NEAS[.]adb0970db7d2115d346c2682fecaa350[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.adb0970db7d2115d346c2682fecaa350.exe
Size

2.6MB
MD5

adb0970db7d2115d346c2682fecaa350
SHA1

2a74872aa913bc1d7d02a0dcb40b164c6df568fe
SHA256

690ca7d3abab2667abede18f7777e0976982c7d2d17edaec1d8cdd1639bece4c
SHA512

fe586424ba1fcb6451b611d9afb428b56cd639df9e4af98c4732446bc990119cb03d91fd58250f6aa181f6c93584d09aa8d2292ad2c343aeb4b4e0893602f8f3
SSDEEP

49152:UzKz1pkqyzb5nfkGmGmGmGmGmGmYcl7zteU5YQ7fKVk5XZn:XKqyZ0F1zn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.adb0970db7d2115d346c2682fecaa350.exe

Files

NEAS.adb0970db7d2115d346c2682fecaa350.exe
.dll windows:6 windows x64

a03488aca6280525ffb1930a78c1e109

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

user32

GetPropW
CallNextHookEx
SetWindowsHookExW
SetDlgItemInt
ScreenToClient
SetScrollRange
SetScrollPos
GetScrollPos
DrawIconEx
GetSysColorBrush
EnumChildWindows
ClientToScreen
GetWindow
DestroyWindow
GetDlgItemInt
DrawFocusRect
CreateDialogParamW
DestroyIcon
IsChild
InflateRect
GetWindowTextLengthW
MessageBoxW
DrawTextW
LoadStringW
WaitForInputIdle
wsprintfA
GetForegroundWindow
GetWindowThreadProcessId
EnumWindows
DialogBoxParamW
SetPropW
UnhookWindowsHookEx
RemovePropW
IsWindowVisible
GetActiveWindow
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowPos
SetActiveWindow
LoadBitmapW
GetNextDlgTabItem
SystemParametersInfoW
GetWindowTextW
GetClassNameW
GetDesktopWindow
DestroyMenu
TrackPopupMenu
GetSubMenu
MapDialogRect
GetCursorPos
ReleaseDC
GetDC
InSendMessage
GetComboBoxInfo
FrameRect
GetWindowLongW
SetRectEmpty
SetTimer
CallWindowProcW
CheckRadioButton
SetRect
CheckDlgButton
KillTimer
IsDlgButtonChecked
SetCapture
ShowCursor
LoadCursorW
SetCursor
ReleaseCapture
SetWindowTextW
PtInRect
GetKeyState
CopyRect
FillRect
GetSysColor
LoadImageW
ShowWindow
IsWindow
IsWindowEnabled
CreateWindowExW
GetTopWindow
SetDlgItemTextA
GetDlgItemTextA
GetSystemMenu
GetDlgCtrlID
SetFocus
GetFocus
InvalidateRect
SendDlgItemMessageW
PostMessageW
EnableWindow
SendMessageW
CharUpperBuffW
GetDlgItemTextW
SetDlgItemTextW
GetDlgItem
GetParent
MoveWindow
GetSystemMetrics
EndDialog
GetWindowRect
GetClientRect
MapWindowPoints
EnableMenuItem
LoadMenuW
wsprintfW

kernel32

InitializeCriticalSectionAndSpinCount
GetCPInfo
GetOEMCP
Sleep
SetFilePointer
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
ExpandEnvironmentStringsA
LocalFree
CreateThread
IsValidLocale
IsValidCodePage
InitializeCriticalSection
lstrcpynA
VerifyVersionInfoW
VerSetConditionMask
FreeResource
ExitThread
GetPrivateProfileStructW
WritePrivateProfileStringA
GlobalDeleteAtom
FileTimeToLocalFileTime
GetFileTime
FileTimeToSystemTime
GetUserDefaultLangID
GlobalReAlloc
GlobalSize
FindNextFileW
RemoveDirectoryW
SystemTimeToFileTime
WritePrivateProfileSectionW
GetPrivateProfileSectionW
GetSystemWow64DirectoryW
GetPrivateProfileSectionNamesW
lstrcpyA
ReadFile
SetFileTime
lstrcmpA
GetLocaleInfoW
FlushFileBuffers
WriteConsoleW
SetStdHandle
LCMapStringW
SetLastError
DeactivateActCtx
GetLastError
LoadLibraryW
ActivateActCtx
FindActCtxSectionStringW
CreateActCtxW
GetModuleFileNameW
GetModuleHandleExW
QueryActCtxW
OutputDebugStringA
FreeLibrary
HeapCreate
HeapAlloc
HeapDestroy
lstrcpyW
GetComputerNameW
lstrcpynW
GetACP
GetProcessHeap
HeapFree
LoadLibraryA
GetProcAddress
GlobalAlloc
GlobalFree
CopyFileW
SetFileAttributesW
lstrcatW
GetWindowsDirectoryA
CreateDirectoryExW
lstrcmpW
lstrlenW
GetSystemDirectoryW
GetPrivateProfileIntW
GetVersionExW
FindFirstFileW
FindClose
CreateDirectoryW
MulDiv
SizeofResource
LockResource
LoadResource
FindResourceW
GetVersion
GlobalUnlock
WritePrivateProfileStringW
GetPrivateProfileStringW
CreateFileW
WriteFile
CloseHandle
lstrcmpiW
GetTempPathW
CreateProcessW
MapViewOfFile
UnmapViewOfFile
GetWindowsDirectoryW
SetEnvironmentVariableW
OpenFileMappingW
CreateFileMappingW
SetEnvironmentVariableA
GetEnvironmentVariableW
GetCurrentProcessId
GlobalFindAtomW
GlobalAddAtomW
GetTempFileNameW
MoveFileW
lstrcmpiA
GetLocalTime
GlobalLock
ProcessIdToSessionId
DeleteFileW
HeapReAlloc
HeapSize
MultiByteToWideChar
WideCharToMultiByte
RaiseException
lstrlenA
FlsSetValue
GetCommandLineA
VirtualProtect
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetModuleHandleW
ExitProcess
EncodePointer
DecodePointer
FlsFree
FlsGetValue
GetCurrentThreadId
EnterCriticalSection
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
LeaveCriticalSection
GetStringTypeW

winspool.drv

DeleteFormW
ClosePrinter
GetPrinterW
SetPrinterDataW
AddFormW
GetPrinterDataW
OpenPrinterW
SetPrinterDataExW
DocumentPropertiesW
DeletePrinterKeyW
GetPrinterDataExW
EndPagePrinter
WritePrinter
EndDocPrinter
StartPagePrinter
StartDocPrinterW
EnumFormsW
GetPrinterDriverW

gdi32

SetBkColor
SetMapMode
CreateBitmap
DeleteDC
StretchBlt
CreateCompatibleBitmap
GetLayout
MoveToEx
CreateSolidBrush
GetObjectW
GetStockObject
BitBlt
SelectObject
GetBitmapDimensionEx
CreateCompatibleDC
GetDeviceCaps
CreateFontW
GetMapMode
DeleteObject
GetTextFaceW
EnumFontFamiliesW
SetStretchBltMode
GetTextMetricsW
ExtTextOutW
CreatePenIndirect
CreateRectRgnIndirect
SetSystemPaletteUse
ExtCreatePen
CreatePalette
StretchDIBits
RealizePalette
SelectPalette
SetBkMode
SetTextColor
GetTextExtentPoint32W
CreateFontIndirectW
LineTo
CreatePen

shell32

SHGetFolderPathW
ExtractIconW
ShellExecuteW
SHGetFolderPathA

advapi32

GetTraceLoggerHandle
GetTraceEnableFlags
RegisterTraceGuidsW
RegQueryValueExA
RegOpenKeyExA
UnregisterTraceGuids
GetUserNameW
LookupAccountNameW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetFileSecurityW
RegDeleteValueW
RegSetKeySecurity
CreateProcessAsUserW
GetTraceEnableLevel

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

spoolss

RevertToPrinterSelf
ImpersonatePrinterClient

ole32

CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree

ntdll

RtlMultiByteToUnicodeN
RtlUnicodeToMultiByteN

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
VarBstrCat
VarBstrCmp
SysAllocStringLen
VariantChangeType
GetErrorInfo

gdiplus

GdipFree
GdipAlloc
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetInterpolationMode
GdipDrawImageRectRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImageVerticalResolution
GdipGetImageRawFormat
GdipCreateBitmapFromFile
GdiplusStartup
GdiplusShutdown

shlwapi

PathIsDirectoryW
PathFileExistsW

Exports

Exports

BRMD_OpenDialog
BRMD_OpenDuplexDialog
DevQueryPrintEx
DllCanUnloadNow
DllGetClassObject
DllMain
DrvConvertDevMode
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentPropertySheets
DrvDriverEvent
DrvPopulateFilterServices
DrvPrinterEvent
DrvSplDeviceCaps
DrvUpgradePrinter
MxdcGetPDEVAdjustment
PTPCConvertDevModeToPrintTicket
PTPCConvertPrintTicketToDevMode
PTPCGetPrintCapabilities
PTPCValidatePrintTicket
PrinterProperties

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 275KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a03488aca6280525ffb1930a78c1e109

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

winspool.drv

gdi32

shell32

advapi32

version

spoolss

ole32

ntdll

oleaut32

gdiplus

shlwapi

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.data Size: 275KB - Virtual size: 292KB

.pdata Size: 117KB - Virtual size: 117KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.data
Size: 275KB - Virtual size: 292KB

.pdata
Size: 117KB - Virtual size: 117KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 29KB - Virtual size: 28KB