NEAS[.]e5f31c3c84f8c0ac02cfda021fb73450[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.e5f31c3c84f8c0ac02cfda021fb73450.exe
Size

9.1MB
MD5

e5f31c3c84f8c0ac02cfda021fb73450
SHA1

f405f49a76df3e98a97e572c7bb015bcb2f0359c
SHA256

d4ae1204c19235f0139e44f73446155fc7d315d45749bf1b2b857f595b8d2291
SHA512

57c712cb0721e4c04b14f2459f5b1b95a50aa2a09223f3059eb15d8208d313c39890bb4052ae1064ab0ef041aa0c76262d363086930f8f8cf4f9d737240cd506
SSDEEP

196608:ZXJj3XnHdIn3ULJT2KXTTJdwUkVdcNGRuzOHWdpIVKD7zccmkc2A5jGbCbj04FH:ZXxnHC3Ul1t21VcAMO+pIoDc1kFA5jPP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e5f31c3c84f8c0ac02cfda021fb73450.exe

Files

NEAS.e5f31c3c84f8c0ac02cfda021fb73450.exe
.dll windows:5 windows x64

f22af71732c1b817a59c2982ba480a54

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateProcessA
WriteFile
LoadResource
FindResourceA
CreateFileA
GetModuleHandleA
GetSystemInfo
GetProcAddress
Sleep
GetWindowsDirectoryA
GetPrivateProfileStringA
GetPrivateProfileIntA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetLastError
GetFileAttributesA
DeleteFileA
HeapFree
HeapAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
SetStdHandle
GetFileType
SetFilePointer
SetHandleCount
GetStdHandle
GetStartupInfoA
DeleteCriticalSection
HeapSize
GetModuleHandleW
ExitProcess
MultiByteToWideChar
ReadFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSetInformation
HeapCreate
HeapDestroy
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
HeapReAlloc
LoadLibraryA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetEndOfFile
GetProcessHeap

advapi32

CryptDeriveKey
ControlService
OpenSCManagerA
QueryServiceStatusEx
RegOpenKeyExA
ChangeServiceConfigA
StartServiceA
RegQueryValueExA
CloseServiceHandle
OpenServiceA
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptCreateHash
CryptEncrypt
CryptAcquireContextA
CryptReleaseContext

Sections

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8.9MB - Virtual size: 8.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f22af71732c1b817a59c2982ba480a54

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Sections

.text Size: 116KB - Virtual size: 116KB

.rdata Size: 43KB - Virtual size: 43KB

.data Size: 6KB - Virtual size: 17KB

.pdata Size: 8KB - Virtual size: 7KB

.rsrc Size: 8.9MB - Virtual size: 8.9MB

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 116KB - Virtual size: 116KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 6KB - Virtual size: 17KB

.pdata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 8.9MB - Virtual size: 8.9MB

.reloc
Size: 6KB - Virtual size: 5KB