NEAS[.]260f2d49685767ce47d3aec23850f9d0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.260f2d49685767ce47d3aec23850f9d0.exe
Size

32KB
MD5

260f2d49685767ce47d3aec23850f9d0
SHA1

6328b2804661972572f669093e1749cf5dfb327f
SHA256

693b31df5aafa319cf4f86180a6bd708568ad50c872a63d7192f4be464658a0b
SHA512

1fec7a05fc214c2a528d830c02f3fbc6db913dbad49c70d1876119d36c9773ba3077f5e922485afed16009cf75b93511ad1d824f666509e4daaac949cb3ce010
SSDEEP

768:j6Ji9UdW6CjXTqEo7DHMpUkQFZLqnDdUm0ATyOaxA3h:jAi9UgcmUkQinDdUZAeOaix

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.260f2d49685767ce47d3aec23850f9d0.exe

Files

NEAS.260f2d49685767ce47d3aec23850f9d0.exe
.exe windows:5 windows x64

ca8c3948096d9616b9c54122dbd647c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

RtlLookupFunctionEntry
RtlCaptureContext
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
ProcessIdToSessionId
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
lstrlenW
CreateEventW
WaitForMultipleObjects
OutputDebugStringW
WaitForSingleObject
OpenProcess
GetCurrentThread
GetCurrentProcess
CloseHandle
TerminateProcess
SetErrorMode
CreateProcessW
SetEvent
lstrcpyW
GlobalAlloc
GlobalFree
SetConsoleCtrlHandler
GetModuleHandleW
GetLastError
GetProcAddress
Sleep
GetModuleFileNameW
AllocConsole
GetStdHandle
FormatMessageW
LocalFree
GetVersionExW
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime

user32

BroadcastSystemMessageW
RegisterClassW
CreateWindowExW
DefWindowProcW
DestroyWindow
RegisterWindowMessageW

advapi32

LsaClose
RegCreateKeyExW
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
LsaStorePrivateData
LsaOpenPolicy
LsaAddAccountRights
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
StartServiceW
RegDeleteValueW
OpenServiceW
ControlService
QueryServiceStatus
DeleteService
RegCreateKeyW
RegSetValueExW
RegCloseKey
OpenSCManagerW
CreateServiceW
ChangeServiceConfig2W
CloseServiceHandle
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetServiceStatus
GetUserNameW
IsValidSid
GetLengthSid
CopySid
LookupAccountNameW

msvcr90

memset
_purecall
??_V@YAXPEAX@Z
fwprintf
__iob_func
setvbuf
_fdopen
_open_osfhandle
wcscpy_s
wcscat_s
wcsrchr
wcsstr
__CxxFrameHandler3
_wcsdup
_wcsicmp
vswprintf_s
_wcslwr_s
??3@YAXPEAX@Z
wcsncat
_amsg_exit
__wgetmainargs
__C_specific_handler
_XcptFilter
_exit
_cexit
exit
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
_encode_pointer
__set_app_type
__crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
malloc
free
??_U@YAPEAX_K@Z

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 876B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ca8c3948096d9616b9c54122dbd647c7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

msvcr90

Sections

.text Size: 18KB - Virtual size: 17KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 876B

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 876B