NEAS[.]425ca4b5479caa1a0b62bf86715fe800[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.425ca4b5479caa1a0b62bf86715fe800.exe
Size

60KB
MD5

425ca4b5479caa1a0b62bf86715fe800
SHA1

dd5861e79fc2c076381119fdc2bcb3c2e31b7347
SHA256

da6d6ad4cf3d74e3a262fe55ebb4969ab29e82a083dbb7797c6577be7e0690f6
SHA512

9cf0b0b8d8a2988d812035569b06a8b5dc10b051479a0b0481d9512ddb3ef467c4ead868ea1e8c16118d08760b9442d767e198a4ad932d45897b813ce3e9c2a7
SSDEEP

768:IhK7BoHVeoVsZzkcNQwq1T/MnN6hygDaC3RFGkpX2/+eoPo77:iVeo26N1T/Mn+ygxfGkl2meoA77

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.425ca4b5479caa1a0b62bf86715fe800.exe

Files

NEAS.425ca4b5479caa1a0b62bf86715fe800.exe
.dll windows:4 windows x86

b09050aea5b567d0468665f7f2c9534e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winscard

SCardGetStatusChangeA
SCardReleaseContext
SCardStatusA
SCardReconnect
SCardEstablishContext
SCardListReadersA
SCardConnectA
SCardDisconnect

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA

kernel32

GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
CreateMutexA
DisableThreadLibraryCalls
WaitForSingleObject
ReleaseMutex
Sleep
CreateFileMappingA
GetCurrentProcessId
UnmapViewOfFile
MapViewOfFile
HeapCreate
HeapDestroy
GetTickCount
GetModuleFileNameA
GetLastError
CreateFileA
CloseHandle
DeviceIoControl
FlushFileBuffers
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
HeapAlloc
TlsFree
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
GetCommandLineA
GetVersion
HeapFree
TlsAlloc
SetLastError
TlsGetValue
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
RtlUnwind
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
VirtualFree
WriteFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
InterlockedDecrement
InterlockedIncrement

user32

RegisterClassA
CreateWindowExA
ShowWindow
LoadCursorA
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
LoadIconA
DefWindowProcA
UpdateWindow

gdi32

GetStockObject

Exports

Exports

?GetOneKeyState@@YAJE@Z
?sam_select@@YAJJEE@Z
?set_baud@@YAJPAXK@Z
?srd_ver@@YAJPAXGPAE@Z
Mw_CardPowerOff
Mw_CardPowerOn
Mw_GetCardState
Mw_GetDevState
asc_asc
asc_hex
auto_init
chk_baud
cpu_comres
cpu_protocol
cpu_reset
get_status
get_status0
hex_asc
ic_exit
ic_init
lib_ver
mw_DriverVer
mw_ReleaseMutex
mw_WaitMutex
mw_close
mw_comres
mw_hash
mw_init
mw_protocol
mw_reset
sam_comres
sam_power_down
sam_power_on
sam_protocol
sam_reset
set_card_baud

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b09050aea5b567d0468665f7f2c9534e

Headers

File Characteristics

Imports

winscard

setupapi

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB