NEAS[.]17bacef07c7e4b912758c5fbc5fa1020[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.17bacef07c7e4b912758c5fbc5fa1020.exe
Size

56KB
MD5

17bacef07c7e4b912758c5fbc5fa1020
SHA1

f35eeab0250ece2be0811ad9f38843ba3e1877f5
SHA256

1a92f22e3bd968f312e480f8026c61beac8f083b9e4165839ad75df16d517ac5
SHA512

d452bab0256053eddd156b45c32fee5d4ac34bf3cc792f8cb8c20de7bd0969faa4de6dff5fad5ad57600ab25279b12a436d3cc9741749c0ec98dcda8ad4c5946
SSDEEP

768:tbHibbCaOlyY5ce7Z245i5kJqeL8nRLQA6GQ7ghBqA2loAx4YfgJzn:tbH0bCFjT7A45ieRL8nRLZ6GQselT4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.17bacef07c7e4b912758c5fbc5fa1020.exe

Files

NEAS.17bacef07c7e4b912758c5fbc5fa1020.exe
.dll windows:4 windows x86

5b93810849315cd7a80f9ab53ec9c4d7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
GetProcAddress
LoadLibraryA
GetPrivateProfileStringA
GetPrivateProfileIntA
FreeLibrary
CloseHandle
DisableThreadLibraryCalls
HeapAlloc
HeapFree
ExitProcess
GetCurrentThreadId
GetCommandLineA
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
MultiByteToWideChar
VirtualProtect
GetSystemInfo
SetFilePointer
GetACP
GetOEMCP
GetCPInfo
ReadFile
SetStdHandle
HeapSize
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
FlushFileBuffers

Exports

Exports

TS_ChangePIN
TS_CloseDev
TS_CreateFile
TS_DeleteFile
TS_Finalize
TS_GetDevParam
TS_GetReaderList
TS_Initialize
TS_Login
TS_Logout
TS_OpenDev
TS_RSAPrivate
TS_ReadFile
TS_RsaPublic
TS_SetDevParam
TS_WriteFile

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5b93810849315cd7a80f9ab53ec9c4d7

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 736B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 736B

.reloc
Size: 4KB - Virtual size: 3KB