NEAS[.]7bfa69ec9bfc9363d941bca23aa629e0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.7bfa69ec9bfc9363d941bca23aa629e0.exe
Size

51KB
MD5

7bfa69ec9bfc9363d941bca23aa629e0
SHA1

33dae1744e91a0d371ffe846611b3e6b9edeb048
SHA256

ed8f98a8b72ee1526adc0c68413177737422da99ed07702b4041bb0fa9c1e39d
SHA512

fa56a11eacd57df3812bc52086e265ae8ee3d3daaac38fe792d6ca7f4fd09a6909eca9d2096474fa8b2a3ffd231b0db0022294d430a8548cf2baced3a4508947
SSDEEP

768:3vKPjUJap1c1LpH8l43dvY55xnED4VbSWiMKJEUiX:3iUWa1N8lqdvY55BED4VeWia/X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.7bfa69ec9bfc9363d941bca23aa629e0.exe

Files

NEAS.7bfa69ec9bfc9363d941bca23aa629e0.exe
.exe windows:6 windows x86

f57e95b11cd7b2b8f1d327353ce150a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

apphelp

SdbDeletePermLayerKeys
SdbEnumMsiTransforms
SdbFindFirstMsiPackage
SdbFindFirstMsiPackage_Str
SdbFindFirstNamedTag
SdbFindFirstTag
SdbFindFirstTagRef
SdbFindNextMsiPackage
SdbFindNextTag

mstask

NetrJobEnum
NetrJobGetInfo
SAGetAccountInformation
SAGetNSAccountInformation
SASetAccountInformation
SASetNSAccountInformation
SetNetScheduleAccountInformation

certcli

CAAccessCheck
CAAccessCheckEx

regapi

RegWdQueryA
RegWdQueryA
RegWdQueryA
RegWdQueryA
RegWdQueryA
RegWdQueryA
RegWdQueryA
RegWdQueryW
RegCdCreateW
RegCdDeleteA
RegCdDeleteW
RegCdEnumerateA
RegCdEnumerateW
RegCdQueryA
RegCdQueryW
RegCloseServer
RegUserConfigRename
RegOpenServerA
RegPdEnumerateA

msvcrt

fopen
fread

kernel32

GetSystemDirectoryA
OutputDebugStringW
IsDebuggerPresent
MulDiv
GetTickCount
GetACP
LoadLibraryA
FindVolumeClose
GetCommandLineA

htui

HTUI_DeviceColorAdjustment
HTUI_DeviceColorAdjustmentA
HTUI_DeviceColorAdjustmentW
HTUI_DeviceColorAdjustment
HTUI_DeviceColorAdjustmentA
HTUI_DeviceColorAdjustmentW

iashlpr

AllocateAttributes

sti

StiCreateInstance

polstore

IPSecClosePolicyStore
IPSecCopyFilterData
IPSecCopyFilterSpec
IPSecCopyISAKMPData
IPSecCopyNFAData
IPSecCopyNegPolData
IPSecCopyPolicyData
IPSecCreateFilterData
IPSecCreateISAKMPData
IPSecCreateNFAData
IPSecCreateNegPolData
IPSecCreatePolicyData
IPSecDeleteFilterData
IPSecDeleteISAKMPData
IPSecDeleteNFAData

dbghelp

ImageRvaToSection
ImageRvaToVa

Sections

.text
Size: 7KB - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

rsRC
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f57e95b11cd7b2b8f1d327353ce150a4

Headers

File Characteristics

Imports

apphelp

mstask

certcli

regapi

msvcrt

kernel32

htui

iashlpr

sti

polstore

dbghelp

Sections

.text Size: 7KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 12KB

rsRC Size: 25KB - Virtual size: 25KB

.text
Size: 7KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 12KB

rsRC
Size: 25KB - Virtual size: 25KB