NEAS[.]a30d939e76beed15cd038f296af37f70[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a30d939e76beed15cd038f296af37f70.exe
Size

17KB
MD5

a30d939e76beed15cd038f296af37f70
SHA1

b8b0bbe27ce7133abd22b9b7c1e1add31584b82c
SHA256

4cdb3409b11d298ef62a504dded509615c1f4e0d723f5faa1de67afec0bbc4e8
SHA512

c12c2a7f358a0830d8266b00c7d57843862c4bba81a4802dbef653341f3d4bf01fb4586ab93d7884f81a6e2449dea5e12cc212c18619140815fd465b0b9661ef
SSDEEP

384:84P3YZOg4yuFeM+zBBk5gmbQ9vzvP7KrVTmt/ArfAKBqzaLUGLGh03C6:0ZOAnPBsgmbQZDKrwtWsGAoGi7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a30d939e76beed15cd038f296af37f70.exe

Files

NEAS.a30d939e76beed15cd038f296af37f70.exe
.exe windows:1 windows x86

942a093bc913b02030965120bd1b655d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExA
RegEnumKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
OpenSCManagerA
CreateServiceA
StartServiceA
ControlService
DeleteService
CloseServiceHandle
RegDeleteValueA
OpenServiceA
QueryServiceStatus
GetUserNameA
RegCreateKeyExA

kernel32

MoveFileA
GetLocalTime
SetUnhandledExceptionFilter
FreeLibrary
lstrlen
GetWindowsDirectoryA
GetStartupInfoA
lstrcmp
GetFileAttributesA
lstrcat
CreateProcessA
lstrcpy
GetSystemDirectoryA
GetTickCount
CopyFileA
DeviceIoControl
SetFileAttributesA
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetLastError
ExitProcess
SetCurrentDirectoryA
WriteFile
GetVersionExA
LoadLibraryA
LoadLibraryExA
GetProcAddress
GetModuleHandleA
GetFileSize
GetModuleFileNameA
GetCommandLineA
LocalAlloc
LocalFree
GetCurrentThread
GetCurrentThreadId
CreateFileA
ReadFile
CloseHandle
Sleep
GetSystemTime

user32

GetSystemMetrics
CharLowerA
SendMessageA
SetWindowsHookExA
SetKeyboardState
ToAscii
MessageBoxA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
ShowWindow
UpdateWindow
ValidateRect
GetCursorPos
WindowFromPoint
GetWindowTextA
CallNextHookEx
RegisterSystemThread
LoadCursorA
LoadIconA
RegisterClassExA
CreateWindowExA
DefWindowProcA
PostQuitMessage
SetCursor
ExitWindowsEx

gdi32

CreateDIBSection
CreatePalette
DeleteObject
RealizePalette
SelectPalette
CreateDCA
DeleteDC
SelectObject
CreateCompatibleDC
SetPixel
BitBlt
GetStockObject

ntdll

NtQuerySystemInformation
RtlAnsiStringToUnicodeString
ZwDeleteFile

wsock32

WSAAsyncSelect
getpeername
inet_addr
bind
connect
ioctlsocket
recv
send
WSACleanup
closesocket
WSAStartup
socket
WSAGetLastError
WSACancelBlockingCall
WSAUnhookBlockingHook
WSASetBlockingHook
gethostbyname

wininet

InternetGetConnectedState
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
HttpQueryInfoA
FtpPutFileA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache

Sections

code
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

bss
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

imports
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

relocs
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

resource
Size: 924B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

942a093bc913b02030965120bd1b655d

Headers

File Characteristics

Imports

advapi32

kernel32

user32

gdi32

ntdll

wsock32

wininet

Sections

code Size: 8KB - Virtual size: 12KB

data Size: 1KB - Virtual size: 4KB

bss Size: - Virtual size: 20KB

imports Size: 3KB - Virtual size: 4KB

relocs Size: 1KB - Virtual size: 4KB

resource Size: 924B - Virtual size: 4KB

code
Size: 8KB - Virtual size: 12KB

data
Size: 1KB - Virtual size: 4KB

bss
Size: - Virtual size: 20KB

imports
Size: 3KB - Virtual size: 4KB

relocs
Size: 1KB - Virtual size: 4KB

resource
Size: 924B - Virtual size: 4KB