NEAS[.]374a390fed666e1112a63e7445978a00[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.374a390fed666e1112a63e7445978a00.exe
Size

2.3MB
MD5

374a390fed666e1112a63e7445978a00
SHA1

8cc640f83c28ca3ed83789f8b238c72fe091970f
SHA256

0c28fe83ff95567de76361b14989dbaea9fe9e4a0a1dd8da57377bac83309c0e
SHA512

096475e771950f03498336b25013b7fc6a881aca9073fe01da1cbbb2a2fcd93a6a2849103ce5e6755e11f348c7a9d35945238d42c0222422ddc7384e0aeb1a5c
SSDEEP

49152:zXCirwLMIGHiZQDI+3K4Do2KZ9PqtEmXM4gBovUiRgL:jXcGH4QBKPvm84g+a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.374a390fed666e1112a63e7445978a00.exe

Files

NEAS.374a390fed666e1112a63e7445978a00.exe
.exe windows:10 windows x86

be0d2e263721e910970f20e4b1cafb36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

freeaddrinfo
getaddrinfo
send
gethostbyname
gethostbyaddr
sendto
recvfrom
inet_addr
bind
getpeername
WSAGetLastError
socket
shutdown
setsockopt
gethostname
select
recv
getsockopt
ioctlsocket
connect
closesocket
accept
__WSAFDIsSet
inet_ntoa
htons
WSACleanup
WSAStartup

crypt32

CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringA
CertGetNameStringW
CryptMsgGetParam
CryptMsgClose
CryptQueryObject

kernel32

GetUserDefaultUILanguage
GetDiskFreeSpaceA
GetTempPathA
GetLocalTime
SystemTimeToFileTime
GetACP
SetConsoleCtrlHandler
GetCurrentDirectoryA
HeapFree
TerminateProcess
GetCurrentThread
SetThreadPriority
SetPriorityClass
GetVersionExA
VirtualProtect
VirtualQuery
GetModuleFileNameA
GetModuleHandleA
SetLastError
GetSystemInfo
GetSystemDirectoryA
GetWindowsDirectoryA
GetSystemWindowsDirectoryA
GetNativeSystemInfo
GetComputerNameA
IsBadReadPtr
GetModuleHandleExA
Process32First
Process32Next
GetTickCount64
CreateDirectoryA
CreateFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileSizeEx
RemoveDirectoryA
SetEndOfFile
SetFilePointer
WriteFile
CloseHandle
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetProcessTimes
SwitchToThread
GetTickCount
MapViewOfFileEx
UnmapViewOfFile
GetProcAddress
LocalFree
FormatMessageA
CreateSemaphoreA
CreateFileMappingA
OpenProcess
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentVariableA
SetCurrentDirectoryA
GetFileAttributesA
GetFullPathNameA
GetSystemTime
FileTimeToSystemTime
GetTimeZoneInformation
AreFileApisANSI
GetExitCodeProcess
CreateProcessA
GetStdHandle
GetConsoleMode
ExitThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DeleteFileA
SetFileTime
IsWow64Process
DuplicateHandle
GetProfileStringA
SetThreadContext
GetExitCodeThread
ReadFile
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleW
GetModuleHandleExW
GetCPInfo
CreateThread
FreeLibraryAndExitThread
CreateFileW
GetFileType
RaiseException
GetStringTypeW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
SetFilePointerEx
SetStdHandle
HeapReAlloc
HeapSize
IsValidCodePage
GetOEMCP
GetCommandLineW
GetModuleFileNameW
WriteConsoleW
EncodePointer
DecodePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
LocalAlloc
MapViewOfFile
OpenFileMappingA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
CreateToolhelp32Snapshot
Thread32First
Thread32Next
SetEvent
ResetEvent
CreateEventA
OpenEventA
WaitForMultipleObjects
ProcessIdToSessionId
IsBadWritePtr
OpenSemaphoreA
FlushInstructionCache
GetVersion
DeviceIoControl
LockFile
UnlockFile
IsBadStringPtrA
IsBadStringPtrW
GetDriveTypeA
GetThreadContext
GetLogicalDrives
GetOverlappedResult
CreateEventW
EnumSystemFirmwareTables
GetSystemFirmwareTable
OpenMutexA
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitializeSListHead
WaitForSingleObjectEx
GetFileTime
GetCurrentThreadId
GetStartupInfoW
GetCurrentProcessId
GetCurrentProcess
Sleep
GetProcessHeap
HeapAlloc
HeapCreate
FlushFileBuffers
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
FindFirstFileExW
FindNextFileW
GetCommandLineA
GlobalFree

user32

TranslateMessage
DispatchMessageA
PeekMessageA
CallMsgFilterA
EnumDisplayDevicesA
MessageBoxA
MessageBoxW
DrawMenuBar
GetSystemMenu
wsprintfA
AppendMenuA
LoadStringA
GetSystemMetrics
CharUpperBuffA
CharLowerBuffA

shell32

ShellExecuteExA

advapi32

SetSecurityDescriptorSacl
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetUserNameA
RegCreateKeyExA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegSetValueExA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegDeleteKeyA
RegFlushKey
CloseServiceHandle
OpenSCManagerA
OpenServiceA
QueryServiceConfigA
QueryServiceStatus
StartServiceA
QueryServiceStatusEx
GetSecurityDescriptorSacl

psapi

GetModuleFileNameExA

powrprof

PowerReadFriendlyName

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration
WinHttpCloseHandle
WinHttpOpen
WinHttpGetProxyForUrl

wintrust

WinVerifyTrust

ntdll

RtlRemoveVectoredExceptionHandler
RtlAddVectoredExceptionHandler

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

__wibu00
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu01
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu02
Size: 94KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

__wibu03
Size: 120KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

be0d2e263721e910970f20e4b1cafb36

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

kernel32

user32

shell32

advapi32

psapi

powrprof

version

winhttp

wintrust

ntdll

Sections

.text Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 924B

.idata Size: 1KB - Virtual size: 1KB

.rsrc Size: 18KB - Virtual size: 17KB

.reloc Size: 512B - Virtual size: 348B

__wibu00 Size: 2.0MB - Virtual size: 2.0MB

__wibu01 Size: 8KB - Virtual size: 8KB

__wibu02 Size: 94KB - Virtual size: 108KB

__wibu03 Size: 120KB - Virtual size: 124KB

.text
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 924B

.idata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 18KB - Virtual size: 17KB

.reloc
Size: 512B - Virtual size: 348B

__wibu00
Size: 2.0MB - Virtual size: 2.0MB

__wibu01
Size: 8KB - Virtual size: 8KB

__wibu02
Size: 94KB - Virtual size: 108KB

__wibu03
Size: 120KB - Virtual size: 124KB