NEAS[.]bda13bc02fd476413f8b1793eac7e980[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.bda13bc02fd476413f8b1793eac7e980.exe
Size

5.2MB
MD5

bda13bc02fd476413f8b1793eac7e980
SHA1

0f0a3bccad7d51babe2eda88e64a431d9f58c2eb
SHA256

0873b13834a36f63987c9cbda2563fb43eca643411e7c4537c79723001c468fa
SHA512

baf6271cd05076a6df1845add880edd9b125f182650f31a6eebd4997522f924969e4f80436281a189c5b2c0b480bae5e3963246d76bc4f825ac7e269c66b9b23
SSDEEP

49152:v1H9iwxn2710aIyRQW4dbNwDy95ww9C+5PmNcMuK3FnMU2nAuu2SNZjXuYCvzpoS:tdiwZ271VlymNcMVVnMyuAQenphi+G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.bda13bc02fd476413f8b1793eac7e980.exe

Files

NEAS.bda13bc02fd476413f8b1793eac7e980.exe
.exe windows:5 windows x86

3338ddb0cf67ca342eeadfbfe3e67075

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

HttpQueryInfoA

crypt32

CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CryptVerifyMessageSignature
CertCloseStore

urlmon

CopyStgMedium

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

winmm

waveOutGetDevCapsA
waveInGetDevCapsA
waveOutGetNumDevs
waveOutOpen
waveInStart
waveInAddBuffer
waveInGetNumDevs
waveInOpen
timeSetEvent
timeKillEvent
waveOutGetPosition
timeBeginPeriod
timeGetTime
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
waveOutClose
waveOutReset
timeGetDevCaps
waveInPrepareHeader
timeEndPeriod

oleaut32

SysFreeString

kernel32

FreeLibrary
GetSystemInfo
GetModuleHandleA
GetSystemDefaultLangID
MoveFileA
DeleteFileA
GetFileAttributesA
GetUserDefaultLangID
ExitThread
GlobalFree
WriteFile
SetFilePointer
CreateFileA
ReadFile
GetFileSize
LockResource
LoadResource
FindResourceExA
FindResourceExW
GetFileAttributesW
SetUnhandledExceptionFilter
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
CreateDirectoryA
GetModuleFileNameA
CreateMutexA
CreateFileW
GlobalAlloc
GetTempFileNameA
GetFullPathNameA
GetSystemDirectoryA
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
GetFileAttributesExA
SetCurrentDirectoryA
RemoveDirectoryA
SetFilePointerEx
GetFileSizeEx
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
TerminateThread
lstrcpyA
lstrlenA
IsDBCSLeadByteEx
GetCommandLineW
DeleteFileW
SetEndOfFile
SetFileAttributesA
CopyFileA
GetStartupInfoA
GetCommandLineA
GetProcessHeap
HeapFree
VirtualAlloc
VirtualFree
VirtualProtect
CreateSemaphoreA
ReleaseSemaphore
UnhandledExceptionFilter
GetStdHandle
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GlobalSize
GetCurrentProcessId
GlobalLock
GlobalUnlock
WideCharToMultiByte
GetCurrentProcess
GetProcessTimes
CreateWaitableTimerA
CreateThread
SetWaitableTimer
WaitForSingleObject
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
CreateProcessA
LCMapStringW
LCMapStringA
GetTickCount
GetCurrentThreadId
GetLocaleInfoA
SetErrorMode
GetLastError
GetVersionExA
LoadLibraryA
GetProcAddress
FlushInstructionCache
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ResetEvent
WaitForMultipleObjects
SetEvent
CreateEventA
CloseHandle
VirtualQuery
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
HeapAlloc
VirtualProtectEx
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
ExitProcess
HeapCreate
HeapReAlloc
GetOEMCP
IsValidCodePage
RtlUnwind
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
RaiseException
GetCurrentDirectoryA

user32

InsertMenuA
InsertMenuW
RemoveMenu
UnregisterClassA
GetWindowTextA
GetDlgItemTextW
GetWindowTextLengthW
PostQuitMessage
GetMenuStringA
GetMenuStringW
RegisterClassA
TranslateAcceleratorA
LoadAcceleratorsA
IsWindow
GetMenuItemID
DeleteMenu
InsertMenuItemA
GetCapture
WindowFromPoint
GetWindowThreadProcessId
AttachThreadInput
GetFocus
GetMenu
SetCursor
GetCursorPos
LoadMenuA
EnableMenuItem
CheckMenuItem
MapVirtualKeyA
GetKeyState
GetForegroundWindow
WaitForInputIdle
ShowWindow
LoadCursorA
GetSubMenu
TrackPopupMenu
SetCapture
SetTimer
UpdateWindow
ReleaseCapture
KillTimer
DefWindowProcA
SetMenu
EndPaint
DestroyWindow
DestroyMenu
InvalidateRect
GetWindowTextLengthA
SetClipboardData
IsWindowEnabled
EnableWindow
MessageBoxA
GetMessageA
LoadStringA
RedrawWindow
DialogBoxParamW
DialogBoxParamA
GetWindowLongA
ScreenToClient
MoveWindow
SetDlgItemTextW
SetDlgItemTextA
GetClientRect
DialogBoxIndirectParamW
DialogBoxIndirectParamA
EndDialog
SetWindowLongA
GetParent
GetWindowRect
GetDesktopWindow
SetWindowPos
LoadIconA
GetDlgItem
SendMessageA
SetWindowTextA
SetFocus
GetMenuItemCount
GetMenuItemInfoA
SystemParametersInfoA
InsertMenuItemW
GetSystemMetrics
GetClipboardFormatNameA
RegisterClipboardFormatA
CreateWindowExA
DdeInitializeA
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
LoadStringW
EnumDisplaySettingsA
GetWindow
IsClipboardFormatAvailable
GetClipboardData
OpenClipboard
BeginPaint
EmptyClipboard
DdeUninitialize
SendInput
GetKeyboardLayout
FillRect
GetDC
ReleaseDC
ClientToScreen
GetMonitorInfoA
OffsetRect
SetRect
MonitorFromWindow
PeekMessageA
TranslateMessage
DispatchMessageA
MsgWaitForMultipleObjects
GetDoubleClickTime
GetDlgItemTextA
CloseClipboard
PostMessageA

gdi32

GetPixel
GetObjectA
CreateDIBSection
DeleteObject
GetDIBits
CreateCompatibleBitmap
GetDeviceCaps
BitBlt
SelectObject
RealizePalette
SelectPalette
ExtTextOutA
SetBkColor
CreateSolidBrush
StretchBlt
SetStretchBltMode
GetStretchBltMode
GetICMProfileA
CreateDCA
GetStockObject
CreateFontIndirectA
GetTextMetricsA
EnumFontFamiliesA
MoveToEx
DeleteDC
IntersectClipRect
SelectClipRgn
ExtTextOutW
SetTextColor
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
GetBkColor
CreateFontIndirectW
SetWorldTransform
SetGraphicsMode
GetWorldTransform
SetTextCharacterExtra
CreatePen
DPtoLP
GetTextExtentPoint32W
GetCurrentObject
GetTextExtentPoint32A
CreatePalette
GetSystemPaletteEntries
GetClipBox
LPtoDP
StartDocA
EndDoc
StrokePath
ExtCreatePen
FillPath
StretchDIBits
CreateCompatibleDC
GdiFlush
RestoreDC
SelectClipPath
PolyBezierTo
LineTo
SetTextAlign
EndPath
BeginPath
SaveDC
SetPolyFillMode
EndPage
GetFontData
SetBkMode
EnumFontFamiliesExW
StartPage

comdlg32

CommDlgExtendedError
GetOpenFileNameA
PrintDlgA
GetOpenFileNameW
GetSaveFileNameW
GetSaveFileNameA

advapi32

RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

shell32

DragQueryFileA
DragAcceptFiles
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHAppBarMessage
DragQueryFileW

ole32

CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoInitialize
CreateBindCtx
ReleaseStgMedium
CoUninitialize
OleUninitialize
OleIsCurrentClipboard
OleGetClipboard
OleSetClipboard
OleInitialize
OleFlushClipboard

mscms

DeleteColorTransform
OpenColorProfileA
CloseColorProfile
CreateColorTransformW
TranslateBitmapBits

ws2_32

inet_ntoa
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
ntohl
select
gethostname
WSAAddressToStringA
sendto
WSACleanup
recvfrom
ioctlsocket
connect
setsockopt
WSASetLastError
getservbyport
gethostbyaddr
htons
getservbyname
htonl
closesocket
gethostbyname
inet_addr
getsockname
ntohs
bind
send
recv
WSAStartup
WSASocketA
socket
WSAAsyncSelect
WSAIoctl
WSAGetLastError
WSACloseEvent

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 873KB - Virtual size: 873KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 128KB - Virtual size: 984KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 622KB - Virtual size: 621KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3338ddb0cf67ca342eeadfbfe3e67075

Headers

DLL Characteristics

File Characteristics

Imports

wininet

crypt32

urlmon

version

winmm

oleaut32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

mscms

ws2_32

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 873KB - Virtual size: 873KB

.data Size: 128KB - Virtual size: 984KB

.rodata Size: 1KB - Virtual size: 1KB

.rsrc Size: 622KB - Virtual size: 621KB

.reloc Size: 118KB - Virtual size: 117KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 873KB - Virtual size: 873KB

.data
Size: 128KB - Virtual size: 984KB

.rodata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 622KB - Virtual size: 621KB

.reloc
Size: 118KB - Virtual size: 117KB