NEAS[.]NEASbbfda8d1700e14c805e37c2764c888f0exe[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.NEASbbfda8d1700e14c805e37c2764c888f0exe.exe
Size

554KB
MD5

bbfda8d1700e14c805e37c2764c888f0
SHA1

c6666d9737f8d58160e4324082ed419a42937676
SHA256

c29fb10be84ffd53a2ea2bf6d2500d1abb6e2b4eb41c5774dcea9fb62fd6acc7
SHA512

4ce035d533ba0b0bc043ab1c737e4af38e7b658b4952e36ed5b7bbae199f0a406ef83084ea194aa678b00594faed797cd4ed7f0732bacf3104ee29eb0b38ebca
SSDEEP

6144:I9G714wpsBD1z84d9SkyuMoksxGrnepqS4jRlzVO/pQtVcBiEQhvyc5/g1RdrNXk:qDQokyt4j7CeCBQxyc54j/XPlJtsgk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.NEASbbfda8d1700e14c805e37c2764c888f0exe.exe

Files

NEAS.NEASbbfda8d1700e14c805e37c2764c888f0exe.exe
.dll windows:6 windows x86

4a705420ac8de51cb091caf115c9f89d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

waveInStop
waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
waveOutGetDevCapsW
waveInStart
waveInAddBuffer
waveInGetDevCapsW
waveInOpen
waveInClose
waveInPrepareHeader
waveInGetNumDevs
waveInUnprepareHeader
waveInReset
waveOutGetNumDevs

kernel32

SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
WaitForSingleObjectEx
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryW
GetProcAddress
GetModuleFileNameW
FreeLibrary
UnmapViewOfFile
MapViewOfFile
SwitchToThread
CloseHandle
RaiseException
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
Sleep
CreateThread
GetCurrentThreadId
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
IsDebuggerPresent
DebugBreak
GetModuleHandleExW
CreateFileW
FindClose
FindFirstFileW
FindNextFileW
GetLastError
GetCurrentThread
SetThreadPriority
VirtualQuery
CreateFileMappingW
UnhandledExceptionFilter

user32

PeekMessageA
GetForegroundWindow
PostThreadMessageA
GetMessageA

shell32

SHGetSpecialFolderPathW

ole32

PropVariantClear
CoTaskMemFree
StringFromCLSID
CoUninitialize
CoInitialize
CoCreateInstance

vcruntime140

__std_type_info_destroy_list
strchr
strrchr
_except_handler4_common
memcpy
memmove
memset

api-ms-win-crt-heap-l1-1-0

_aligned_malloc
free
realloc
_aligned_free
malloc
calloc

api-ms-win-crt-string-l1-1-0

_stricmp
isalpha
strncpy
isalnum
isspace
_strnicmp
_strdup
strncmp
strpbrk

api-ms-win-crt-math-l1-1-0

floor
_libm_sse2_cos_precise
_libm_sse2_log_precise
_libm_sse2_pow_precise
lrintf
roundf
_CIatan2
_libm_sse2_acos_precise
_libm_sse2_asin_precise
_libm_sse2_log10_precise
log2f
modf
_fdclass
_libm_sse2_sqrt_precise
_libm_sse2_sin_precise
_libm_sse2_exp_precise
ceil
_CIsinh
_libm_sse2_atan_precise
_except1
lroundf

api-ms-win-crt-convert-l1-1-0

atoi
strtoul
strtof
strtol

api-ms-win-crt-environment-l1-1-0

_wgetenv
_wgetcwd
getenv

api-ms-win-crt-stdio-l1-1-0

fwrite
fseek
fputs
ferror
clearerr
__stdio_common_vfprintf
_wfopen
__stdio_common_vsscanf
fgetc
ftell
__stdio_common_vsprintf
fclose
fflush
__acrt_iob_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
fegetround
fegetenv
fesetenv
_execute_onexit_table
_cexit
_errno
_initterm_e
_initterm
fesetround
strerror

Exports

Exports

alAuxiliaryEffectSlotf
alAuxiliaryEffectSlotfv
alAuxiliaryEffectSloti
alAuxiliaryEffectSlotiv
alBuffer3f
alBuffer3i
alBufferData
alBufferSamplesSOFT
alBufferSubDataSOFT
alBufferSubSamplesSOFT
alBufferf
alBufferfv
alBufferi
alBufferiv
alDeferUpdatesSOFT
alDeleteAuxiliaryEffectSlots
alDeleteBuffers
alDeleteEffects
alDeleteFilters
alDeleteSources
alDisable
alDistanceModel
alDopplerFactor
alDopplerVelocity
alEffectf
alEffectfv
alEffecti
alEffectiv
alEnable
alFilterf
alFilterfv
alFilteri
alFilteriv
alGenAuxiliaryEffectSlots
alGenBuffers
alGenEffects
alGenFilters
alGenSources
alGetAuxiliaryEffectSlotf
alGetAuxiliaryEffectSlotfv
alGetAuxiliaryEffectSloti
alGetAuxiliaryEffectSlotiv
alGetBoolean
alGetBooleanv
alGetBuffer3f
alGetBuffer3i
alGetBufferSamplesSOFT
alGetBufferf
alGetBufferfv
alGetBufferi
alGetBufferiv
alGetDouble
alGetDoublev
alGetEffectf
alGetEffectfv
alGetEffecti
alGetEffectiv
alGetEnumValue
alGetError
alGetFilterf
alGetFilterfv
alGetFilteri
alGetFilteriv
alGetFloat
alGetFloatv
alGetInteger
alGetInteger64SOFT
alGetInteger64vSOFT
alGetIntegerv
alGetListener3f
alGetListener3i
alGetListenerf
alGetListenerfv
alGetListeneri
alGetListeneriv
alGetProcAddress
alGetSource3dSOFT
alGetSource3f
alGetSource3i
alGetSource3i64SOFT
alGetSourcedSOFT
alGetSourcedvSOFT
alGetSourcef
alGetSourcefv
alGetSourcei
alGetSourcei64SOFT
alGetSourcei64vSOFT
alGetSourceiv
alGetString
alGetStringiSOFT
alIsAuxiliaryEffectSlot
alIsBuffer
alIsBufferFormatSupportedSOFT
alIsEffect
alIsEnabled
alIsExtensionPresent
alIsFilter
alIsSource
alListener3f
alListener3i
alListenerf
alListenerfv
alListeneri
alListeneriv
alProcessUpdatesSOFT
alSource3dSOFT
alSource3f
alSource3i
alSource3i64SOFT
alSourcePause
alSourcePausev
alSourcePlay
alSourcePlayv
alSourceQueueBuffers
alSourceRewind
alSourceRewindv
alSourceStop
alSourceStopv
alSourceUnqueueBuffers
alSourcedSOFT
alSourcedvSOFT
alSourcef
alSourcefv
alSourcei
alSourcei64SOFT
alSourcei64vSOFT
alSourceiv
alSpeedOfSound
alcCaptureCloseDevice
alcCaptureOpenDevice
alcCaptureSamples
alcCaptureStart
alcCaptureStop
alcCloseDevice
alcCreateContext
alcDestroyContext
alcDevicePauseSOFT
alcDeviceResumeSOFT
alcGetContextsDevice
alcGetCurrentContext
alcGetEnumValue
alcGetError
alcGetInteger64vSOFT
alcGetIntegerv
alcGetProcAddress
alcGetString
alcGetStringiSOFT
alcGetThreadContext
alcIsAmbisonicFormatSupportedSOFT
alcIsExtensionPresent
alcIsRenderFormatSupportedSOFT
alcLoopbackOpenDeviceSOFT
alcMakeContextCurrent
alcOpenDevice
alcProcessContext
alcRenderSamplesSOFT
alcResetDeviceSOFT
alcSetThreadContext
alcSuspendContext

Sections

.text
Size: 303KB - Virtual size: 302KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 233KB - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a705420ac8de51cb091caf115c9f89d

Headers

DLL Characteristics

File Characteristics

Imports

winmm

kernel32

user32

shell32

ole32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 303KB - Virtual size: 302KB

.rdata Size: 233KB - Virtual size: 233KB

.data Size: 512B - Virtual size: 1KB

_RDATA Size: 512B - Virtual size: 32B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 303KB - Virtual size: 302KB

.rdata
Size: 233KB - Virtual size: 233KB

.data
Size: 512B - Virtual size: 1KB

_RDATA
Size: 512B - Virtual size: 32B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 15KB - Virtual size: 15KB