NEAS[.]5f3197136630068eb8d6c97bdc765bc0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.5f3197136630068eb8d6c97bdc765bc0.exe
Size

1.2MB
MD5

5f3197136630068eb8d6c97bdc765bc0
SHA1

bf71deb1da61678491cea8b76d9f1f2c23fef3c4
SHA256

23575afe8f51d262c912c699354b4e73ce97906bd27437fb3e480e0334a28694
SHA512

be3baa8828650e6d3629b55dcacea924737e0ca74ff3e9be8d66860b220564f50e882db343aed18ca7d36c93c7ba0166263aa6f342ba5c9ecb10af97b8514ed7
SSDEEP

12288:PZgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WsqjnhMgeiCl7G0nehbGZpbD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5f3197136630068eb8d6c97bdc765bc0.exe

Files

NEAS.5f3197136630068eb8d6c97bdc765bc0.exe
.exe windows:6 windows x64

e5ecaa671cbcec6ce84b3223322d2018

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

gstreamer-1.0-0

gst_buffer_flags_get_type
GST_CAT_DEFAULT
gst_version_string
gst_init_get_option_group
gst_debug_log
gst_structure_from_string
gst_structure_get_string
gst_structure_get_uint64
gst_structure_get
gst_structure_get_name
gst_structure_free
gst_pad_direction_get_type
_gst_debug_min

glib-2.0-0

g_strfreev
g_ptr_array_set_size
g_list_free
g_strdup_printf
g_ptr_array_free
g_strdup
g_strchomp
g_malloc0_n
g_free
g_ptr_array_foreach
g_snprintf
g_set_prgname
g_str_has_suffix
g_slice_free1
g_slice_alloc0
g_match_info_fetch
g_match_info_free
g_regex_match
g_regex_unref
g_regex_new
g_queue_push_tail
g_queue_foreach
g_queue_free_full
g_queue_new
g_option_context_add_group
g_option_context_parse
g_option_context_add_main_entries
g_option_context_free
g_option_context_new
g_print
g_slist_foreach
g_slist_find_custom
g_slist_insert_sorted
g_slist_free
g_str_hash
g_str_equal
g_hash_table_get_values
g_hash_table_size
g_get_prgname
g_hash_table_foreach_remove
g_hash_table_find
g_hash_table_foreach
g_hash_table_lookup
g_hash_table_remove_all
g_hash_table_insert
g_hash_table_destroy
g_hash_table_new_full
g_list_sort
g_ptr_array_new_with_free_func
g_list_foreach
g_strv_length

intl

g_libintl_bindtextdomain
g_libintl_bind_textdomain_codeset
g_libintl_textdomain

vcruntime140

strchr
__C_specific_handler
memset

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_register_onexit_function
_initialize_onexit_table
exit
terminate
_register_thread_local_exe_atexit_callback
_cexit
__p___argv
__p___argc
_seh_filter_exe
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_c_exit
_set_app_type

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vfprintf
rewind
puts
fopen
fgets
feof
fclose
__acrt_iob_func
__p__commode

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

kernel32

GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetModuleHandleW
IsDebuggerPresent

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e5ecaa671cbcec6ce84b3223322d2018

Headers

DLL Characteristics

File Characteristics

Imports

gstreamer-1.0-0

glib-2.0-0

intl

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

Sections

.text Size: 15KB - Virtual size: 14KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 792B

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 15KB - Virtual size: 14KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 792B

.reloc
Size: 1.2MB - Virtual size: 1.8MB