NEAS[.]ccb4786c4998d195d51530ab11885360[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.ccb4786c4998d195d51530ab11885360.exe
Size

1.8MB
MD5

ccb4786c4998d195d51530ab11885360
SHA1

7648bc33259ade482a10708e71d03fb7a31352c8
SHA256

d6c23854716fbd3a49a4d364b6d4e0dc463663c83b26de50ff60ba7b390b1175
SHA512

8508608fbdf694a1e233ef55419c5e644c6d7434295d1ab7dca43c0e4aaecae68c2b92a272a230e5bd027f66de4b919d9e01878905cddcaaccb8e8e99e1231d8
SSDEEP

49152:4IM53x+C+N8WZWJSJAS5uNi4O8b8ITDnlXcLNiXicJFFRGNzj3:4L53x+xNMSeaudc7wRGpj3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ccb4786c4998d195d51530ab11885360.exe

Files

NEAS.ccb4786c4998d195d51530ab11885360.exe
.exe windows:5 windows x86

0f450aa7bee8cd671d75cce94f235151

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LockResource
FindResourceExW
GetProcessHeap
HeapSetInformation
CreateSemaphoreW
ReleaseSemaphore
GetTempPathW
AddAtomW
SetErrorMode
WideCharToMultiByte
MulDiv
GlobalUnlock
GlobalLock
OpenProcess
GetCurrentDirectoryW
GetSystemDirectoryW
FindFirstFileW
FindClose
lstrcmpW
lstrcmpA
LocalAlloc
GetCommandLineW
SetCurrentDirectoryW
SetDllDirectoryW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
LoadLibraryExW
lstrcmpiW
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetCurrentProcess
IsProcessInJob
ProcessIdToSessionId
QueryInformationJobObject
GetExitCodeProcess
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
RaiseException
InterlockedExchange
GetVersion
GetFileAttributesW
LoadLibraryW
GetModuleHandleA
LoadLibraryA
GetTickCount
GetVolumeInformationW
lstrlenW
SetNamedPipeHandleState
Sleep
OpenMutexW
DeleteCriticalSection
SetEvent
InterlockedPopEntrySList
InterlockedPushEntrySList
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
FlushFileBuffers
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetStdHandle
GetCurrentProcessId
CreateEventW
CreateNamedPipeW
LocalFree
ResetEvent
CreateThread
CloseHandle
InitializeCriticalSection
GetModuleHandleW
GetProcAddress
WaitForSingleObject
ConnectNamedPipe
ReadFile
WriteFile
DisconnectNamedPipe
CreateMutexW
CallNamedPipeW
GetLastError
WaitNamedPipeW
CreateFileW
GetVersionExW
LeaveCriticalSection
GlobalAlloc
WriteConsoleW
GetTimeZoneInformation
QueryPerformanceCounter
SetHandleCount
FreeEnvironmentStringsW
HeapSize
ExitProcess
IsValidCodePage
GetOEMCP
GetACP
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
GetCPInfo
LCMapStringW
VirtualAlloc
GetFullPathNameW
HeapReAlloc
InterlockedCompareExchange
GetNativeSystemInfo
ExpandEnvironmentStringsW
SetInformationJobObject
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetProcessId
DuplicateHandle
CreateProcessW
GetStdHandle
GetSystemInfo
TerminateProcess
ResumeThread
AssignProcessToJobObject
GetCurrentThreadId
IsDebuggerPresent
ReleaseMutex
DeleteFileW
SetFilePointer
GetLocaleInfoW
GetLongPathNameW
PostQueuedCompletionStatus
UnregisterWaitEx
TerminateJobObject
TerminateThread
GetQueuedCompletionStatus
RegisterWaitForSingleObject
CreateIoCompletionPort
WriteProcessMemory
VirtualAllocEx
VirtualQueryEx
MapViewOfFile
CreateFileMappingW
GetThreadContext
GetStartupInfoW
SignalObjectAndWait
VirtualFree
VirtualFreeEx
CreateJobObjectW
VirtualProtectEx
HeapAlloc
VirtualProtect
OpenEventW
SearchPathW
GetCurrentThread
UnmapViewOfFile
GetFileSize
GetDriveTypeW
GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW
DeviceIoControl
QueryDosDeviceW
DebugBreak
ExitThread
VirtualQuery
ReadProcessMemory
SuspendThread
WaitForMultipleObjects
GlobalFree
GetTempFileNameW
GlobalSize
GlobalAddAtomW
CreateActCtxW
GetFileType
GetSystemWindowsDirectoryW
MoveFileExW
GetExitCodeThread
GetEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
CreateDirectoryExW
QueueUserWorkItem
VerifyVersionInfoW
VerSetConditionMask
GetProfileStringW
GetProfileStringA
FindNextFileW
FlushInstructionCache
lstrlenA
GlobalHandle
GetStringTypeW
EncodePointer
DecodePointer
RtlUnwind
HeapFree
HeapCreate
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
EnterCriticalSection

user32

GetDC
ReleaseDC
RegisterClipboardFormatW
DispatchMessageW
PeekMessageW
TranslateMessage
MsgWaitForMultipleObjects
DdeDisconnect
DdeConnect
DdeCreateDataHandle
DdeAddData
SystemParametersInfoW
GetThreadDesktop
GetProcessWindowStation
CloseWindowStation
GetDesktopWindow
CreateWindowStationW
CreateDesktopW
GetUserObjectInformationW
PostThreadMessageW
GetActiveWindow
SetTimer
GetAsyncKeyState
UnregisterClassW
RegisterClassW
EnableWindow
SetWindowTextW
GetWindowInfo
EnumChildWindows
GetRawInputDeviceList
GetRawInputDeviceInfoW
SetWindowPos
GetWindowRect
GetWindowTextW
GetWindowTextLengthW
CreateIconFromResourceEx
UnhookWindowsHookEx
SetDlgItemTextW
SetWindowsHookExW
GetParent
GetClassNameW
FindWindowExW
DdeClientTransaction
SetActiveWindow
IsWindowEnabled
CloseWindow
GetClipboardFormatNameA
GetClipboardData
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
EnumClipboardFormats
CountClipboardFormats
GetClipboardFormatNameW
GetClipboardSequenceNumber
GetClipboardOwner
GetOpenClipboardWindow
GetClipboardViewer
LoadCursorW
LoadIconW
SetFocus
GetFocus
SendDlgItemMessageW
MoveWindow
GetClientRect
UpdateWindow
GetClassInfoExW
IsChild
GetMessageW
GetSysColor
ClientToScreen
ScreenToClient
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
ReleaseCapture
FillRect
CallWindowProcW
EndPaint
BeginPaint
DestroyAcceleratorTable
CreateAcceleratorTableW
IsDialogMessageW
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
SetCursor
LoadBitmapW
SetWindowContextHelpId
MapDialogRect
CreateDialogIndirectParamW
GetWindowDC
SetPropW
PostQuitMessage
GetPropW
UnregisterClassA
DdeGetData
EnumThreadWindows
SetForegroundWindow
IsWindowVisible
DdeInitializeW
DdeUninitialize
DdeFreeStringHandle
DdeCreateStringHandleW
DdeNameService
FindWindowA
RegisterWindowMessageA
SetWindowLongW
ShowWindow
SetProcessWindowStation
SetThreadDesktop
OpenInputDesktop
CloseDesktop
FindWindowW
DefWindowProcW
MessageBoxW
CreateWindowExW
RegisterClassExW
RegisterWindowMessageW
PostMessageW
DestroyWindow
EnumWindows
IsWindow
UserHandleGrantAccess
SetParent
GetWindowLongW
GetWindow
BringWindowToTop
GetSystemMetrics
GetForegroundWindow
EndDialog
GetDlgItem
AllowSetForegroundWindow
CharNextW
DialogBoxParamW
SendMessageW
GetGUIThreadInfo
GetWindowThreadProcessId
GetPriorityClipboardFormat

advapi32

CryptGenKey
GetSecurityInfo
SetEntriesInAclW
SetSecurityInfo
RegOpenKeyExA
GetTokenInformation
AllocateAndInitializeSid
OpenProcessToken
EqualSid
FreeSid
RegQueryValueExA
RegCreateKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumValueW
ConvertSidToStringSidW
RegDisablePredefinedCache
RevertToSelf
SetThreadToken
CreateProcessAsUserW
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
GetSecurityDescriptorSacl
DuplicateTokenEx
CreateRestrictedToken
DuplicateToken
LookupPrivilegeValueW
CopySid
CreateWellKnownSid
AccessCheck
MapGenericMask
GetNamedSecurityInfoW
OpenThreadToken
CheckTokenMembership
RegOpenKeyW
CryptGetProvParam
CryptSetProvParam
CryptGenRandom
CryptDecrypt
CryptHashData
CryptSignHashA
CryptSignHashW
CryptGetHashParam
CryptSetKeyParam
CryptAcquireContextA
CryptAcquireContextW
CryptImportKey
CryptGetUserKey
CryptCreateHash
CryptReleaseContext
CryptDestroyKey
CryptDestroyHash
RegFlushKey

shlwapi

ord219
PathRemoveBackslashW
PathAddBackslashW
PathCreateFromUrlW
PathFindFileNameW
UrlCanonicalizeW
PathIsUNCW
PathFindExtensionW
PathCombineW
PathIsDirectoryW
AssocQueryStringW
UrlGetPartW
PathIsRelativeW
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
SHDeleteKeyW
PathIsURLW
UrlIsW

Sections

.text
Size: 916KB - Virtual size: 915KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 628KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0f450aa7bee8cd671d75cce94f235151

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

Sections

.text Size: 916KB - Virtual size: 915KB

.rdata Size: 236KB - Virtual size: 236KB

.data Size: 16KB - Virtual size: 32KB

.rsrc Size: 82KB - Virtual size: 82KB

.reloc Size: 628KB - Virtual size: 632KB

.text
Size: 916KB - Virtual size: 915KB

.rdata
Size: 236KB - Virtual size: 236KB

.data
Size: 16KB - Virtual size: 32KB

.rsrc
Size: 82KB - Virtual size: 82KB

.reloc
Size: 628KB - Virtual size: 632KB