NEAS[.]40bec1224476330f95b898a2e1001f20[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.40bec1224476330f95b898a2e1001f20.exe
Size

212KB
MD5

40bec1224476330f95b898a2e1001f20
SHA1

8cc6c3b9f841dcb87dfc6f8c48dc151ebf6c2eaf
SHA256

b3b308f71feaa593f12a4a29a61cbc852e4ffd983f31e637a55c960d4d0e9fe9
SHA512

2ef0c2867951b29f4990237c4f8aaf2c0179bc7628284a23a2724ffcbfb6a16546b1922f4980d4a77914add3cfef1dfa1e7a25d523ba91be8e5964cc464caddb
SSDEEP

3072:FMeEzNLBeTVotnCDIAYBYMfm1yYn9D2NlD0y4tK7xctZwEF7k/it+GNdfOIJ6s7:FHAVBYUnCJqVfm1t2P0ai5j+QGns

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.40bec1224476330f95b898a2e1001f20.exe

Files

NEAS.40bec1224476330f95b898a2e1001f20.exe
.dll windows:4 windows x86

795f995cbac039ca0d181470fe9f6a25

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

vcl50.bpl

@System@initialization$qqrv

vclx50.bpl

@Filectrl@initialization$qqrv

vcldb50.bpl

@Dbconsts@initialization$qqrv

vclbde50.bpl

@Bde@initialization$qqrv

qrpt50.bpl

@Qr3const@initialization$qqrv

ip4000v5.bpl

@Wwstr@initialization$qqrv

fc4000v5.bpl

@Fcgraphics@initialization$qqrv

advctrls.bpl

@@Checktreeview@Finalize

tuxedo.bpl

@Msxml_tlb@Finalization$qqrv

ehlibb50.bpl

@Dbsumlst@Finalization$qqrv

syscomm

@TMsgUtil@MsgBoxError$qpvrx17System@AnsiString

user32

EnumThreadWindows

oleaut32

VariantInit

Exports

Exports

@@Cs_checkinfo@Finalize
@@Cs_checkinfo@Initialize
@@Cs_custlist@Finalize
@@Cs_custlist@Initialize
@@Cs_frametradefeeinfo@Finalize
@@Cs_frametradefeeinfo@Initialize
@@Cs_identitycheckdeal@Finalize
@@Cs_identitycheckdeal@Initialize
@@Cs_mobtrade@Finalize
@@Cs_mobtrade@Initialize
@@Cs_pubusrhintinfo@Finalize
@@Cs_pubusrhintinfo@Initialize
@@Cs_setpage@Finalize
@@Cs_setpage@Initialize
@@Cs_terminaterepairtrade@Finalize
@@Cs_terminaterepairtrade@Initialize
@@Cs_userlist@Finalize
@@Cs_userlist@Initialize
@@Pub_syslog@Finalize
@@Pub_syslog@Initialize
@@Pub_sysmainproxy@Finalize
@@Pub_sysmainproxy@Initialize
@@Pub_sysmanageproxy@Finalize
@@Pub_sysmanageproxy@Initialize
@@Pub_sysorgproxy@Finalize
@@Pub_sysorgproxy@Initialize
@@Pub_syssecproxy@Finalize
@@Pub_syssecproxy@Initialize
@System@TMetaClass@ClassName$qqrv
@System@TMetaClass@ClassParent$qqrv
@System@TObject@ClassName$qqrv
@System@TObject@ClassName$qqrv
@System@TObject@ClassNameIs$qqrx17System@AnsiString
@System@TObject@ClassNameIs$qqrx17System@AnsiString
@System@TObject@ClassNameIs$qqrx17System@AnsiString
@System@TObject@ClassNameIs$qqrx17System@AnsiString
@System@TObject@ClassNameIs$qqrx17System@AnsiString
@System@TObject@ClassParent$qqrv
___CPPdebugHook
_frameTradeFeeInfo
_frmCheckInfo
_frmCustList
_frmIdentityCheckDeal
_frmPageSetup
_frmUserList
_frmUsrHintInfo
fnDllLoad
fnDllLoad
fnDllLoad
fnDllLoad
fnDllService
fnDllUnload
fnGetDllBuildno

Sections

.text
Size: 204KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

795f995cbac039ca0d181470fe9f6a25

Headers

File Characteristics

Imports

kernel32

vcl50.bpl

vclx50.bpl

vcldb50.bpl

vclbde50.bpl

qrpt50.bpl

ip4000v5.bpl

fc4000v5.bpl

advctrls.bpl

tuxedo.bpl

ehlibb50.bpl

syscomm

user32

oleaut32

Exports

Exports

Sections

.text Size: 204KB - Virtual size: 1.1MB

.rsrc Size: 6KB - Virtual size: 8KB

.reloc Size: 512B - Virtual size: 512B

.text
Size: 204KB - Virtual size: 1.1MB

.rsrc
Size: 6KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 512B