NEAS[.]83bd8d78101a5cc4294a401e09c88a30[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.83bd8d78101a5cc4294a401e09c88a30.exe
Size

1.4MB
MD5

83bd8d78101a5cc4294a401e09c88a30
SHA1

1b0d0ffd6b272de8e1c2995a94a2956793b658b8
SHA256

61c3406bf47bc46d8d6113e599abf8a1916315fe434a4be430f8070cda0d088c
SHA512

66dd007b7dc4dce53d1a08b83f0f5ade30b240b6ee9d9079d0a0f7e3caa9185b55d9d83bd7ad239ffae2471571b2b9542812b036cd675d9014fa307bf1b681a7
SSDEEP

24576:O9TmAXiQ+M0xMX8q5vZRoSQoNw5nkiX2Q3jguiBzqfid8V+msxu:O9TR6MsqnRDTgAuV+m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.83bd8d78101a5cc4294a401e09c88a30.exe

Files

NEAS.83bd8d78101a5cc4294a401e09c88a30.exe
.dll windows:6 windows x64

55caa103ee7389b779eea2635ecf9dd1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_onexit
__dllonexit
_unlock
_lock
free
qsort
memmove
realloc
_vsnwprintf
_aligned_malloc
_aligned_free
_wcsnicmp
_wcsicmp
memcmp
_stricmp
_isnan
strncmp
memmove_s
strcpy_s
strstr
rand
fprintf
ldexp
wcschr
iswalpha
__C_specific_handler
_initterm
log
floor
exp
atan2
_setjmp
_finite
memset
wcsstr
memcpy
_amsg_exit
_XcptFilter
_callnewh
malloc
_purecall
sqrt

ole32

CreateStreamOnHGlobal
PropVariantCopy
CoGetApartmentType
CoLockObjectExternal
CoTaskMemFree
StringFromGUID2
PropVariantClear
CoTaskMemAlloc
CoCreateInstance
IIDFromString
CLIPFORMAT_UserSize
CLIPFORMAT_UserMarshal
CLIPFORMAT_UserFree
CLIPFORMAT_UserUnmarshal
HBITMAP_UserUnmarshal
HICON_UserSize
HPALETTE_UserFree
HBITMAP_UserFree
HBITMAP_UserMarshal
HICON_UserMarshal
HPALETTE_UserMarshal
HBITMAP_UserSize
HICON_UserUnmarshal
HICON_UserFree
HPALETTE_UserSize
HPALETTE_UserUnmarshal
GetHGlobalFromStream

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DbgPrintEx
RtlSetBits
RtlInitializeBitMap
WinSqmAddToStream
WinSqmIsOptedIn

rpcrt4

NdrDllGetClassObject
NdrCStdStubBuffer2_Release
NdrCStdStubBuffer_Release
CStdStubBuffer_Connect
CStdStubBuffer_Invoke
NdrClientCall2
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_Disconnect
CStdStubBuffer_DebugServerRelease
IUnknown_AddRef_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_DebugServerQueryInterface
IUnknown_Release_Proxy
NdrStubCall2
CStdStubBuffer_CountRefs
NdrOleAllocate
NdrStubForwardingFunction
NdrOleFree
IUnknown_QueryInterface_Proxy
CStdStubBuffer_AddRef
RpcRaiseException

kernel32

GetModuleHandleW
HeapFree
GetProcessHeap
HeapAlloc
RtlCaptureStackBackTrace
LoadLibraryExW
IsProcessorFeaturePresent
GetVersionExW
GlobalAlloc
CreateFileMappingA
VirtualAlloc
VirtualFree
DelayLoadFailureHook
LoadLibraryExA
FreeLibrary
RaiseException
MulDiv
LocalAlloc
LocalFree
GetProcAddress
MultiByteToWideChar
GetStringScripts
SleepEx
GlobalUnlock
GlobalLock
GlobalSize
ReadFile
SetFilePointerEx
GetFileInformationByHandle
GetFileSize
SetFilePointer
WriteFile
CloseHandle
SetEndOfFile
CreateFileW
WideCharToMultiByte
RegEnumValueW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
MapViewOfFileEx
GetSystemInfo
UnmapViewOfFile
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
Sleep
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
SetLastError
GetFileType
lstrcmpiW
lstrcmpW
GlobalFree

advapi32

IsTextUnicode

user32

IsRectEmpty
IntersectRect
ReleaseDC
GetDC
IsCharAlphaNumericA
GetGuiResources
GetIconInfo
EqualRect

gdi32

GetPaletteEntries
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectW
CreateDIBSection
SetDIBits
GetDeviceCaps
DeleteObject

Exports

Exports

DllGetClassObject
IEnumString_Next_WIC_Proxy
IEnumString_Reset_WIC_Proxy
IPropertyBag2_Write_Proxy
IWICBitmapClipper_Initialize_Proxy
IWICBitmapCodecInfo_DoesSupportAnimation_Proxy
IWICBitmapCodecInfo_DoesSupportLossless_Proxy
IWICBitmapCodecInfo_DoesSupportMultiframe_Proxy
IWICBitmapCodecInfo_GetContainerFormat_Proxy
IWICBitmapCodecInfo_GetDeviceManufacturer_Proxy
IWICBitmapCodecInfo_GetDeviceModels_Proxy
IWICBitmapCodecInfo_GetFileExtensions_Proxy
IWICBitmapCodecInfo_GetMimeTypes_Proxy
IWICBitmapDecoder_CopyPalette_Proxy
IWICBitmapDecoder_GetColorContexts_Proxy
IWICBitmapDecoder_GetDecoderInfo_Proxy
IWICBitmapDecoder_GetFrameCount_Proxy
IWICBitmapDecoder_GetFrame_Proxy
IWICBitmapDecoder_GetMetadataQueryReader_Proxy
IWICBitmapDecoder_GetPreview_Proxy
IWICBitmapDecoder_GetThumbnail_Proxy
IWICBitmapEncoder_Commit_Proxy
IWICBitmapEncoder_CreateNewFrame_Proxy
IWICBitmapEncoder_GetEncoderInfo_Proxy
IWICBitmapEncoder_GetMetadataQueryWriter_Proxy
IWICBitmapEncoder_Initialize_Proxy
IWICBitmapEncoder_SetPalette_Proxy
IWICBitmapEncoder_SetThumbnail_Proxy
IWICBitmapFlipRotator_Initialize_Proxy
IWICBitmapFrameDecode_GetColorContexts_Proxy
IWICBitmapFrameDecode_GetMetadataQueryReader_Proxy
IWICBitmapFrameDecode_GetThumbnail_Proxy
IWICBitmapFrameEncode_Commit_Proxy
IWICBitmapFrameEncode_GetMetadataQueryWriter_Proxy
IWICBitmapFrameEncode_Initialize_Proxy
IWICBitmapFrameEncode_SetColorContexts_Proxy
IWICBitmapFrameEncode_SetResolution_Proxy
IWICBitmapFrameEncode_SetSize_Proxy
IWICBitmapFrameEncode_SetThumbnail_Proxy
IWICBitmapFrameEncode_WriteSource_Proxy
IWICBitmapLock_GetDataPointer_STA_Proxy
IWICBitmapLock_GetStride_Proxy
IWICBitmapScaler_Initialize_Proxy
IWICBitmapSource_CopyPalette_Proxy
IWICBitmapSource_CopyPixels_Proxy
IWICBitmapSource_GetPixelFormat_Proxy
IWICBitmapSource_GetResolution_Proxy
IWICBitmapSource_GetSize_Proxy
IWICBitmap_Lock_Proxy
IWICBitmap_SetPalette_Proxy
IWICBitmap_SetResolution_Proxy
IWICColorContext_InitializeFromMemory_Proxy
IWICComponentFactory_CreateMetadataWriterFromReader_Proxy
IWICComponentFactory_CreateQueryWriterFromBlockWriter_Proxy
IWICComponentInfo_GetAuthor_Proxy
IWICComponentInfo_GetCLSID_Proxy
IWICComponentInfo_GetFriendlyName_Proxy
IWICComponentInfo_GetSpecVersion_Proxy
IWICComponentInfo_GetVersion_Proxy
IWICFastMetadataEncoder_Commit_Proxy
IWICFastMetadataEncoder_GetMetadataQueryWriter_Proxy
IWICFormatConverter_Initialize_Proxy
IWICImagingFactory_CreateBitmapClipper_Proxy
IWICImagingFactory_CreateBitmapFlipRotator_Proxy
IWICImagingFactory_CreateBitmapFromHBITMAP_Proxy
IWICImagingFactory_CreateBitmapFromHICON_Proxy
IWICImagingFactory_CreateBitmapFromMemory_Proxy
IWICImagingFactory_CreateBitmapFromSource_Proxy
IWICImagingFactory_CreateBitmapScaler_Proxy
IWICImagingFactory_CreateBitmap_Proxy
IWICImagingFactory_CreateComponentInfo_Proxy
IWICImagingFactory_CreateDecoderFromFileHandle_Proxy
IWICImagingFactory_CreateDecoderFromFilename_Proxy
IWICImagingFactory_CreateDecoderFromStream_Proxy
IWICImagingFactory_CreateEncoder_Proxy
IWICImagingFactory_CreateFastMetadataEncoderFromDecoder_Proxy
IWICImagingFactory_CreateFastMetadataEncoderFromFrameDecode_Proxy
IWICImagingFactory_CreateFormatConverter_Proxy
IWICImagingFactory_CreatePalette_Proxy
IWICImagingFactory_CreateQueryWriterFromReader_Proxy
IWICImagingFactory_CreateQueryWriter_Proxy
IWICImagingFactory_CreateStream_Proxy
IWICMetadataBlockReader_GetCount_Proxy
IWICMetadataBlockReader_GetReaderByIndex_Proxy
IWICMetadataQueryReader_GetContainerFormat_Proxy
IWICMetadataQueryReader_GetEnumerator_Proxy
IWICMetadataQueryReader_GetLocation_Proxy
IWICMetadataQueryReader_GetMetadataByName_Proxy
IWICMetadataQueryWriter_RemoveMetadataByName_Proxy
IWICMetadataQueryWriter_SetMetadataByName_Proxy
IWICPalette_GetColorCount_Proxy
IWICPalette_GetColors_Proxy
IWICPalette_GetType_Proxy
IWICPalette_HasAlpha_Proxy
IWICPalette_InitializeCustom_Proxy
IWICPalette_InitializeFromBitmap_Proxy
IWICPalette_InitializeFromPalette_Proxy
IWICPalette_InitializePredefined_Proxy
IWICPixelFormatInfo_GetBitsPerPixel_Proxy
IWICPixelFormatInfo_GetChannelCount_Proxy
IWICPixelFormatInfo_GetChannelMask_Proxy
IWICStream_InitializeFromIStream_Proxy
IWICStream_InitializeFromMemory_Proxy
WICConvertBitmapSource
WICCreateBitmapFromSection
WICCreateBitmapFromSectionEx
WICCreateColorContext_Proxy
WICCreateImagingFactory_Proxy
WICGetMetadataContentSize
WICMapGuidToShortName
WICMapSchemaToName
WICMapShortNameToGuid
WICMatchMetadataContent
WICSerializeMetadataContent
WICSetEncoderFormat_Proxy

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RT_CODE
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 1024B - Virtual size: 853B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

55caa103ee7389b779eea2635ecf9dd1

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ole32

ntdll

rpcrt4

kernel32

advapi32

user32

gdi32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

RT_CODE Size: 2KB - Virtual size: 2KB

.orpc Size: 1024B - Virtual size: 853B

.data Size: 12KB - Virtual size: 15KB

.pdata Size: 38KB - Virtual size: 37KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 1.3MB - Virtual size: 1.3MB

RT_CODE
Size: 2KB - Virtual size: 2KB

.orpc
Size: 1024B - Virtual size: 853B

.data
Size: 12KB - Virtual size: 15KB

.pdata
Size: 38KB - Virtual size: 37KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 22KB - Virtual size: 21KB