NEAS[.]f8b205ba4472060a904a6028b39acb30[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f8b205ba4472060a904a6028b39acb30.exe
Size

1.6MB
MD5

f8b205ba4472060a904a6028b39acb30
SHA1

b93957b3a4cc29ca933d71d0312ea148519bf22b
SHA256

3873ebea549e88a2f29f0d64b3321f3a836e049ae81d65b80592832d15488a63
SHA512

45ad11d5bdc37261d599ae1a5a5c80ff5ed9ef10a7aed3ce20a0394a23353145b6b35f10b275a55cd10019ff7a7faa08a5be18c7f6fb1d77e69ebff5d9c6dc92
SSDEEP

24576:V/LLlxX1LzseOSw1hQsx4MWf1701eGtVTV/rIYkz:5L1GcsRecVTJrIYk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f8b205ba4472060a904a6028b39acb30.exe

Files

NEAS.f8b205ba4472060a904a6028b39acb30.exe
.exe windows:5 windows x86

bccdaa9888134cf1ca42259ef1662433

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

setupapi

SetupCloseInfFile
SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupOpenInfFileW
SetupInitDefaultQueueCallbackEx
SetupFindNextLine
SetupCopyOEMInfW
SetupDefaultQueueCallbackW
SetupFindFirstLineW
SetupGetStringFieldW

cabinet

ord23
ord20
ord22

kernel32

InterlockedIncrement
InterlockedDecrement
SetErrorMode
GetStdHandle
SetEndOfFile
CreateDirectoryW
GetCurrentDirectoryW
MoveFileW
CopyFileExW
GetTickCount
TerminateProcess
GetSystemInfo
GetVersionExA
InterlockedCompareExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsSetValue
TlsGetValue
DebugBreak
InitializeCriticalSectionAndSpinCount
GetFileAttributesExW
GetSystemWindowsDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
GetCurrentDirectoryA
VirtualProtect
IsBadReadPtr
HeapAlloc
HeapFree
RtlUnwind
DeleteFileA
HeapReAlloc
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetModuleFileNameA
GetProcessHeap
TlsFree
HeapSize
GetCPInfo
GetACP
GetOEMCP
GetTimeZoneInformation
LCMapStringA
MultiByteToWideChar
SetLastError
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
VirtualQuery
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTempPathA
GetTempFileNameA
GetFileAttributesExA
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetModuleHandleW
GetWindowsDirectoryW
ReadFile
GetEnvironmentVariableW
GetLocalTime
GetCurrentThreadId
FindFirstFileW
RemoveDirectoryW
FindClose
DeleteFileW
FindNextFileW
GetSystemDirectoryW
GetModuleFileNameW
Sleep
CreateProcessW
WaitForSingleObject
GetSystemTimeAsFileTime
GetShortPathNameW
MoveFileExW
GetFileAttributesW
SetFileAttributesW
LoadLibraryA
WideCharToMultiByte
GetFullPathNameA
DeviceIoControl
CloseHandle
CreateFileW
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
LocalAlloc
LocalFree
SetConsoleCtrlHandler
GetCurrentProcess
GetExitCodeProcess
SetCurrentDirectoryW
GetFullPathNameW
CreateMutexW
LoadLibraryExW
GetVersionExW
CreateDirectoryA
SetFilePointer
WriteFile
LCMapStringW
CreateFileA
GetVersion
OutputDebugStringA

advapi32

CryptReleaseContext
GetExplicitEntriesFromAclW
IsValidSid
EqualSid
LookupPrivilegeValueW
AdjustTokenPrivileges
BuildTrusteeWithSidW
SetEntriesInAclW
FreeSid
AllocateAndInitializeSid
RegEnumValueW
CryptAcquireContextW
CryptGetProvParam
RegSetValueExW
RegCreateKeyExW
OpenProcessToken
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegQueryValueExW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ControlService
QueryServiceStatus
StartServiceW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyW
RegSetValueW
RegOpenKeyW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
ChangeServiceConfig2W
CreateServiceW
OpenSCManagerW
OpenServiceW
ChangeServiceConfigW
CloseServiceHandle
StartTraceW
EnableTrace
ControlTraceW
TraceEvent
GetSecurityDescriptorDacl

shell32

SHGetFolderPathW

shlwapi

SHGetValueW
SHSetValueW
wnsprintfW
SHDeleteKeyW

ole32

CoInitialize
CoCreateInstance

oleaut32

VariantInit
SysStringLen
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen

crypt32

CertOpenStore
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CryptAcquireCertificatePrivateKey
CertGetCertificateChain
CryptSignMessage
CertFreeCertificateChain
CertFreeCertificateContext
CertCloseStore
CryptVerifyDetachedMessageSignature

sfc

SfcIsFileProtected

Sections

.text
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bldvar
Size: 512B - Virtual size: 19B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.1MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

bccdaa9888134cf1ca42259ef1662433

Headers

DLL Characteristics

File Characteristics

Imports

version

setupapi

cabinet

kernel32

advapi32

shell32

shlwapi

ole32

oleaut32

crypt32

sfc

Sections

.text Size: 313KB - Virtual size: 312KB

.rdata Size: 82KB - Virtual size: 82KB

.data Size: 49KB - Virtual size: 58KB

.bldvar Size: 512B - Virtual size: 19B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1.1MB - Virtual size: 1.7MB

.text
Size: 313KB - Virtual size: 312KB

.rdata
Size: 82KB - Virtual size: 82KB

.data
Size: 49KB - Virtual size: 58KB

.bldvar
Size: 512B - Virtual size: 19B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1.1MB - Virtual size: 1.7MB