NEAS[.]eb6736415670f43f09b421e36e974000[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.eb6736415670f43f09b421e36e974000.exe
Size

1.8MB
MD5

eb6736415670f43f09b421e36e974000
SHA1

149f7937b6e5f627d90500557adb60af7a46c28f
SHA256

cbf24b675fafe1c8486b2d3c22a846cde4e79f68b47782544c51dabb68fa44a2
SHA512

4e7755544ea2642bf597856e769e30b5fbfc5d2a3fc0cf431af8d742e17901c63cf4c03b4d97efd0bd901df8b35ed656143a2ccf75182456b773d07140c5b3b4
SSDEEP

24576:y8zNYTcrI77bpPg9rWCzUfLfEc47kC6dkLbt6:v6TcrI77bgr1UfLfE7KkE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.eb6736415670f43f09b421e36e974000.exe

Files

NEAS.eb6736415670f43f09b421e36e974000.exe
.exe windows:6 windows x86

89339d2bb51653ee495aa15a1a080f11

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
SetLastError
ReleaseMutex
CloseHandle
CreateMutexA
LocalFree
FormatMessageA
MultiByteToWideChar
GetCurrentThreadId
WaitForSingleObject
OutputDebugStringA
GetModuleHandleA
GetLocalTime
SetThreadAffinityMask
GetCurrentThread
ResumeThread
SetThreadPriority
QueryPerformanceFrequency
WriteConsoleA
AllocConsole
FreeConsole
SetConsoleTextAttribute
GetStdHandle
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
WideCharToMultiByte
RaiseException
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep

msvcp140d

?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Debug_message@std@@YAXPB_W0I@Z

vcruntime140d

memcmp
__CxxFrameHandler3
memcpy
memset
strrchr
strstr
_purecall
_CxxThrowException
memmove
__vcrt_LoadLibraryExW
__vcrt_GetModuleHandleW
__vcrt_GetModuleFileNameW
_except_handler4_common
__std_type_info_destroy_list
__vcrt_InitializeCriticalSectionEx
strchr

ucrtbased

_aligned_free
_aligned_malloc
_wassert
toupper
tolower
strlen
free
malloc
__stdio_common_vsprintf
_invalid_parameter
_CrtDbgReportW
cos
floor
strcmp
atof
atoi
__stdio_common_vsscanf
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
wcscpy_s
_wsplitpath_s
_wmakepath_s
__stdio_common_vsprintf_s
_controlfp_s
_except1
terminate
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_CrtDbgReport
__p__commode
__acrt_iob_func
freopen_s
fclose
_errno
strerror
tan
srand
_time64
sin
rename
_mkdir
_rmdir
_findclose
_findfirst64i32
_findnext64i32
sqrt
asin
atan2
_set_errno
_beginthreadex
fabs
strncmp
strcpy
_unlink
_close
_open
_write
_lseek
_read
_strnicmp
_set_new_mode
_configthreadlocale
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_set_fmode
_exit
exit
_initterm_e
_initterm

user32

GetSystemMetrics
RegisterTouchWindow
DispatchMessageA
PeekMessageA
ShowCursor
ToAscii
GetMessageExtraInfo
GetTouchInputInfo
TranslateMessage
GetKeyboardState
GetMonitorInfoA
MonitorFromPoint
ChangeDisplaySettingsA
LoadCursorA
GetWindowLongA
AdjustWindowRectEx
SetForegroundWindow
SetActiveWindow
UpdateWindow
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
PostQuitMessage
RegisterRawInputDevices
GetRawInputDeviceInfoA
GetRawInputData
GetClipCursor
ClipCursor
GetCursorPos
SetCursorPos
CloseTouchInputHandle
DefWindowProcA

gdi32

GetStockObject

winmm

joyGetPos
joyGetDevCapsA
joyGetNumDevs
joyGetPosEx
timeGetTime

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

dxgi

CreateDXGIFactory1

Sections

.text
Size: 997KB - Virtual size: 996KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 594KB - Virtual size: 598KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 329B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89339d2bb51653ee495aa15a1a080f11

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140d

vcruntime140d

ucrtbased

user32

gdi32

winmm

d3d11

d3dcompiler_47

dxgi

Sections

.text Size: 997KB - Virtual size: 996KB

.rdata Size: 184KB - Virtual size: 184KB

.data Size: 594KB - Virtual size: 598KB

.idata Size: 7KB - Virtual size: 6KB

.gfids Size: 512B - Virtual size: 329B

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 260B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 33KB - Virtual size: 32KB

.text
Size: 997KB - Virtual size: 996KB

.rdata
Size: 184KB - Virtual size: 184KB

.data
Size: 594KB - Virtual size: 598KB

.idata
Size: 7KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 329B

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 260B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 33KB - Virtual size: 32KB