NEAS[.]906b3ed1ce0927a95deedaeccbe90710[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.906b3ed1ce0927a95deedaeccbe90710.exe
Size

66KB
MD5

906b3ed1ce0927a95deedaeccbe90710
SHA1

55625002bacc25f523c2f8b47a99c9593b447e14
SHA256

0b650aa8acd4741273ba5a3547ee5d759fd5a73a43a9045569b54aa47477df1a
SHA512

de63a46d7c897a40041adaad0ebce4aaf9b1db2abf333e1642be07c62cc30a367fdde7f117708db54b503de008cfd927b93725a4bf0ce22a89223712e57464c2
SSDEEP

1536:/kYgyFk47OTkcAxomUcVGP4NUdJ8RH4B:jcPxiGP4NUdCRHO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.906b3ed1ce0927a95deedaeccbe90710.exe

Files

NEAS.906b3ed1ce0927a95deedaeccbe90710.exe
.dll windows:10 windows x64

7de0526d6e672de836f38a1d0520bbb4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_onexit
__dllonexit
_lock
_initterm
__C_specific_handler
_XcptFilter
malloc
free
_amsg_exit
_unlock
??_V@YAXPEAX@Z
??3@YAXPEAX@Z
_vsnwprintf
_purecall
memmove
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
_CxxThrowException
__CxxFrameHandler3
memcpy
_callnewh
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
memset

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
LoadStringW
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
LoadLibraryExW

api-ms-win-core-synch-l1-2-0

WaitForSingleObject
Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentThreadId
ProcessIdToSessionId
GetCurrentProcess
TerminateProcess
CreateThread

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetSystemTimeAsFileTime
SetComputerNameExW

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-1

SetLastError
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-com-l1-1-1

CoInitializeEx
CoTaskMemAlloc
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoTaskMemFree

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-registry-l1-1-0

RegGetValueW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegQueryInfoKeyW

api-ms-win-security-lsalookup-l2-1-1

LookupAccountNameW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VariantInit
SysStringLen
VariantClear

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoActivateInstance
RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

dui70

?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?_ZeroRelease@Value@DirectUI@@AEAAXXZ
?GetClassInfoPtr@TouchEdit2@DirectUI@@SAPEAUIClassInfo@2@XZ
InitThread
StrToID
InitProcessPriv
UnInitProcessPriv
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?CreateString@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
?GetEncodedContentStringLength@Element@DirectUI@@QEAA_KXZ
UnInitThread
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z

ext-ms-win-ntuser-message-l1-1-1

PeekMessageW
DispatchMessageW
TranslateMessage

ext-ms-win-ntuser-synch-l1-1-0

MsgWaitForMultipleObjects

ext-ms-win-session-wtsapi32-l1-1-0

WTSQuerySessionInformationW
WTSFreeMemory

api-ms-win-appmodel-runtime-l1-1-1

ClosePackageInfo
GetPackageApplicationIds
OpenPackageInfoByFullName

Exports

Exports

CheckPackageManagerOutOfProc
CheckUserConsent
ConfigureAppLaunch
GetDeviceId
GetPackagePassword
GetProvisioningTargetUser
ReportInstallationError
SetDeviceName

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7de0526d6e672de836f38a1d0520bbb4

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-debug-l1-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

dui70

ext-ms-win-ntuser-message-l1-1-1

ext-ms-win-ntuser-synch-l1-1-0

ext-ms-win-session-wtsapi32-l1-1-0

api-ms-win-appmodel-runtime-l1-1-1

Exports

Exports

Sections

.text Size: 37KB - Virtual size: 37KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 500B

.text
Size: 37KB - Virtual size: 37KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 500B