NEAS[.]dc2db04ca829cad7910ce71263f68c90[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.dc2db04ca829cad7910ce71263f68c90.exe
Size

321KB
MD5

dc2db04ca829cad7910ce71263f68c90
SHA1

2eac9f1543a6a4509eb0ed63a09da28d56dbe8e3
SHA256

eac26becf40b49bece6ac7c678f72a161905edea7351590953ddf6f3fe8a7ffd
SHA512

3afa71fe6a12760e91fc4188d65fb0707a3b3a100edc02f6c8aa7445733bbcf59eaf67fc27fa55d859f7cde205778b603d7e02ee9c7b6ba0fb86303f0b860a2d
SSDEEP

3072:djFcM+bSzWeAZctledkKf0f2OzenzQBOnF79BZJTzjBZhhWThjEmLibd2BV:hF7SzeAZcnDOYmQBOn7BZlBZhhsEmLi4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.dc2db04ca829cad7910ce71263f68c90.exe

Files

NEAS.dc2db04ca829cad7910ce71263f68c90.exe
.dll windows:10 windows x86

c26138bd60521e84f7415e55889d5173

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_aligned_malloc
memmove
??0exception@@QAE@ABQBDH@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
?terminate@@YAXXZ
_vsnprintf_s
_aligned_free
_CIsqrt
memset
_CIcos
??_V@YAXPAX@Z
_vsnwprintf
_purecall
??3@YAXPAX@Z
memcpy_s
__CxxFrameHandler3
__libm_sse2_sinf
_XcptFilter
_onexit
_callnewh
__dllonexit
_unlock
_lock
_except_handler4_common
_initterm
malloc
_CIsin
free
??0exception@@QAE@XZ
_amsg_exit
??0exception@@QAE@ABQBD@Z
_CxxThrowException
memcpy
??1type_info@@UAE@XZ
__libm_sse2_cosf
__libm_sse2_expf
__libm_sse2_powf
_ftol2

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls
GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
LeaveCriticalSection
EnterCriticalSection
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionEx
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSemaphore
WaitForSingleObject
ReleaseMutex
SetEvent
CreateEventExW
ResetEvent
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoTaskMemFree

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventSetInformation
EventRegister
EventUnregister
EventActivityIdControl

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
OutputDebugStringW
DebugBreak

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-wow64-l1-1-0

Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

GetFileSizeEx
SetFilePointer
CreateFileW
ReadFile

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile
CreateFileMappingW

rpcrt4

I_RpcBindingInqLocalClientPID
RpcImpersonateClient

api-ms-win-security-base-l1-1-0

RevertToSelf

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoInitialize
RoUninitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

Exports

Exports

s_RequestHrtfData

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c26138bd60521e84f7415e55889d5173

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-memory-l1-1-0

rpcrt4

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

Exports

Exports

Sections

.text Size: 292KB - Virtual size: 291KB

.data Size: 15KB - Virtual size: 16KB

.idata Size: 5KB - Virtual size: 5KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 292KB - Virtual size: 291KB

.data
Size: 15KB - Virtual size: 16KB

.idata
Size: 5KB - Virtual size: 5KB

.reloc
Size: 8KB - Virtual size: 7KB