NEAS[.]0d0241a6eb3acb0cb0e4993b5566c630[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0d0241a6eb3acb0cb0e4993b5566c630.exe
Size

256KB
MD5

0d0241a6eb3acb0cb0e4993b5566c630
SHA1

9ed7d1a5fae34484509a79c91ddd7e4faafe1d89
SHA256

42aa49f62ff570eaa53ebb5f2aa37f700bd61df78c1a547ee84c5b258fbfe41c
SHA512

7c0e3c9a434102b371ad695896d637821cb120f16cfd98e8221e0fda4fc7e0f4d40f46256d4393c24d6bc0abb79de3d7201021e39798c410c0d80b6742ca3b83
SSDEEP

6144:TNGfBNTp/3FNKtfdaUf7J4p9eTxHMphkBjJY:T+NTLNKtl57J4kHBBjq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0d0241a6eb3acb0cb0e4993b5566c630.exe

Files

NEAS.0d0241a6eb3acb0cb0e4993b5566c630.exe
.exe windows:5 windows x86

dcfce339695857823e8ba65951a0fb1f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
Sleep
InterlockedDecrement
GetLastError
FlushFileBuffers
CreateFileW
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryW
HeapReAlloc
HeapSize
GetCurrentProcessId
GetTickCount
OpenProcess
CloseHandle
CreateDirectoryW
GetModuleHandleW
GetBinaryTypeW
GetProcAddress
GetSystemInfo
FindFirstFileW
GetCurrentDirectoryW
FindClose
FindNextFileW
GetTempFileNameW
CopyFileW
MultiByteToWideChar
GetTempPathW
WideCharToMultiByte
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LocalFree
GetSystemTimeAsFileTime
HeapFree
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
GetCPInfo
RtlUnwind
HeapAlloc
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
WriteFile
GetStdHandle
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapCreate
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

SHGetFolderPathAndSubDirW

ole32

CoInitializeEx
CoUninitialize

psapi

GetModuleFileNameExW
EnumProcesses

urlmon

URLDownloadToFileW

Sections

.text
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 108KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dcfce339695857823e8ba65951a0fb1f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

shell32

ole32

psapi

urlmon

Sections

.text Size: 106KB - Virtual size: 106KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 8KB

.text Size: 108KB - Virtual size: 112KB

.text
Size: 106KB - Virtual size: 106KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 8KB

.text
Size: 108KB - Virtual size: 112KB