NEAS[.]4f3cc32be8069e80f7780aa27fc55710_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4f3cc32be8069e80f7780aa27fc55710_JC.exe
Size

1.2MB
MD5

4f3cc32be8069e80f7780aa27fc55710
SHA1

a201bce10576706a8b32b53e9c51e3afe76ae1da
SHA256

e143361135dc4b2f8c1deb82b7b6b0206f12e7ec6039b6d16db130c4a6a7eb28
SHA512

933f5f39bca66281641be0139d1608bc1f98c3083d2079dab86749a15f5da86ea4e4a9ed1d9f552d546666050971c6b7aa431742d74ae95b124cc415d9d5cb38
SSDEEP

24576:TZEQi+PnaiCWOzfUrlwZFmQ7qYPa4D+hF5dzuInCzRMxMmABlNGwBcDDLxYQ:Q+PnaiCWOzfUrlwZFmQ77R6Dz1nIsLmQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4f3cc32be8069e80f7780aa27fc55710_JC.exe

Files

NEAS.4f3cc32be8069e80f7780aa27fc55710_JC.exe
.exe windows:6 windows x64

f5f78fbc0fd090bfe27a0fa5db8e141f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
LeaveCriticalSection
VirtualQueryEx
EnterCriticalSection
LocalFree
FormatMessageA
IsDebuggerPresent
MoveFileExA
SetLastError
GetCurrentProcess
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
Sleep
GetLastError
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
FreeLibrary
QueryPerformanceCounter
Process32First
WriteProcessMemory
OutputDebugStringA
TerminateProcess
GetTickCount
VerifyVersionInfoA
GetSystemDirectoryA
ReadProcessMemory
SleepEx
VirtualProtectEx
CreateThread
CloseHandle
Process32Next
CreateFileA
CreateToolhelp32Snapshot
OpenProcess

user32

RegisterClassExW
GetActiveWindow
UnregisterClassW
GetSystemMetrics
CreateWindowExW
DestroyWindow
GetWindowRect
DispatchMessageA
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
GetKeyState
UpdateWindow
PostQuitMessage
PeekMessageA
LoadIconA
TranslateMessage
SetLayeredWindowAttributes
MoveWindow
DefWindowProcW
ShowWindow
MessageBoxA
GetAsyncKeyState
GetWindowLongA
SetWindowLongA
SetWindowDisplayAffinity

ole32

CoInitialize
CoUninitialize
CoCreateInstance

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlCaptureContext
RtlVirtualUnwind
NtResumeProcess
NtRaiseHardError
RtlAdjustPrivilege
NtSuspendProcess
RtlLookupFunctionEntry

normaliz

IdnToAscii

wldap32

ord45
ord143
ord217
ord60
ord211
ord46
ord41
ord22
ord301
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord50

crypt32

CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertOpenStore
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertFreeCertificateChain
CryptStringToBinaryA
PFXImportCertStore
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertEnumCertificatesInStore

ws2_32

send
WSAGetLastError
setsockopt
bind
socket
WSASetLastError
WSAIoctl
WSAStartup
connect
WSACleanup
getpeername
ntohl
htons
gethostname
getsockname
sendto
accept
htonl
listen
ioctlsocket
closesocket
recv
recvfrom
freeaddrinfo
getsockopt
getaddrinfo
__WSAFDIsSet
select
ntohs

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
__current_exception
strchr
__C_specific_handler
strrchr
memset
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
_CxxThrowException
memchr
memcmp
memcpy
memmove

api-ms-win-crt-stdio-l1-1-0

fseek
_lseeki64
__stdio_common_vsprintf
_wfopen
fwrite
fread
fgets
__stdio_common_vsscanf
fclose
feof
fflush
fputs
fputc
__acrt_iob_func
_set_fmode
_open
_close
_write
_read
ftell
__p__commode
__stdio_common_vfprintf
fopen

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp
strspn
tolower
strpbrk
isupper
strcmp
strcspn
_strdup
strncpy

api-ms-win-crt-heap-l1-1-0

calloc
_msize
_callnewh
realloc
free
malloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_exit
_initterm_e
_register_thread_local_exe_atexit_callback
_errno
_initterm
_get_narrow_winmain_command_line
abort
_c_exit
__sys_nerr
_invalid_parameter_noinfo
exit
_invalid_parameter_noinfo_noreturn
_wassert
_set_app_type
_beginthreadex
_seh_filter_exe
strerror
_cexit
_resetstkoflw
_getpid
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
system

api-ms-win-crt-convert-l1-1-0

strtol
strtod
strtoll
strtoull
strtoul
atoi

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-math-l1-1-0

acosf
ceilf
sqrtf
sinf
__setusermatherr
cosf
fmodf
roundf
_dclass

api-ms-win-crt-time-l1-1-0

_gmtime64
_time64

api-ms-win-crt-filesystem-l1-1-0

_unlink
_stat64
_access
_fstat64

advapi32

ConvertSidToStringSidA
OpenProcessToken
CopySid
GetLengthSid
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
GetTokenInformation
IsValidSid

Sections

.text
Size: 673KB - Virtual size: 672KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 315KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f5f78fbc0fd090bfe27a0fa5db8e141f

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d3dcompiler_43

kernel32

user32

ole32

msvcp140

imm32

dwmapi

d3dx11_43

ntdll

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

advapi32

Sections

.text Size: 673KB - Virtual size: 672KB

.rdata Size: 171KB - Virtual size: 170KB

.data Size: 315KB - Virtual size: 319KB

.pdata Size: 28KB - Virtual size: 28KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 673KB - Virtual size: 672KB

.rdata
Size: 171KB - Virtual size: 170KB

.data
Size: 315KB - Virtual size: 319KB

.pdata
Size: 28KB - Virtual size: 28KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB