NEAS[.]205ef9bab30653cc667729e93357dd80[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.205ef9bab30653cc667729e93357dd80.exe
Size

480KB
MD5

205ef9bab30653cc667729e93357dd80
SHA1

0521a2d342ad8bd440b2509adf951e130c12794a
SHA256

449add524a7003a1c1693a3ed6dc83a7601a35938338160774c9e2285748a855
SHA512

58664ec64ff7f4a3e14b9a57106f4b03a4924ad91379170ffce06fe04996f79468559c317a778f0b0233b001ba10d8b671b1c6d7cdbb8bb3200624ade52837f1
SSDEEP

12288:6ox4IP/lEhydjccIVT3BIAnQf/dUENWYkJK1e/cJ+oY:RlETlT3BX8GAy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.205ef9bab30653cc667729e93357dd80.exe

Files

NEAS.205ef9bab30653cc667729e93357dd80.exe
.exe windows:4 windows x86

6ca6c9e4012037fd6ee2e25bf6630231

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
GetLocalTime
GetStartupInfoA
GetCommandLineA
ExitProcess
RaiseException
HeapAlloc
HeapFree
TerminateProcess
HeapSize
HeapReAlloc
GetACP
GetTimeZoneInformation
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStdHandle
GetFileType
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
IsBadWritePtr
Sleep
IsBadReadPtr
IsBadCodePtr
SetStdHandle
IsValidLocale
IsValidCodePage
EnumSystemLocalesA
GetUserDefaultLCID
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoW
InterlockedExchange
SetEndOfFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetCurrentProcess
SetErrorMode
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
LocalFree
InterlockedIncrement
CreateEventA
GlobalAlloc
lstrcmpA
GetCurrentThread
GlobalFree
lstrcpynA
MulDiv
SetLastError
FindResourceA
LoadResource
LockResource
GetVersion
lstrcatA
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpyA
GetModuleHandleA
GetLastError
GetEnvironmentVariableA
GetProcAddress
GetTempPathA
GetTempFileNameA
CreateFileA
DeleteFileA
CreateProcessA
GlobalLock
GlobalSize
GlobalUnlock
Beep
InterlockedDecrement
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesA
GetLocaleInfoA
SystemTimeToFileTime
GetShortPathNameA
FreeLibrary
LoadLibraryA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetPrivateProfileIntA
GetSystemTime
GetCurrentProcessId
SetEvent
CloseHandle
WaitForSingleObject
GetCurrentThreadId
GetTickCount
CreateThread
GetModuleFileNameA
WritePrivateProfileStringA
SetHandleCount
GetPrivateProfileStringA

user32

RegisterClipboardFormatA
PostThreadMessageA
GetMessageA
TranslateMessage
ValidateRect
ShowOwnedPopups
PostQuitMessage
EndDialog
CreateDialogIndirectParamA
BringWindowToTop
UnpackDDElParam
ReuseDDElParam
SetMenu
LoadMenuA
DestroyMenu
GetActiveWindow
GetDesktopWindow
ReleaseCapture
TranslateAcceleratorA
LoadAcceleratorsA
SetRectEmpty
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
GetNextDlgTabItem
IsWindowEnabled
SetWindowTextA
IsDialogMessageA
SetDlgItemTextA
LoadIconA
PostMessageA
MapWindowPoints
GetSysColor
PeekMessageA
DispatchMessageA
GetFocus
IsWindow
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
IsWindowVisible
GetTopWindow
MessageBoxA
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
LoadCursorA
EnableWindow
UnregisterClassA
wvsprintfA
SetWindowPos
GetWindowRect
GetParent
SetForegroundWindow
GetDlgItem
GetDlgCtrlID
GetKeyState
DestroyWindow
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
RemovePropA
DefWindowProcA
GetMessageTime
GetSysColorBrush
PtInRect
SendDlgItemMessageA
GetClassNameA
GetMessagePos
GetLastActivePopup
SendMessageA
SetWindowLongA
CallWindowProcA
CloseClipboard
SetFocus
GetClipboardData
OpenClipboard
InvalidateRect
SetActiveWindow
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
UpdateWindow
ShowWindow
GetWindowLongA
ClientToScreen
SetCursor
GetCursorPos
ScreenToClient
ReleaseDC
GetDC
GetWindowTextA
GetWindowTextLengthA
GetClientRect
MoveWindow
GetSystemMetrics
GetWindowPlacement
IsIconic
SystemParametersInfoA
OffsetRect
RegisterWindowMessageA
GetWindow
LoadStringA
EnableMenuItem

gdi32

PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
GetMapMode
GetWindowExtEx
GetViewportExtEx
GetDeviceCaps
DeleteObject
CreateFontIndirectA
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetBkMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
GetTextExtentPointA
GetObjectA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegQueryInfoKeyA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA

shell32

DragQueryFileA
DragFinish
FindExecutableA
ShellExecuteA

comctl32

ord17

oledlg

ord8

ole32

CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoInitialize
CoCreateInstance
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoGetClassObject

oleaut32

SysFreeString
VariantCopy
VariantInit
SysAllocStringLen
SysAllocString
VariantChangeType
VariantClear

wininet

InternetAutodialHangup
InternetOpenA
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetErrorDlg
InternetReadFile
InternetQueryDataAvailable
InternetGetConnectedState
InternetAutodial

Sections

.text
Size: 360KB - Virtual size: 359KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ca6c9e4012037fd6ee2e25bf6630231

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

oleaut32

wininet

Sections

.text Size: 360KB - Virtual size: 359KB

.rdata Size: 68KB - Virtual size: 65KB

.data Size: 36KB - Virtual size: 47KB

.rsrc Size: 12KB - Virtual size: 11KB

.text
Size: 360KB - Virtual size: 359KB

.rdata
Size: 68KB - Virtual size: 65KB

.data
Size: 36KB - Virtual size: 47KB

.rsrc
Size: 12KB - Virtual size: 11KB