NEAS[.]05ec5391182a1de154e937a9b4197380[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.05ec5391182a1de154e937a9b4197380.exe
Size

492KB
MD5

05ec5391182a1de154e937a9b4197380
SHA1

4671891dc9e5af3c69a77fac071fb8289f49d807
SHA256

280c95f2c0d5413f116d5bc2e615cd4c968c832d45f7576fcfaff529f882b948
SHA512

c0ef4fea3857c2cfccfa81a05cfe583b1ad521953e114ef5a5578c9dd7bd4ca287bad65cced56810b8d032db43314c0f5b5968fd0d6d920ee079013dca5a72be
SSDEEP

6144:KXcGb0kowV8RKdPlQ9FmIhzVxWQ6vd8oWWrsCUDCqJckBA1g13cldJmNmds40k:i/0k6e9Ca6j3mcckyA3I/mNms40k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.05ec5391182a1de154e937a9b4197380.exe

Files

NEAS.05ec5391182a1de154e937a9b4197380.exe
.dll windows:4 windows x86

9e2e10ca3264dab3cdffa2f2f228fa24

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

select
recv
send
ioctlsocket
connect
getsockopt
__WSAFDIsSet
shutdown
WSACleanup
getservbyport
gethostbyaddr
getservbyname
inet_addr
WSASetLastError
htonl
WSAStartup
gethostname
gethostbyname
inet_ntoa
socket
setsockopt
bind
closesocket
ntohs
WSAGetLastError
ntohl
htons

kernel32

CompareStringW
CompareStringA
CloseHandle
CreateFileA
GetLastError
ReadFile
WriteFile
SetFilePointer
GetModuleFileNameA
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
GetDiskFreeSpaceExA
DeleteFileA
FindClose
FindFirstFileA
GetLocaleInfoW
Sleep
SetEndOfFile
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
CreateSemaphoreA
GetLocalTime
ReleaseSemaphore
GetCurrentProcess
GetCurrentThreadId
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
GetStringTypeW
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
UnhandledExceptionFilter
GetEnvironmentStringsW
OutputDebugStringA
GetEnvironmentStrings
CreateDirectoryA
FindNextFileA
WaitForSingleObject
GetFileInformationByHandle
GetFileType
FlushFileBuffers
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
LCMapStringW
LCMapStringA
IsBadWritePtr
VirtualAlloc
VirtualFree
SetEnvironmentVariableA
GetTickCount
GetTimeZoneInformation
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
HeapSize
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
SetLastError
GetFileAttributesA
ExitThread
CreateThread
GetVersion
GetCommandLineA
HeapReAlloc
RtlUnwind
HeapAlloc
HeapFree
RaiseException
GetSystemTime
ExitProcess
TerminateProcess

advapi32

GetSecurityInfo

user32

InvalidateRect
GetClientRect
ShowWindow

Exports

Exports

NS_AudioPlayPasue
NS_AudioPlayResume
NS_BMPCapture
NS_ChangeRange
NS_CloseSound
NS_D3DCapture
NS_Decrypt
NS_Download
NS_EnableIVS
NS_Encrypt
NS_ExportDeviceConfig
NS_ExportDeviceLog
NS_ExportFile
NS_ExportReport
NS_FECRigisterDrawFun
NS_FEC_CapturePIC
NS_FEC_GetParam
NS_FEC_GetSpecialViewParam
NS_FEC_GetViewParam
NS_FEC_IsInFinshDraw
NS_FEC_PTZ2WindowEx
NS_FEC_Play
NS_FEC_Set3DModelParam
NS_FEC_SetCorrectEffect
NS_FEC_SetDisplayRegion
NS_FEC_SetDrawType
NS_FEC_SetFinshDraw
NS_FEC_SetViewParam
NS_FEC_TestScan
NS_FEC_UpDateParam
NS_Fast
NS_FiniLib
NS_FrameForward
NS_GetAudioPlayedTime
NS_GetAudioVolume
NS_GetDownLoadFiles
NS_GetDownloadStatus
NS_GetEngineSupport
NS_GetFormUploadErrorInfo
NS_GetHTTPErrorInfo
NS_GetIpcImportErrorInfo
NS_GetLastError
NS_GetNetworkInfo
NS_GetOSDTime
NS_GetPictureSize
NS_GetPlayedTime
NS_GetRecordFileSize
NS_GetScale
NS_GetSycVAStatus
NS_GetUploadErrorInfo
NS_GetVolume
NS_ImportDeviceConfig
NS_InitLib
NS_JPEGCapture
NS_OpenSound
NS_Pause
NS_Play
NS_Play_V20
NS_RefreshPlay
NS_RegAdditionFun
NS_RenderPrivateDataEx
NS_ResetPlayWnd
NS_Resume
NS_ReversePlay
NS_RigisterAudioDrawFun
NS_RigisterDrawFun
NS_SR_Rotate
NS_SendHttpSynRequest
NS_SetAudioPlayStatus
NS_SetAudioVolume
NS_SetDVRMessageCallBack
NS_SetDisplayBuf
NS_SetDisplayCallBack
NS_SetDisplayRegion
NS_SetFishMsgCallBack
NS_SetHttpRequestCallBack
NS_SetLocalAlarmPicLoacation
NS_SetMessageHandler
NS_SetOverlayPriInfoFlag
NS_SetPicInfoToPlayer
NS_SetPicOrRegionFillPara
NS_SetReconnectInfo
NS_SetSecretKey
NS_SetTrackDurationTime
NS_SetVoiceAdditionDataCallBack
NS_SetVoiceMsgCallBack
NS_SetVolume
NS_Slow
NS_StartAlarmChan
NS_StartAsynUpload
NS_StartAudioPlay
NS_StartAudioRecord
NS_StartDownload
NS_StartDownloadEx
NS_StartFishListener
NS_StartFormAsynUpload
NS_StartSave
NS_StartSycAudioPlay
NS_StartUpgrade
NS_StartVoiceTalk
NS_Stop
NS_StopAlarmChan
NS_StopAsynUpload
NS_StopAudioPlay
NS_StopAudioRecord
NS_StopDownload
NS_StopFishListener
NS_StopFormAsynUpload
NS_StopHttpRequest
NS_StopSave
NS_StopSycAudioPlay
NS_StopSycVAFiles
NS_StopUpgrade
NS_StopVoiceTalk
NS_SubmitHttpRequest
NS_SwitchFile
NS_SycVideoAndAudioFiles
NS_USB_GetDeviceSerial
NS_USB_LoginDefaultDevice
NS_USB_LogoutDevice
NS_UpgradeStatus
NS_Upload

Sections

.text
Size: 332KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e2e10ca3264dab3cdffa2f2f228fa24

Headers

File Characteristics

Imports

ws2_32

kernel32

advapi32

user32

Exports

Exports

Sections

.text Size: 332KB - Virtual size: 328KB

.rdata Size: 52KB - Virtual size: 48KB

.data Size: 72KB - Virtual size: 1.4MB

.rsrc Size: 4KB - Virtual size: 784B

.reloc Size: 28KB - Virtual size: 27KB

.text
Size: 332KB - Virtual size: 328KB

.rdata
Size: 52KB - Virtual size: 48KB

.data
Size: 72KB - Virtual size: 1.4MB

.rsrc
Size: 4KB - Virtual size: 784B

.reloc
Size: 28KB - Virtual size: 27KB