NEAS[.]0acf6c0d2b80aaa15830fa711123dc70_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0acf6c0d2b80aaa15830fa711123dc70_JC.exe
Size

1020KB
MD5

0acf6c0d2b80aaa15830fa711123dc70
SHA1

3dcbf1b7e5abe712d3453471167ca362ef5ebaea
SHA256

c167c97b8cef48a45874605162270b04f4d7c1c736ecd37a0c45e0e0e6a9d7a5
SHA512

00f5084673475aebfbb6fffd8b9b5b79fa65393d52c37f2ecc9dec2d3ea4ca935349cbff2c0629a1adb75472e8a2ae69e70b30be075ddb6a6b6ea93c479a4415
SSDEEP

24576:aR9lt7gaw0KkRgwhnm5SU+DVavxJxG4W07U:87ga5hDU+cvxJM4W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0acf6c0d2b80aaa15830fa711123dc70_JC.exe

Files

NEAS.0acf6c0d2b80aaa15830fa711123dc70_JC.exe
.dll windows:4 windows x86

9394ebe889b41f2b992fdea0721f3dcd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wfstreamrder

ord4
ord1
ord2
ord7

kernel32

FormatMessageW
SetEvent
ResetEvent
GetTickCount
ReleaseSemaphore
SetLastError
GetLocalTime
WaitForMultipleObjects
Sleep
GetCurrentThreadId
GetLastError
WideCharToMultiByte
MultiByteToWideChar
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
TerminateThread
InterlockedExchange
GetModuleHandleA
WaitForSingleObject
CloseHandle
CreateThread
GetProcAddress
FreeLibrary
LoadLibraryA
GetModuleFileNameA
CreateDirectoryA
GetSystemInfo
CreateSemaphoreA
ExitThread
CreateMutexA
QueryPerformanceFrequency
GetCurrentThread
LocalFree
CreateEventA
SetThreadAffinityMask
GetSystemDirectoryA
TlsGetValue
TlsFree
OpenThread
TlsAlloc
CreateEventW
TlsSetValue
ReleaseMutex
CreateMutexW
InterlockedIncrement
InterlockedDecrement
PostQueuedCompletionStatus
GetQueuedCompletionStatus
OutputDebugStringA
CreateIoCompletionPort
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess

ws2_32

accept
WSAStartup
shutdown
gethostname
ntohs
WSARecv
WSARecvFrom
WSASend
WSAGetLastError
WSASendTo
WSACleanup
getsockopt
gethostbyaddr
recvfrom
listen
bind
closesocket
connect
ntohl
gethostbyname
htons
inet_addr
htonl
select
recv
send
__WSAFDIsSet
socket
inet_ntoa
sendto
getsockname
ioctlsocket
getservbyport
WSASetLastError
setsockopt
getservbyname

winmm

timeBeginPeriod

iphlpapi

GetAdaptersInfo

msvcr80

??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
_time64
_mktime64
malloc
_strlwr
free
calloc
fgetpos
fseek
fwrite
fopen
fclose
strncpy
strstr
fflush
_snprintf
memmove
_purecall
fread
printf
strcmp
__CxxFrameHandler3
_CIlog10
_stricmp
strcpy
memset
strchr
sprintf_s
memcpy
__CxxFrameHandler
strncmp
_vsnprintf
fputs
__iob_func
_errno
_itoa
_access
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??_V@YAXPAX@Z
_localtime64
??3@YAXPAX@Z
atoi
memchr
sprintf
sscanf
memmove_s
??2@YAPAXI@Z
_invalid_parameter_noinfo
rand
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
srand
strcspn
strncpy_s
localeconv
strtoul
strcat_s
ceil
strcpy_s
_ftol
_mktime32
_localtime32
_CIpow
memcpy_s
_CxxThrowException

msvcp80

?_Unlock@_Mutex@std@@QAEXXZ
??0_Lockit@std@@QAE@H@Z
_Getcvt
?uncaught_exception@std@@YA_NXZ
?_Lock@_Mutex@std@@QAEXXZ
_Toupper
??1_Lockit@std@@QAE@XZ
??1_Mutex@std@@QAE@XZ
??0_Mutex@std@@QAE@XZ
?facet_Register@facet@locale@std@@CAXPAV123@@Z
_Tolower
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
_Getctype
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z
?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z

Exports

Exports

H264_DVR_CatchPic
H264_DVR_CatchPicInBuffer
H264_DVR_CatchPicUI
H264_DVR_CheckEncrypt
H264_DVR_Cleanup
H264_DVR_ClickKey
H264_DVR_CloseAlarmChan
H264_DVR_CloseSound
H264_DVR_CloseTransComChannel
H264_DVR_CloseUpgradeHandle
H264_DVR_ControlAudio
H264_DVR_ControlDVR
H264_DVR_ControlFile
H264_DVR_DelRealDataCallBack
H264_DVR_DelRealDataCallBack_V2
H264_DVR_FindAudioFile
H264_DVR_FindDVRLog
H264_DVR_FindFile
H264_DVR_FindFileByTime
H264_DVR_GetDDNSInfo
H264_DVR_GetDVRWorkState
H264_DVR_GetDevConfig
H264_DVR_GetDownloadPos
H264_DVR_GetFileByName
H264_DVR_GetFileByTime
H264_DVR_GetLastError
H264_DVR_GetOEMInfo
H264_DVR_GetPlayPos
H264_DVR_GetUpgradeState
H264_DVR_Init
H264_DVR_LocalCatchPic
H264_DVR_LocalGetColor
H264_DVR_LocalPlayCtrl
H264_DVR_LocalSetColor
H264_DVR_Login
H264_DVR_LoginEx
H264_DVR_Logout
H264_DVR_MakeKeyFrame
H264_DVR_OpenSound
H264_DVR_OpenTransComChannel
H264_DVR_PTZControl
H264_DVR_PTZControlEx
H264_DVR_PTZPostion
H264_DVR_PauseRealPlay
H264_DVR_PlayBackByName
H264_DVR_PlayBackByName_V2
H264_DVR_PlayBackByTime
H264_DVR_PlayBackByTimeEx
H264_DVR_PlayBackControl
H264_DVR_RealPlay
H264_DVR_RecordInfo
H264_DVR_SearchDevice
H264_DVR_SearchDeviceEX
H264_DVR_SendNetAlarmMsg
H264_DVR_SerialRead
H264_DVR_SerialWrite
H264_DVR_SetConfigOverNet
H264_DVR_SetConnectTime
H264_DVR_SetDVRMessCallBack
H264_DVR_SetDevConfig
H264_DVR_SetFileEndCallBack
H264_DVR_SetInfoFrameCallBack
H264_DVR_SetKeepLifeTime
H264_DVR_SetLocalBindAddress
H264_DVR_SetPlayPos
H264_DVR_SetRealDataCallBack
H264_DVR_SetRealDataCallBack_V2
H264_DVR_SetSubDisconnectCallBack
H264_DVR_SetSystemDateTime
H264_DVR_SetTalkMode
H264_DVR_SetupAlarmChan
H264_DVR_StartActiveRigister
H264_DVR_StartAlarmCenterListen
H264_DVR_StartDVRRecord
H264_DVR_StartDevTalk
H264_DVR_StartLocalPlay
H264_DVR_StartLocalRecord
H264_DVR_StartLocalVoiceCom
H264_DVR_StartUploadData
H264_DVR_StartVoiceCom_MR
H264_DVR_StopActiveRigister
H264_DVR_StopAlarmCenterListen
H264_DVR_StopDVRRecord
H264_DVR_StopDevTalk
H264_DVR_StopGetFile
H264_DVR_StopLocalPlay
H264_DVR_StopLocalRecord
H264_DVR_StopPlayBack
H264_DVR_StopRealPlay
H264_DVR_StopUploadData
H264_DVR_StopVoiceCom
H264_DVR_StorageManage
H264_DVR_Upgrade
H264_DVR_UserData
H264_DVR_VoiceComSendData

Sections

.text
Size: 756KB - Virtual size: 755KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9394ebe889b41f2b992fdea0721f3dcd

Headers

File Characteristics

Imports

wfstreamrder

kernel32

ws2_32

winmm

iphlpapi

msvcr80

msvcp80

Exports

Exports

Sections

.text Size: 756KB - Virtual size: 755KB

.rdata Size: 96KB - Virtual size: 95KB

.data Size: 24KB - Virtual size: 26KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 48KB - Virtual size: 46KB

.rmnet Size: 88KB - Virtual size: 88KB

.text
Size: 756KB - Virtual size: 755KB

.rdata
Size: 96KB - Virtual size: 95KB

.data
Size: 24KB - Virtual size: 26KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 48KB - Virtual size: 46KB

.rmnet
Size: 88KB - Virtual size: 88KB