NEAS[.]9b1232b922d3d09d14edd7391c75e3c0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.9b1232b922d3d09d14edd7391c75e3c0.exe
Size

564KB
MD5

9b1232b922d3d09d14edd7391c75e3c0
SHA1

5c2ed22da4ba8c895024d3c693c2ceab4c921c37
SHA256

cfb7d646c7b7741a03bdf5d0cbfb96f22d0638ac5777346949129579ac6c09d4
SHA512

9b16470f62296fde0421e453eb6a0fda398fb8790ba4bf514365548e4ec4872bde262172c2fb6cd702d592f80c51078a5de1f138920d7080b2f1682c13ebd406
SSDEEP

12288:tehnaNPpSVZmNxRCwnwm3W3OHIIf5m9RhWFVM:teh0PpS6NxNnwYeOHXAhWTM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9b1232b922d3d09d14edd7391c75e3c0.exe

Files

NEAS.9b1232b922d3d09d14edd7391c75e3c0.exe
.dll windows:4 windows x86

a24bdda400a413aa6d759d0b8e02ddd9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GlobalMemoryStatus
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
HeapFree
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
RtlUnwind
GetProcAddress
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
WideCharToMultiByte
GetTimeZoneInformation
Sleep
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryA
LCMapStringA
LCMapStringW
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CreateFileA
CloseHandle
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

WXMPIterator_DecrementRefCount_1
WXMPIterator_IncrementRefCount_1
WXMPIterator_Next_1
WXMPIterator_PropCTor_1
WXMPIterator_Skip_1
WXMPIterator_TableCTor_1
WXMPIterator_Unlock_1
WXMPMeta_AppendArrayItem_1
WXMPMeta_CTor_1
WXMPMeta_Clone_1
WXMPMeta_CountArrayItems_1
WXMPMeta_DecrementRefCount_1
WXMPMeta_DeleteAlias_1
WXMPMeta_DeleteArrayItem_1
WXMPMeta_DeleteNamespace_1
WXMPMeta_DeleteProperty_1
WXMPMeta_DeleteQualifier_1
WXMPMeta_DeleteStructField_1
WXMPMeta_DoesArrayItemExist_1
WXMPMeta_DoesPropertyExist_1
WXMPMeta_DoesQualifierExist_1
WXMPMeta_DoesStructFieldExist_1
WXMPMeta_DumpAliases_1
WXMPMeta_DumpNamespaces_1
WXMPMeta_DumpObject_1
WXMPMeta_DumpPropertyTraits_1
WXMPMeta_GetArrayItem_1
WXMPMeta_GetGlobalOptions_1
WXMPMeta_GetLocalizedText_1
WXMPMeta_GetMemProcs_1
WXMPMeta_GetNamespacePrefix_1
WXMPMeta_GetNamespaceURI_1
WXMPMeta_GetObjectName_1
WXMPMeta_GetObjectOptions_1
WXMPMeta_GetProperty_1
WXMPMeta_GetProperty_Bool_1
WXMPMeta_GetProperty_Date_1
WXMPMeta_GetProperty_Float_1
WXMPMeta_GetProperty_Int64_1
WXMPMeta_GetProperty_Int_1
WXMPMeta_GetQualifier_1
WXMPMeta_GetStructField_1
WXMPMeta_GetVersionInfo_1
WXMPMeta_IncrementRefCount_1
WXMPMeta_Initialize_1
WXMPMeta_MarkStaleProperties_1
WXMPMeta_ParseFromBuffer_1
WXMPMeta_RegisterAlias_1
WXMPMeta_RegisterAssertNotify_1
WXMPMeta_RegisterNamespace_1
WXMPMeta_RegisterPropertyTraits_1
WXMPMeta_RegisterStandardAliases_1
WXMPMeta_ResolveAlias_1
WXMPMeta_SendAssertNotify_1
WXMPMeta_SerializeToBuffer_1
WXMPMeta_SetArrayItem_1
WXMPMeta_SetGlobalOptions_1
WXMPMeta_SetLocalizedText_1
WXMPMeta_SetObjectName_1
WXMPMeta_SetObjectOptions_1
WXMPMeta_SetProperty_1
WXMPMeta_SetProperty_Bool_1
WXMPMeta_SetProperty_Date_1
WXMPMeta_SetProperty_Float_1
WXMPMeta_SetProperty_Int64_1
WXMPMeta_SetProperty_Int_1
WXMPMeta_SetQualifier_1
WXMPMeta_SetStructField_1
WXMPMeta_Terminate_1
WXMPMeta_UnlockObject_1
WXMPMeta_Unlock_1
WXMPMeta_UnregisterAssertNotify_1
WXMPUtils_AddEmbeddedDocument_1
WXMPUtils_AppendProperties_1
WXMPUtils_CatenateArrayItems_1
WXMPUtils_ClearManifest_1
WXMPUtils_CollectMultiFileXMP_1
WXMPUtils_CompareDateTime_1
WXMPUtils_ComposeArrayItemPath_1
WXMPUtils_ComposeFieldSelector_1
WXMPUtils_ComposeLangSelector_1
WXMPUtils_ComposeQualifierPath_1
WXMPUtils_ComposeStructFieldPath_1
WXMPUtils_ConvertFromBool_1
WXMPUtils_ConvertFromDate_1
WXMPUtils_ConvertFromFloat_1
WXMPUtils_ConvertFromInt64_1
WXMPUtils_ConvertFromInt_1
WXMPUtils_ConvertToBool_1
WXMPUtils_ConvertToDate_1
WXMPUtils_ConvertToFloat_1
WXMPUtils_ConvertToInt64_1
WXMPUtils_ConvertToInt_1
WXMPUtils_ConvertToLocalTime_1
WXMPUtils_ConvertToUTCTime_1
WXMPUtils_CurrentDateTime_1
WXMPUtils_DecodeFromBase64_1
WXMPUtils_DistributeMultiFileXMP_1
WXMPUtils_DuplicateSubtree_1
WXMPUtils_EncodeToBase64_1
WXMPUtils_GetDateRange_1
WXMPUtils_GetMergedListPath_1
WXMPUtils_HasContainedDoc_1
WXMPUtils_InitializeDerivedDocument_1
WXMPUtils_InitializeNewDocument_1
WXMPUtils_IsPropertyMultiValued_1
WXMPUtils_MergeFromJPEG_1
WXMPUtils_OpenWorkingDocument_1
WXMPUtils_PackageForJPEG_1
WXMPUtils_RemoveEmbeddedDocument_1
WXMPUtils_RemoveMultiValueInfo_1
WXMPUtils_RemoveProperties_1
WXMPUtils_SaveWorkingDocument_1
WXMPUtils_SeparateArrayItems_1
WXMPUtils_SetAppName_1
WXMPUtils_SetMIMEMapping_1
WXMPUtils_SetTimeZone_1
WXMPUtils_UnlockIter_1
WXMPUtils_Unlock_1
WXMPUtils_UpdateEmbeddedDocument_1

Sections

.text
Size: 276KB - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 168KB - Virtual size: 168KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a24bdda400a413aa6d759d0b8e02ddd9

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 276KB - Virtual size: 273KB

.rdata Size: 68KB - Virtual size: 66KB

.data Size: 8KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 18KB

.text Size: 168KB - Virtual size: 168KB

.text
Size: 276KB - Virtual size: 273KB

.rdata
Size: 68KB - Virtual size: 66KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 18KB

.text
Size: 168KB - Virtual size: 168KB