NEAS[.]c71b49c575cc0a459b941b2c8cd28650[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c71b49c575cc0a459b941b2c8cd28650.exe
Size

1.8MB
MD5

c71b49c575cc0a459b941b2c8cd28650
SHA1

513d7215fe40a2cf7f02d906508d1a1070041261
SHA256

c8a4a8456f23dd8805cbbce2ed34e7d1e5f8270ee7cf08698fccf3f580a1cd27
SHA512

9f3b433a5ef63e5e6d852d899dda36b7d438d8564b82a5aa99855a5ada698454d706c0a918479de5d7cfcd0ca8e65d0d9053b75fe0db002d2f5c3f1ab09f2aed
SSDEEP

49152:D8THtHEj9Asu9gsSPu0GB/Q7EiSDDYmFi:DCtHsQ9jSdGi4iIkm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c71b49c575cc0a459b941b2c8cd28650.exe

Files

NEAS.c71b49c575cc0a459b941b2c8cd28650.exe
.dll windows:5 windows x86

5d7dfe9f6130f8565c351758e60e3ebe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleaut32

LoadTypeLibEx
GetErrorInfo

shell32

SHFileOperationA

urlmon

IsValidURL

kernel32

LoadLibraryA
GetProcAddress
WideCharToMultiByte
IsProcessorFeaturePresent
CreateThread
VirtualAlloc
ExpandEnvironmentStringsA
GetSystemTimeAsFileTime
GetModuleFileNameW
GetModuleFileNameA

shlwapi

PathRelativePathToW

winspool.drv

EnumFormsW

msvcrt

isleadbyte
putc

advapi32

RegRestoreKeyA
SaferCloseLevel

ole32

CoEnableCallCancellation

user32

IsCharAlphaNumericA
DeregisterShellHookWindow
GetSysColorBrush
DragObject
SwitchToThisWindow

Exports

Exports

MlHleewehee

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.qdata
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vNe=w
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5d7dfe9f6130f8565c351758e60e3ebe

Headers

File Characteristics

Imports

oleaut32

shell32

urlmon

kernel32

shlwapi

winspool.drv

msvcrt

advapi32

ole32

user32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 29KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 108KB - Virtual size: 107KB

.qdata Size: 92KB - Virtual size: 90KB

vNe=w Size: 1.5MB - Virtual size: 1.5MB

.rsrc Size: 4KB - Virtual size: 904B

.reloc Size: 28KB - Virtual size: 24KB

.text
Size: 32KB - Virtual size: 29KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 108KB - Virtual size: 107KB

.qdata
Size: 92KB - Virtual size: 90KB

vNe=w
Size: 1.5MB - Virtual size: 1.5MB

.rsrc
Size: 4KB - Virtual size: 904B

.reloc
Size: 28KB - Virtual size: 24KB