NEAS[.]011faa611640bf4ad3d3ae32e068a3f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.011faa611640bf4ad3d3ae32e068a3f0.exe
Size

144KB
MD5

011faa611640bf4ad3d3ae32e068a3f0
SHA1

19bf03736deae098a75cfb7c7d10db207022d38a
SHA256

3b49edc41d915fa83fee2b6644bb866fedff0963b1ba16348adefeea422d427f
SHA512

3ace9a3472b5abb4419f73550f582dc568f07f64ed6da1b6624f94427499e3e957462bf6c3187e1040646357f9bce27459b77a6b0f9bf3243a408ef5f9a98654
SSDEEP

3072:osiRCXKVibm+F/ny8XHfalnjIafmAyQoybjU:oxCb/ny8XHfmnnuHvybg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.011faa611640bf4ad3d3ae32e068a3f0.exe

Files

NEAS.011faa611640bf4ad3d3ae32e068a3f0.exe
.exe windows:5 windows x86

21c1ff8db1b3e1bcdb124db17bfdfeb9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

ClearEventLogW

clusapi

CloseClusterNetInterface
GetClusterNetworkKey
FailClusterResource
ClusterRegSetKeySecurity
ClusterCloseEnum
GetClusterFromNetInterface
ClusterNetworkGetEnumCount
ClusterControl
SetClusterGroupName

kernel32

CloseHandle
WaitForSingleObject
ExitThread
GetCurrentThreadId
GetLastError
CreateThread
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
HeapSetInformation
GetStartupInfoW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetProcAddress
ExitProcess
HeapFree
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
SetStdHandle
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryW
RtlUnwind
HeapAlloc
HeapReAlloc
WriteConsoleW
MultiByteToWideChar
SetFilePointer
FlushFileBuffers
LCMapStringW
GetStringTypeW
HeapSize
IsProcessorFeaturePresent
CreateFileW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 792KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

21c1ff8db1b3e1bcdb124db17bfdfeb9

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

clusapi

kernel32

Sections

.text Size: 29KB - Virtual size: 28KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 4KB - Virtual size: 792KB

.rsrc Size: 96KB - Virtual size: 172KB

.text
Size: 29KB - Virtual size: 28KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 792KB

.rsrc
Size: 96KB - Virtual size: 172KB