NEAS[.]05ee7faaabc1025cfe0373e2af6f3c20[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.05ee7faaabc1025cfe0373e2af6f3c20.exe
Size

63KB
MD5

05ee7faaabc1025cfe0373e2af6f3c20
SHA1

4d59a5aa8177719281c30f46b8dd7a117f03403a
SHA256

f2be0a322f7c31899c01d16a69b188972cc5b5ea242a9ad69ebc6a79d454ab9b
SHA512

c3ac36a9c1c4c2e19dcb14a15e58c23a77d39c81677615fb846798c5d04f5dac885048c5fefb96cec89befc33c90ad366742d0754d0e366e5a43362a8190da0f
SSDEEP

1536:kkr5H2HATolUZ7nSK8OHZ9rbIqdbWCvsNoE1viZEc90:5+ATGES2HZ9XIKbYjvi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.05ee7faaabc1025cfe0373e2af6f3c20.exe

Files

NEAS.05ee7faaabc1025cfe0373e2af6f3c20.exe
.exe windows:6 windows x86

f730ec6ce6a80c53ffd4969e380af011

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

LsaClose
LsaOpenPolicy
RegCloseKey
RegCreateKeyExW
RegConnectRegistryW
LsaQueryTrustedDomainInfoByName
RegEnumKeyExW
RegOpenKeyExW
RegEnumValueW
LsaFreeMemory
LsaQueryInformationPolicy
LsaStorePrivateData
LsaSetInformationPolicy
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
LsaSetTrustedDomainInfoByName

kernel32

lstrcmpiW
GetLastError
GetModuleHandleW
SetConsoleMode
GetConsoleMode
GetStdHandle
lstrlenW
FormatMessageW
LoadLibraryW
GetSystemDirectoryW
LocalFree
LocalAlloc
GetComputerNameW
SetComputerNameExW
lstrcmpW
SetLastError
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
InterlockedExchange
Sleep
InterlockedCompareExchange
OutputDebugStringA
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetModuleHandleA
SetThreadUILanguage
GetConsoleOutputCP
WideCharToMultiByte
GetProcessHeap
HeapAlloc
WriteFile
HeapFree
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter

msvcrt

mbtowc
__mb_cur_max
isleadbyte
_snprintf
_itoa
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
_isatty
_controlfp
?terminate@@YAXXZ
malloc
fprintf
_iob
memset
fgetws
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_XcptFilter
_exit
_cexit
__wgetmainargs
_errno
wcsncmp
wcsstr
wcstoul
exit
wcschr
realloc
_wcsdup
_vsnprintf
iswalpha
iswupper
getchar
_vsnwprintf
fwprintf
_wsetlocale
isspace
_wcsicmp
printf
memcpy
free

netapi32

NetServerGetInfo
NetApiBufferFree
DsGetDcNameW

ntdll

RtlCompareUnicodeString
RtlInitString
RtlInitUnicodeString
RtlUnwind

user32

LoadStringW

wldap32

ord34
ord26
ord27
ord30
ord156
ord146
ord170
ord73
ord13
ord50
ord211
ord41

secur32

LsaConnectUntrusted
LsaFreeReturnBuffer
LsaLookupAuthenticationPackage
LsaCallAuthenticationPackage

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

exmnyjy
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f730ec6ce6a80c53ffd4969e380af011

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

netapi32

ntdll

user32

wldap32

secur32

Sections

.text Size: 29KB - Virtual size: 29KB

.data Size: 2KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 29KB - Virtual size: 30KB

exmnyjy Size: - Virtual size: 4KB

.text
Size: 29KB - Virtual size: 29KB

.data
Size: 2KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 29KB - Virtual size: 30KB

exmnyjy
Size: - Virtual size: 4KB