NEAS[.]38884faaa49c66361301aa645566da20[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.38884faaa49c66361301aa645566da20.exe
Size

188KB
MD5

38884faaa49c66361301aa645566da20
SHA1

fc60c377b94549a2127b19eedde4ef59af3b15f0
SHA256

3d2e6ff685f25163c93c11d3abb886a9912b30246603931a31292567dbd05210
SHA512

137a280eacf8269d27b728248f4bd1e5218a210f4e940da82ee736e37148a09226310fa5cc4a53be8cedf2fac03262b34f6d0bc705c392d431bf88c655dc2839
SSDEEP

3072:BGiW+q4KNpgLh/Jr8y4BOKUUCBh/7S/7xFsUX:Pirg1Aztctm/tKUX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.38884faaa49c66361301aa645566da20.exe

Files

NEAS.38884faaa49c66361301aa645566da20.exe
.exe windows:5 windows x86

e099a8a94c129a20c06844a575a0c343

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr90

fclose
printf
scanf
calloc
ceil
sprintf
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__FrameUnwindFilter
_encoded_null
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit

kernel32

LoadLibraryW
IsProcessorFeaturePresent
ReleaseSemaphore
SetLastError
LocalAlloc
GetTapeParameters
VirtualProtect
LocalFileTimeToFileTime
GetSystemTimes
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetFileSize
GetNativeSystemInfo
CompareFileTime
LoadLibraryA

user32

SetCursor
SetSystemCursor
AnimateWindow
LoadIconA
GetWindowTextLengthA
GetWindowContextHelpId
ShowWindow
SetMenuContextHelpId
CreateCaret
UpdateWindow

gdi32

SetPolyFillMode
EndPath
SetWinMetaFileBits
CreateCompatibleDC
StretchBlt
GetPolyFillMode
FillPath
CreateDIBPatternBrush
GetPath
CreateEllipticRgn
CloseFigure
CreateDIBitmap

shell32

DragFinish
ShellExecuteW

msimg32

TransparentBlt
AlphaBlend

comctl32

ord6

winhttp

WinHttpOpenRequest
WinHttpConnect

msvcp90

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_F?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ

msvcm90

?ThrowNestedModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVException@System@@0@Z
?DoDllLanguageSupportValidation@<CrtImplementationDetails>@@YAXXZ
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@P$AAVException@3@@Z
?DoCallBackInDefaultDomain@<CrtImplementationDetails>@@YAXP6GJPAX@Z0@Z
?RegisterModuleUninitializer@<CrtImplementationDetails>@@YAXP$AAVEventHandler@System@@@Z
?ThrowModuleLoadException@<CrtImplementationDetails>@@YAXP$AAVString@System@@@Z

mscoree

_CorExeMain

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.zehogo
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.batula
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e099a8a94c129a20c06844a575a0c343

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

kernel32

user32

gdi32

shell32

msimg32

comctl32

winhttp

msvcp90

msvcm90

mscoree

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 83KB - Virtual size: 83KB

.data Size: 512B - Virtual size: 70KB

.zehogo Size: 512B - Virtual size: 10B

.batula Size: 512B - Virtual size: 100B

.rsrc Size: 95KB - Virtual size: 95KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 83KB - Virtual size: 83KB

.data
Size: 512B - Virtual size: 70KB

.zehogo
Size: 512B - Virtual size: 10B

.batula
Size: 512B - Virtual size: 100B

.rsrc
Size: 95KB - Virtual size: 95KB