NEAS[.]a9fba3049431ef63f5b451204f3bbe60[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.a9fba3049431ef63f5b451204f3bbe60.exe
Size

133KB
MD5

a9fba3049431ef63f5b451204f3bbe60
SHA1

222e1e5f6125fade7126704e561682f6812169d2
SHA256

7e3a8da3c73494bd08c402c8f3c257c601f3f1ed5d714d69ba03d5826c1aefd2
SHA512

57d5a31cb53bdf5923a26ab79cf12470d1b437a1435399c7309c40813ecd0e5f2e1882f9492c942dcd4ab0fa51fc8fe1de547fc976465d806de3758a35b1991b
SSDEEP

3072:YTLWqZEm1qbfi/oT3jjoUEWEqCYtxwV+OPaqlfVZbfZ:OL1ZEm1qb+m/fVGTf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a9fba3049431ef63f5b451204f3bbe60.exe

Files

NEAS.a9fba3049431ef63f5b451204f3bbe60.exe
.dll windows:6 windows x64

b32250da0d30f7782b5b900d4d9c519a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

strncpy
memmove
_vsnprintf_s
strncpy_s
malloc
_initterm
_amsg_exit
__C_specific_handler
memset
memcpy
strcpy_s
wcsstr
wcsrchr
wcschr
free
memcmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtAllocateLocallyUniqueId
RtlValidSid
NtQueryInformationToken
RtlInitString
NtDuplicateObject
RtlCompareUnicodeString
RtlDeleteResource
RtlInitializeResource
RtlGetNtProductType
RtlAcquireResourceShared
RtlReleaseResource
RtlAcquireResourceExclusive
RtlFreeHeap
RtlAllocateHeap
NtOpenThreadToken
NtQueryEvent
RtlDeleteCriticalSection
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlInitializeCriticalSection
DbgPrintEx
RtlCreateUnicodeStringFromAsciiz
RtlStringFromGUID
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlNtStatusToDosError
RtlxAnsiStringToUnicodeSize
RtlxUnicodeStringToAnsiSize
NlsMbCodePageTag
RtlNtStatusToDosErrorNoTeb
NtQueryInformationThread
RtlCopyUnicodeString
RtlCopySid
RtlLengthSid
NtSetInformationThread
NtOpenThreadTokenEx
NtClose
NtWaitForSingleObject
NtOpenEvent
RtlInitUnicodeString
NtFreeVirtualMemory

rpcrt4

NdrServerCallAll
NdrServerCall2
NdrClientCall3
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcSsDestroyClientContext
I_RpcExceptionFilter
RpcBindingFree
RpcBindingUnbind
I_RpcMapWin32Status

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileTime

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-1-0

FreeLibrary
GetModuleFileNameW
LoadLibraryExA
DisableThreadLibraryCalls
LoadLibraryExW
GetProcAddress

api-ms-win-core-localregistry-l1-1-0

RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyExW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegQueryValueExA
RegOpenKeyExA

api-ms-win-core-misc-l1-1-0

LocalAlloc
LocalFree
LocalReAlloc
lstrlenA
Sleep

api-ms-win-core-processthreads-l1-1-0

TlsFree
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentThread
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AcceptSecurityContext
AcquireCredentialsHandleA
AcquireCredentialsHandleW
AddCredentialsA
AddCredentialsW
AddSecurityPackageA
AddSecurityPackageW
ApplyControlToken
ChangeAccountPasswordA
ChangeAccountPasswordW
CompleteAuthToken
CredMarshalTargetInfo
CredUnmarshalTargetInfo
DecryptMessage
DeleteSecurityContext
DeleteSecurityPackageA
DeleteSecurityPackageW
EncryptMessage
EnumerateSecurityPackagesA
EnumerateSecurityPackagesW
ExportSecurityContext
FreeContextBuffer
FreeCredentialsHandle
GetSecurityUserInfo
GetUserNameExA
GetUserNameExW
ImpersonateSecurityContext
ImportSecurityContextA
ImportSecurityContextW
InitSecurityInterfaceA
InitSecurityInterfaceW
InitializeSecurityContextA
InitializeSecurityContextW
LogonUserExExW
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaEnumerateLogonSessions
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaLogonUser
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess
LsaRegisterPolicyChangeNotification
LsaUnregisterPolicyChangeNotification
MakeSignature
QueryContextAttributesA
QueryContextAttributesW
QueryCredentialsAttributesA
QueryCredentialsAttributesW
QuerySecurityContextToken
QuerySecurityPackageInfoA
QuerySecurityPackageInfoW
RevertSecurityContext
SaslAcceptSecurityContext
SaslEnumerateProfilesA
SaslEnumerateProfilesW
SaslGetContextOption
SaslGetProfilePackageA
SaslGetProfilePackageW
SaslIdentifyPackageA
SaslIdentifyPackageW
SaslInitializeSecurityContextA
SaslInitializeSecurityContextW
SaslSetContextOption
SealMessage
SecCacheSspiPackages
SecDeleteUserModeContext
SecInitUserModeContext
SeciAllocateAndSetCallFlags
SeciAllocateAndSetIPAddress
SeciFreeCallContext
SetContextAttributesA
SetContextAttributesW
SetCredentialsAttributesA
SetCredentialsAttributesW
SspiCompareAuthIdentities
SspiCopyAuthIdentity
SspiDecryptAuthIdentity
SspiEncodeAuthIdentityAsStrings
SspiEncodeStringsAsAuthIdentity
SspiEncryptAuthIdentity
SspiExcludePackage
SspiFreeAuthIdentity
SspiGetComputerNameForSPN
SspiGetTargetHostName
SspiIsAuthIdentityEncrypted
SspiLocalFree
SspiMarshalAuthIdentity
SspiPrepareForCredRead
SspiPrepareForCredWrite
SspiUnmarshalAuthIdentity
SspiUnmarshalAuthIdentityInternal
SspiValidateAuthIdentity
SspiZeroAuthIdentity
UnsealMessage
VerifySignature

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b32250da0d30f7782b5b900d4d9c519a

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

rpcrt4

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 91KB - Virtual size: 90KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 4KB - Virtual size: 4KB

.pdata Size: 5KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 788B

.text
Size: 91KB - Virtual size: 90KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 4KB - Virtual size: 4KB

.pdata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 788B