafe9c1a6a56942cb701cd4a0d907ad6070
SSDEEP

3072:KKspiWc40UsrzTNO1y9iLWrtm3eRIZVKnlxWxr:ipw4ZOzH9OWOSIZo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.65728aaf5a7b8c1aeafc789a2b13c300.exe

Files

NEAS.65728aaf5a7b8c1aeafc789a2b13c300.exe
.dll windows:4 windows x86

a3cf9776a06c88470dd855ed0cc017ff

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
Sleep
CloseHandle
ReadFile
GetFileSize
MapViewOfFile
WriteFile
DeleteFileA
GetTickCount
GetProcessHeap
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
ReleaseMutex
LoadLibraryExA
CopyFileA
HeapCreate
GetSystemDirectoryA
ExpandEnvironmentStringsA
UpdateResourceA
EndUpdateResourceA
BeginUpdateResourceA
CreateMutexA
GetTempPathA
UnmapViewOfFile
WideCharToMultiByte
GetSystemInfo
CreateFileA

user32

DispatchMessageA
IsWindow
GetWindowThreadProcessId
GetDCEx
wsprintfA
MessageBoxA
WindowFromDC
GetAncestor
PrintWindow
GetWindowInfo
GetWindowRect
IsIconic
ReleaseDC
GetDC
IsWindowVisible
GetWindow
GetKeyboardLayoutList
UnloadKeyboardLayout
SystemParametersInfoA
CallWindowProcA

shlwapi

PathFileExistsA
PathFindFileNameA

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

imm32

ImmInstallIMEA

gdi32

SelectObject
CreateDIBSection
BitBlt
GetObjectA
GetCurrentObject
CreateCompatibleDC
GetStockObject
GetDIBits

msvcrt

strrchr
??3@YAXPAX@Z
rand
_atoi64
strncpy
strncmp
_ftol
atoi
sprintf
_CIfmod
_stricmp
??2@YAPAXI@Z
__CxxFrameHandler
floor
strchr
memmove
modf
free
malloc
_strnicmp

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA

Exports

Exports

Lw_GetUserFunction
lw_BaseNamedObjects
lw_CallFunc
lw_CopyObj
lw_CreateMapping
lw_CreateThread
lw_FindColorBlock
lw_FindMultiColor
lw_FindMultiColorEx
lw_FindMultiColorEx0
lw_FreeLibrary
lw_FreeLibrary_Memory
lw_GdiToDx
lw_GetNtId
lw_GetObjNameIdx
lw_GetProcessPEB
lw_GetWindowPic
lw_HeapAlloc
lw_HeapFree
lw_HeapSize
lw_InstallIMEA
lw_IshProcessDebuggerPresent
lw_LoadLibraryA
lw_LoadLibraryA_Memory
lw_MapView
lw_OpenProcess
lw_OpenThread
lw_OpneMapping
lw_ReadMemory
lw_SendStringA
lw_UnInstallIMEA
lw_UnMapView
lw_VirtualAlloc
lw_VirtualAllocEx
lw_VirtualFree
lw_VirtualFreeEx
lw_VirtualProtect
lw_VirtualQuery
lw_WriteMemory
lw_findPic0
lw_getD3dHookAddr
lw_isProcessX64

Sections

.text
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3cf9776a06c88470dd855ed0cc017ff

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

version

imm32

gdi32

msvcrt

advapi32

Exports

Exports

Sections

.text Size: 168KB - Virtual size: 165KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 8KB - Virtual size: 54KB

.rsrc Size: 4KB - Virtual size: 684B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 168KB - Virtual size: 165KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 8KB - Virtual size: 54KB

.rsrc
Size: 4KB - Virtual size: 684B

.reloc
Size: 4KB - Virtual size: 3KB