NEAS[.]915dea99bfb5ac8e0a692838a7a0aa50[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.915dea99bfb5ac8e0a692838a7a0aa50.exe
Size

1.8MB
MD5

915dea99bfb5ac8e0a692838a7a0aa50
SHA1

f61faecd0dfd1e1db0efe80eca186e72204b3221
SHA256

3ecbe27d51b546e0a2c18435552ebb06eec27b7d6bcf5184065d5b95a6499456
SHA512

da31ed04b4594bd5c2c7187b0f78d493d0a20e1a03c117fd2a0939f221ae44e27a42aa539beb0a5cab1c255dc6e2a2c33e52cafa34dd36c8ad79b6ef6450159b
SSDEEP

24576:uj8tWSJz58DO2t77sI6d+wlJm9IMaJFYfST7wRlG+vdUPXLzsCrzBkP/Ny/:08JJz587tXl/wlJaqYGcrTUPXprzyW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.915dea99bfb5ac8e0a692838a7a0aa50.exe

Files

NEAS.915dea99bfb5ac8e0a692838a7a0aa50.exe
.dll windows:5 windows x86

9f0df798b26c381767f6f2eb2d0d5926

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

urlmon

HlinkSimpleNavigateToString

kernel32

IsProcessorFeaturePresent
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
GetModuleHandleW
VirtualAlloc
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetBinaryTypeA
CreateFileA
GetModuleFileNameW

advapi32

CreateProcessWithLogonW
CryptDestroyHash
DuplicateToken

shlwapi

StrCpyNW
StrRetToBSTR

msvcrt

wcstoul
putc

winspool.drv

AddMonitorA

user32

GetCursor
DestroyAcceleratorTable
InSendMessageEx
DispatchMessageA

oleaut32

LoadTypeLibEx
GetErrorInfo

ole32

HDC_UserUnmarshal

Exports

Exports

MlHleewehee

Sections

.text
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 132KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DcT5Oo
Size: 328KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

N
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f0df798b26c381767f6f2eb2d0d5926

Headers

File Characteristics

Imports

urlmon

kernel32

advapi32

shlwapi

msvcrt

winspool.drv

user32

oleaut32

ole32

Exports

Exports

Sections

.text Size: 32KB - Virtual size: 29KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 132KB - Virtual size: 133KB

DcT5Oo Size: 328KB - Virtual size: 326KB

N Size: 1.3MB - Virtual size: 1.3MB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 44KB - Virtual size: 42KB

.text
Size: 32KB - Virtual size: 29KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 132KB - Virtual size: 133KB

DcT5Oo
Size: 328KB - Virtual size: 326KB

N
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 44KB - Virtual size: 42KB