NEAS[.]75e0258cde0922e912d8b8814dcd3c50[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.75e0258cde0922e912d8b8814dcd3c50.exe
Size

604KB
MD5

75e0258cde0922e912d8b8814dcd3c50
SHA1

64b16602f733cb5c48a48a0777caf9bed558bb90
SHA256

4171b73344ff30afbd47b2fd3efbecd7a26d43c2a0989ca82f2b37fb50bab5e5
SHA512

d110c4f8e323b29fc57823ee124136ec3fe825e32c0a850af6f7ac60bdd94d1399553c24924fdabf5bc21df59084c42061bfefdcef8abae5c8d8851f25aea00c
SSDEEP

12288:OB0spjzi+IyRDf4zelsq7wIA+1JmekDMw:OB5jzi+IAfSelsq7wIAECDM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.75e0258cde0922e912d8b8814dcd3c50.exe

Files

NEAS.75e0258cde0922e912d8b8814dcd3c50.exe
.dll windows:5 windows x86

39eaa479dabec678a118a26962b4f2d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_onexit
_adjust_fdiv
__dllonexit
_initterm
isspace
_errno
memcpy
memset
atol
_stricmp
sprintf
malloc
time
free

kernel32

Sleep
GetProcAddress
LoadLibraryA
GetModuleHandleA
FreeLibrary
TlsSetValue
InitializeCriticalSection
DeleteCriticalSection
TlsGetValue
TlsFree
DisableThreadLibraryCalls
TlsAlloc
GetCurrentProcess
CloseHandle
EnterCriticalSection
LeaveCriticalSection
CreateFileA
DeviceIoControl
GetFileSize
ReadFile
WriteFile
GetFileAttributesA
SetFileAttributesA
DeleteFileA
GetLocalTime
GetSystemTimeAsFileTime
GetCurrentThread
GetLastError
LocalAlloc
LocalFree
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA

user32

GetUserObjectInformationA
GetProcessWindowStation
MessageBoxA
GetForegroundWindow

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
OpenThreadToken
EqualSid
AllocateAndInitializeSid
FreeSid
GetTokenInformation
OpenProcessToken
DeregisterEventSource

Exports

Exports

AddOpenKey
CheckFileSeparate
CheckKeyByNum
CheckKeyHash
CheckMemSeparateEx
CheckOpenKey
CheckOpenKeyBuff
CheckSpr
ComputeCommonSecret
CreateCryptCtx
CreateHash
CryptoDone
CryptoInit
DeCryptFile
DeCryptFileEx
DeCryptMem
DeCryptMemEx
DecryptData
DelImitByNum
DelKeyByNum
DelOpenKey
DelSign
Del_Mem_Sign
DeleteCryptCtx
DestroyHash
DuplicateHash
EnCryptFile
EnCryptFileEx
EnCryptMem
EnCryptMemEx
EncryptData
EncryptMemOnPassword
ExportKeyInfo
ExtractKey
FreeMemory
GetAlias
GetCryptKeysF
GetCryptKeysM
GetCurrID
GetDrvInfo
GetFileSenderID
GetFileSignInfo
GetFlopID
GetHash
GetID
GetKeyID
GetMemSenderID
GetMemSignInfo
HashData
HashFile
HashMem
ImitoFile
ImitoFileOnGk
ImitoFileOnPassword
ImitoMem
ImitoMemOnPassword
ImitoMemOnPasswordEx
ImportKeyInfo
InitKey
OpenKeyCompromise
Res2Work
ResetKey
ResetKeyEx
Rndm
SetDevParam
SetHash
SignDone
SignFile
SignFileSeparate
SignHash
SignInit
SignLogIn
SignLogOut
SignMem
SignMemEx
SignMemSeparate
SignMemSeparateEx
SignSpr
SprList
VerifySignature
WO_SelectMedia
WO_rdr_context_free
WO_rdr_list_get_a
WO_rdr_login_a
WO_rdr_logout
WipeFile
check_file_sign
check_file_sign_ex
check_lib
check_mem_sign
lokey_done
lokey_free
lokey_get
lokey_get_last_error
lokey_get_last_error_text
lokey_init
verba_key_copy_clear
verba_key_copy_dest
verba_key_copy_src
verba_key_gen

Sections

.text
Size: 556KB - Virtual size: 556KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39eaa479dabec678a118a26962b4f2d4

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 556KB - Virtual size: 556KB

.data Size: 37KB - Virtual size: 37KB

.rsrc Size: 1024B - Virtual size: 840B

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 556KB - Virtual size: 556KB

.data
Size: 37KB - Virtual size: 37KB

.rsrc
Size: 1024B - Virtual size: 840B

.reloc
Size: 9KB - Virtual size: 8KB