NEAS[.]7ab662cf99b854dfd1ca4d312c52f7c0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.7ab662cf99b854dfd1ca4d312c52f7c0.exe
Size

10.0MB
MD5

7ab662cf99b854dfd1ca4d312c52f7c0
SHA1

3be29c6304f545f68f868cbf21df064860750688
SHA256

4aafd3776a60fb8562b0b25f0bfe12647ce7acd261b3b34fba26d2a98027de9d
SHA512

1c2098425ab4a7feb86f23a35c4d26433872764b599cd302bb3c1e6d7aba5ee064a77866e0b8b75b72c579c5e8017a9d58c817d5251ab0b089dd94e5e3e05ffe
SSDEEP

196608:veVKj96v5muYO+B/WfJ4syO213aucgGcA8DttAbhi9nlKB:veM9buYO+MhyO24bcA8DIbA9UB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.7ab662cf99b854dfd1ca4d312c52f7c0.exe

Files

NEAS.7ab662cf99b854dfd1ca4d312c52f7c0.exe
.exe windows:5 windows x86

8b97d0b68d9eb599b0ff8d1bbd40b866

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipDisposeImage
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCloneImage
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdiplusShutdown
GdiplusStartup
GdipBitmapLockBits

kernel32

GetCurrentThreadId
LoadLibraryExW
EnumResourceLanguagesW
ConvertDefaultLocale
InterlockedIncrement
GetCurrentProcessId
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
lstrlenA
GlobalFlags
GlobalAddAtomW
SetErrorMode
GetStartupInfoW
ExitThread
CreateThread
HeapReAlloc
VirtualProtect
GetSystemInfo
VirtualQuery
UnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
ExitProcess
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
CompareStringW
LoadLibraryA
FreeLibrary
lstrcmpW
GetVersionExA
GetModuleHandleA
SetLastError
GlobalFree
lstrcmpA
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
VirtualAlloc
IsBadReadPtr
SetFilePointer
lstrlenW
InterlockedDecrement
GetSystemTimeAsFileTime
GetLocaleInfoW
SuspendThread
SetUnhandledExceptionFilter
FormatMessageW
WritePrivateProfileStringW
GlobalUnlock
ResumeThread
FindResourceExW
GetSystemDirectoryW
FileTimeToSystemTime
SystemTimeToFileTime
GetLocalTime
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentThread
WideCharToMultiByte
FreeResource
Process32NextW
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
GetTempPathW
CreateProcessW
ReadFile
LocalFree
LocalAlloc
CreateDirectoryW
MultiByteToWideChar
FindClose
FindNextFileW
SetFileAttributesW
RemoveDirectoryW
FindFirstFileW
CloseHandle
FlushFileBuffers
WriteFile
CreateFileW
DeleteFileW
GetProcAddress
LoadLibraryW
GetModuleHandleW
MulDiv
GlobalLock
GlobalAlloc
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetModuleFileNameW
GetTickCount
GetCurrentProcess
TerminateProcess
Sleep
WaitForSingleObject
FindResourceW
LoadResource
LockResource
SizeofResource

user32

DestroyMenu
GetWindowThreadProcessId
GetSysColorBrush
GetMessageW
TranslateMessage
ValidateRect
PostQuitMessage
WindowFromPoint
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
ShowWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
IsWindowVisible
CreateWindowExW
UnregisterClassW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
GetMenu
SetWindowLongW
SystemParametersInfoA
GetWindowPlacement
GetWindowTextW
GetClientRect
KillTimer
SetTimer
PostMessageW
GetWindow
SetFocus
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
EndPaint
BeginPaint
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetSysColor
BringWindowToTop
PtInRect
GetCursorPos
LoadBitmapW
SetWindowPos
IsRectEmpty
ScreenToClient
DrawIcon
IsIconic
LoadIconW
ReleaseDC
GetClassInfoExW
EnableWindow
GetWindowRect
GetParent
FindWindowW
SendMessageTimeoutW
MessageBoxW
GetSystemMetrics
RedrawWindow
InvalidateRect
UpdateWindow
SetCursor
LoadCursorW
SendMessageW
SetRect
LoadImageW
GetDC

gdi32

CreateBitmap
ExtTextOutW
ScaleWindowExtEx
TextOutW
RectVisible
PtVisible
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
GetStockObject
CreateCompatibleBitmap
CreateFontW
CreateSolidBrush
GetTextExtentPoint32W
BitBlt
GetDeviceCaps
SetDIBColorTable
SelectObject
DeleteObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
CreatePatternBrush
GetObjectW
PatBlt
GetClipBox
SetMapMode

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

advapi32

DeleteService
CryptImportKey
RegSetValueExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
StartServiceW
AdjustTokenPrivileges
GetTokenInformation
OpenProcessToken
CloseServiceHandle
CryptAcquireContextW
ControlService
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
FreeSid
SetFileSecurityW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam

shell32

ShellExecuteW
SHGetSpecialFolderPathW

comctl32

_TrackMouseEvent
InitCommonControlsEx

shlwapi

PathFileExistsW
SHDeleteKeyW
SHDeleteValueW
SHSetValueW
PathFindFileNameW
PathFindExtensionW
SHGetValueW

ole32

CoInitialize
CreateStreamOnHGlobal
CoCreateInstance

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString
VariantChangeType

crypt32

CryptMsgClose
CertCloseStore
CryptDecodeObject
CryptMsgGetParam
CryptQueryObject

Sections

.text
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 480KB - Virtual size: 479KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8b97d0b68d9eb599b0ff8d1bbd40b866

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

crypt32

Sections

.text Size: 218KB - Virtual size: 217KB

.rdata Size: 77KB - Virtual size: 77KB

.data Size: 9KB - Virtual size: 25KB

.rsrc Size: 480KB - Virtual size: 479KB

.reloc Size: 41KB - Virtual size: 40KB

.text
Size: 218KB - Virtual size: 217KB

.rdata
Size: 77KB - Virtual size: 77KB

.data
Size: 9KB - Virtual size: 25KB

.rsrc
Size: 480KB - Virtual size: 479KB

.reloc
Size: 41KB - Virtual size: 40KB