NEAS[.]b127a08f49ad5756eca41e9216238f60[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b127a08f49ad5756eca41e9216238f60.exe
Size

2.2MB
MD5

b127a08f49ad5756eca41e9216238f60
SHA1

73898278f71708782422bd4386039dea132929d6
SHA256

c311e3fa804023ae55d3641538b9d36e9902e581a39db7ac1844fddc62098323
SHA512

7fdd4dc3e8e2ecf2f0b5d3ed0df85955bcd79928da9c9b24b997c63d6dbbe9fb64f46cb9952f427730f562ae3355c4dfcdb49fce93ca30d4fb01b79d3a011220
SSDEEP

49152:T0NmdYJ1rI0m/OrMN+3spGlHw5zTinGZMFdJpZU0RiQNjXfBZn8MI9Yt:6mdYJ11m/OS+8pAHw5zTinGZMF7k0Rxd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b127a08f49ad5756eca41e9216238f60.exe

Files

NEAS.b127a08f49ad5756eca41e9216238f60.exe
.exe windows:5 windows x86

48a0eed1591f8149f435f717de832c55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeW
CompareStringW
CreateFileW
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
GetConsoleCP
SetHandleCount
IsProcessorFeaturePresent
LCMapStringW
IsValidCodePage
HeapCreate
GetStdHandle
GetTimeZoneInformation
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileType
SetStdHandle
HeapSize
HeapQueryInformation
ExitThread
RaiseException
VirtualQuery
GetSystemInfo
VirtualAlloc
RtlUnwind
GetStartupInfoW
HeapSetInformation
lstrlenA
HeapReAlloc
DecodePointer
EncodePointer
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
FindResourceExW
VirtualProtect
SearchPathA
GetProfileIntA
InitializeCriticalSectionAndSpinCount
GetNumberFormatA
GetTempFileNameA
GetFileTime
GetFileSizeEx
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
SleepEx
GetSystemDirectoryA
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
GetFileInformationByHandle
GetFileAttributesA
FileTimeToLocalFileTime
GetFileAttributesExA
SetErrorMode
GetCurrentDirectoryA
GetOEMCP
GetCPInfo
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetACP
GlobalFlags
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ResumeThread
SetThreadPriority
GetFullPathNameA
GetVolumeInformationA
GetDriveTypeA
FindFirstFileExA
GetCurrentDirectoryW
GetDriveTypeW
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
DeleteFileA
lstrcmpiA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GetModuleHandleW
GetThreadLocale
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
LoadLibraryW
lstrcmpW
CopyFileA
GlobalSize
GlobalAlloc
FormatMessageA
lstrlenW
GlobalLock
GlobalUnlock
GlobalFree
FindResourceA
FreeResource
FileTimeToSystemTime
GetVersionExA
GetModuleHandleA
GetProcAddress
ActivateActCtx
DeactivateActCtx
LocalFree
LocalAlloc
OpenFileMappingA
GetTempPathA
OutputDebugStringA
CreateFileMappingA
FindClose
SetLastError
FindFirstFileA
MultiByteToWideChar
TerminateProcess
CreateProcessA
OpenProcess
WaitForSingleObject
GetCurrentProcess
SetLocalTime
CreateThread
GetCurrentProcessId
CloseHandle
CreateToolhelp32Snapshot
GetModuleFileNameA
LockResource
Process32Next
GetLocalTime
GetLastError
SizeofResource
Sleep
TerminateThread
WideCharToMultiByte
GetCommandLineA
GetTickCount
Process32First
LoadResource
FindResourceW
CreateFileA
MulDiv
lstrcpyA
WinExec
LoadLibraryA
lstrcatA
GetWindowsDirectoryA
FreeLibrary
GetConsoleMode

user32

ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InsertMenuItemA
TranslateAcceleratorA
RegisterClipboardFormatA
CopyImage
EnableScrollBar
HideCaret
InvertRect
GetMenuDefaultItem
LockWindowUpdate
BringWindowToTop
SetCursorPos
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
DrawFocusRect
DrawFrameControl
DrawEdge
DrawStateA
GetSystemMenu
NotifyWinEvent
CreatePopupMenu
DestroyAcceleratorTable
RedrawWindow
SetWindowRgn
IsZoomed
GetNextDlgGroupItem
DeleteMenu
ReleaseCapture
SetCapture
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableA
UnregisterClassA
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
GetSysColorBrush
SystemParametersInfoA
DestroyMenu
GetMenuItemInfoA
GetMessageA
TranslateMessage
ValidateRect
CharUpperA
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
CharNextA
EndPaint
BeginPaint
ClientToScreen
GrayStringA
DrawTextExA
TabbedTextOutA
FillRect
IntersectRect
WindowFromPoint
MapVirtualKeyA
GetKeyNameTextA
MoveWindow
IsDialogMessageA
GetDlgItemTextA
CheckDlgButton
RegisterWindowMessageA
LoadIconA
SendDlgItemMessageA
UnpackDDElParam
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassNameA
SetPropA
GetDoubleClickTime
RemovePropA
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
ShowScrollBar
UpdateWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
SetWindowPlacement
GetWindowPlacement
DefWindowProcA
CallWindowProcA
GetMenu
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
RemoveMenu
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
EndDialog
GetWindowTextLengthA
GetScrollPos
SetScrollPos
GetWindowLongA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
MonitorFromPoint
UnionRect
UpdateLayeredWindow
IsMenu
CreateMenu
PostThreadMessageA
WaitMessage
SetMenuDefaultItem
IsClipboardFormatAvailable
DestroyIcon
DrawTextA
OffsetRect
FrameRect
GetFocus
GetAsyncKeyState
GetDlgCtrlID
GetDlgItemInt
SetDlgItemInt
SetDlgItemTextA
IsIconic
GetSubMenu
GetUpdateRect
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
LoadImageW
WinHelpA
CharUpperBuffA
SetForegroundWindow
DrawIcon
LoadIconW
LoadMenuW
GetCursorPos
ShowWindow
LockWorkStation
PostQuitMessage
FindWindowExA
ExitWindowsEx
GetForegroundWindow
SendMessageTimeoutA
IsWindowVisible
UnregisterHotKey
IsCharLowerA
MapVirtualKeyExA
SubtractRect
DestroyCursor
GetWindowRgn
GetPropA
RegisterHotKey
GetWindowThreadProcessId
GetWindow
GetWindowDC
DrawIconEx
GetIconInfo
SetParent
SetClassLongA
GetDesktopWindow
PostMessageA
LoadImageA
FindWindowA
GetClassLongA
SetWindowPos
GetSystemMetrics
SetCursor
SetTimer
ScreenToClient
GetWindowRect
KillTimer
GetParent
MessageBeep
IsWindowEnabled
GetClientRect
PtInRect
GetDC
InflateRect
CopyIcon
SetWindowLongA
InvalidateRect
ReleaseDC
GetSysColor
IsWindow
LoadCursorA
GetMessagePos
SetFocus
SendMessageA
GetWindowTextA
MessageBoxA
GetDlgItem
SetWindowTextA
EnableWindow
RealChildWindowFromPoint

gdi32

CreateHatchBrush
GetBkColor
GetTextColor
CreateDIBitmap
CreateCompatibleBitmap
GetTextMetricsA
EnumFontFamiliesA
GetTextCharsetInfo
GetRgnBox
CreateDIBSection
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
SetPixel
Rectangle
CreateSolidBrush
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetTextFaceA
SetPixelV
SetLayout
CreatePen
GetObjectType
SelectPalette
SelectClipRgn
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
TextOutA
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
EnumFontFamiliesExA
GetStockObject
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
DPtoLP
CreatePatternBrush
GetMapMode
CombineRgn
SetRectRgn
CreateRectRgn
ExtTextOutA
CreateRectRgnIndirect
SetBkColor
SetTextColor
CreateDCA
CopyMetaFileA
CreateBitmap
DeleteDC
DeleteObject
SelectObject
BitBlt
PatBlt
StretchBlt
CreateCompatibleDC
GetDeviceCaps
GetTextExtentPoint32A
CreateFontIndirectA
GetObjectA

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

RegEnumValueA
RegQueryValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
OpenProcessToken
RegSetValueExA
LookupPrivilegeValueA
RegCreateKeyExA
RegDeleteValueA
AdjustTokenPrivileges
RegEnumKeyExA
RegOpenKeyExA
RegEnumKeyA
RegDeleteKeyA

shell32

SHAppBarMessage
Shell_NotifyIconA
SHGetFileInfoA
SHGetDesktopFolder
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
DragQueryFileA
DragFinish
SHGetSpecialFolderLocation

comctl32

_TrackMouseEvent
InitCommonControlsEx
ImageList_GetIconSize

shlwapi

PathRemoveFileSpecW
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
StrStrIA
PathIsUNCA

ole32

CoTaskMemAlloc
ReleaseStgMedium
OleDuplicateData
CreateStreamOnHGlobal
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
CoCreateGuid
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoGetClassObject
StgOpenStorageOnILockBytes
OleIsCurrentClipboard
OleFlushClipboard
CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoUninitialize
DoDragDrop
CoRevokeClassObject
CoRegisterMessageFilter
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
StgCreateDocfileOnILockBytes
RevokeDragDrop

oleaut32

VariantTimeToSystemTime
SysAllocString
VarBstrFromDate
SafeArrayDestroy
VariantCopy
SysStringLen
OleCreateFontIndirect
SysAllocStringByteLen
SysFreeString
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SystemTimeToVariantTime

oledlg

ord8

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsA
SetupDiSetClassInstallParamsA

psapi

GetModuleFileNameExA
EnumProcessModules

wldap32

ord35
ord32
ord30
ord26
ord79
ord60
ord143
ord211
ord200
ord33
ord301
ord27
ord41
ord50
ord22
ord46

rpcrt4

UuidFromStringA

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

gdiplus

GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

winmm

PlaySoundA

ws2_32

socket
closesocket
WSAGetLastError
recv
WSACleanup
send
getsockname
ntohs
bind
htons
getsockopt
getpeername
setsockopt
connect
WSASetLastError
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
sendto
recvfrom
accept
listen
__WSAFDIsSet
gethostname
ioctlsocket
WSAStartup
select

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 230KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48a0eed1591f8149f435f717de832c55

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

setupapi

psapi

wldap32

rpcrt4

oleacc

gdiplus

imm32

winmm

ws2_32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 325KB - Virtual size: 325KB

.data Size: 28KB - Virtual size: 108KB

.rsrc Size: 230KB - Virtual size: 229KB

.reloc Size: 183KB - Virtual size: 183KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 325KB - Virtual size: 325KB

.data
Size: 28KB - Virtual size: 108KB

.rsrc
Size: 230KB - Virtual size: 229KB

.reloc
Size: 183KB - Virtual size: 183KB