NEAS[.]659a7866d7b578e469692146a09b7d40[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.659a7866d7b578e469692146a09b7d40.exe
Size

410KB
MD5

659a7866d7b578e469692146a09b7d40
SHA1

18ae118677d80ed2e9b9c5d96e02bacc3a59e7a9
SHA256

492e4aed1059dea01bad9fa25548a105d49a6f0611b5a0e8b817370834203d5f
SHA512

07c3537b70ab620bfc2afb36ac8953e18890e63f62bdb031a6a46bc8f08f3070ef875e59cf0dad6754a65fd92b712b1d8e3481d436dae019871672993f11ff9a
SSDEEP

6144:cVmXBExLVmkcpVjVgRrdOnAjxpbeVaig/kp0NqNDJMM4:SL/PyV5EICugYN9Mz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.659a7866d7b578e469692146a09b7d40.exe

Files

NEAS.659a7866d7b578e469692146a09b7d40.exe
.dll windows:5 windows x64

8ff5fe13384a4a9bb35aacf2c151227c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_wcsnicmp
_strnicmp
strchr
_snprintf
wcsrchr
_strcmpi
_vsnprintf
_itow
wcsspn
wcstoul
memcpy
memcmp
_wcsicmp
_ultoa
memset
_resetstkoflw
malloc
_onexit
__dllonexit
free
_initterm
swprintf
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
sscanf
iswspace
_snwprintf
strrchr

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlFreeHeap
RtlAllocateHeap
RtlCopySid
RtlFreeUnicodeString
RtlUpcaseUnicodeString
RtlDeleteCriticalSection
RtlGetNtProductType
RtlInitializeSid
RtlLengthRequiredSid
RtlRegisterWait
RtlDeregisterWait
RtlNtStatusToDosError
NtClose
NtCreateEvent
NtOpenEvent
NtQuerySystemTime
RtlEqualSid
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlEqualUnicodeString
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlLengthSid
RtlDeleteResource
RtlInitializeResource
RtlAcquireResourceExclusive
RtlReleaseResource
RtlAcquireResourceShared
RtlInitUnicodeString
RtlDowncaseUnicodeString
RtlAppendUnicodeStringToString
RtlValidSid
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlGetElementGenericTable
RtlDeleteElementGenericTable
RtlLookupElementGenericTable
RtlInitializeGenericTable
RtlInsertElementGenericTable
NtQuerySystemInformation
RtlOemStringToUnicodeString
RtlInitAnsiString
RtlImageNtHeader

kerberos

KerbMakeKdcCall
KerbKdcCallBack
KerbIsInitialized
KerbCreateTokenFromTicket
KerbFree

ntdsa

CrackSingleName
IsStringGuid

cryptdll

CDGenerateRandomBits
CDBuildIntegrityVect
MD5Init
CDFindCommonCSystemWithKey
CDFindCommonCSystem
CDLocateCheckSum
MD5Update
CDLocateCSystem
MD5Final

lsasrv

LsaIQueryForestTrustInfo
LsarEnumerateTrustedDomainsEx
LsaIFree_LSAPR_TRUSTED_ENUM_BUFFER_EX
LsaIFreeForestTrustInfo
LsarQueryDomainInformationPolicy
LsaIFree_LSAPR_POLICY_DOMAIN_INFORMATION
LsaIRegisterPolicyChangeNotificationCallback
LsaIForestTrustFindMatch
LsaIFree_LSAPR_TRUSTED_DOMAIN_INFO
LsaIFree_LSAPR_POLICY_INFORMATION
LsarQueryInformationPolicy
LsaIOpenPolicyTrusted
LsaIGetLogonGuid
LsaIGetCallInfo
LsaIAuditAccountLogonEx
LsaINoMoreWin2KDomain
LsaIAuditKdcEvent
LsaICancelNotification
LsaIRegisterNotification
LsarQueryTrustedDomainInfoByName
LsaIFilterNamespace
LsaIFilterSids
LsaIQueryInformationPolicyTrusted
LsarClose
LsaIUnregisterAllPolicyChangeNotificationCallback
LsaIKerberosRegisterTrustNotification

ntdsatq

AtqStopEndpoint
AtqCloseEndpoint
AtqInitialize
AtqStartEndpoint
AtqEndpointGetInfo
AtqCreateEndpoint
AtqTerminate
AtqGetAcceptExAddrs
AtqWriteSocket
AtqReadFile
AtqWriteDatagramSocket
AtqContextSetInfo
AtqGetDatagramAddrs
AtqFreeContext
AtqCloseSocket
AtqContextGetInfo

msasn1

ASN1objectidentifier_free
ASN1CEREncGeneralizedTime
ASN1BERDecObjectIdentifier
ASN1BERDecNotEndOfContents
ASN1BERDecExplicitTag
ASN1BEREncCharString
ASN1_CreateModule
ASN1_CloseDecoder
ASN1BERDecGeneralizedTime
ASN1_CreateEncoder
ASN1_FreeEncoded
ASN1_Decode
ASN1_FreeDecoded
ASN1_CreateDecoder
ASN1_CloseEncoder
ASN1_Encode
ASN1BEREncObjectIdentifier
ASN1BERDecSkip
ASN1BEREncOpenType
ASN1octetstring_free
ASN1BERDecSXVal
ASN1ztcharstring_free
ASN1BERDecS32Val
ASN1BERDecPeekTag
ASN1BERDecOctetString
ASN1DecAlloc
ASN1BERDecBitString
ASN1bitstring_free
ASN1BEREncU32
ASN1BERDecU32Val
ASN1Free
ASN1BERDecCharString
ASN1charstring_free
ASN1BERDecEndOfContents
ASN1DecSetError
ASN1BEREncOctetString
ASN1BEREncSX
ASN1BEREncEndOfContents
ASN1BEREncS32
ASN1EncSetError
ASN1BERDecZeroCharString
ASN1BEREncBool
ASN1BEREncExplicitTag
ASN1BERDecBool
ASN1BERDecOpenType2
ASN1intx_free
ASN1BEREncBitString

msv1_0

Msv1_0SubAuthenticationPresent
Msv1_0ExportSubAuthenticationRoutine

crypt32

CryptEncryptMessage
CryptSignMessage
CryptVerifyMessageSignature
CryptDecodeObjectEx
CertGetNameStringW
CertCloseStore
CertOpenStore
CertCompareCertificate
CertEnumCertificatesInStore
CertControlStore
CertFreeCertificateContext
CryptAcquireCertificatePrivateKey
CryptImportPublicKeyInfo
CertCreateCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CryptDecodeObject
CertGetCertificateContextProperty
CertFindExtension
CertDuplicateCertificateContext

authz

AuthzInitializeResourceManager
AuthzFreeContext
AuthzAccessCheck
AuthzInitializeContextFromSid
AuthzFreeResourceManager

ws2_32

htonl
ntohl
closesocket
WSAEventSelect
WSASocketW
WSAIoctl
WSAGetLastError
setsockopt

samsrv

SamIResetBadPwdCountOnPdc
SamrCloseHandle
SamIQueryServerRole
SamIGetUserLogonInformation2
SamIRetrievePrimaryCredentials
SamIGetAliasMembership
SamIFree_SAMPR_ULONG_ARRAY
SamIFreeSidArray
SamIGetResourceGroupMembershipsTransitive
SamIChangePasswordForeignUser
SamISetPasswordForeignUser2
SamIChangePasswordForeignUser2
SamrOpenDomain
SamIConnect
SamIAccountRestrictions
SamIFree_SAMPR_DOMAIN_INFO_BUFFER
SamrQueryInformationDomain
SamIIncrementPerformanceCounter
SamIFreeSidAndAttributesList
SamIFree_UserInternal6Information
SamIUpdateLogonStatistics
SamIStorePrimaryCredentials

user32

wsprintfW
CharLowerBuffW

kernel32

WriteFile
InitializeCriticalSection
LoadLibraryW
CreateFileW
GetProcAddress
VirtualAlloc
GetLocalTime
CreateFileMappingW
GetProfileStringA
GetSystemInfo
GetModuleFileNameA
OpenFileMappingW
OutputDebugStringA
DebugBreak
LoadLibraryA
__C_specific_handler
lstrlenW
GetACP
GetLastError
Sleep
CloseHandle
FormatMessageW
LocalFree
GetTickCount
GetSystemTimeAsFileTime
WaitForSingleObject
OpenEventW
RegisterWaitForSingleObject
SetLastError
SetEvent
LocalAlloc
UnregisterWaitEx
EnterCriticalSection
LeaveCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
GetModuleHandleW
GetModuleFileNameW
lstrcpyW
GetComputerNameW
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
lstrlenA
GetSystemDefaultLCID
WideCharToMultiByte
MapViewOfFileEx
MultiByteToWideChar
lstrcmpiA
CompareStringA
CreateFileA
UnmapViewOfFile
FreeLibrary
CreateEventW

advapi32

UnregisterTraceGuids
RegisterServiceCtrlHandlerW
RegNotifyChangeKeyValue
GetTraceEnableFlags
SetServiceStatus
RegOpenKeyExW
RegQueryValueExW
RegisterTraceGuidsW
GetTraceLoggerHandle
CryptReleaseContext
CryptDestroyKey
CryptAcquireContextW
SystemFunction027
CryptVerifySignatureW
CryptSetProvParam
CryptSignHashW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
EqualSid
GetLengthSid
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegConnectRegistryW
GetTokenInformation
OpenProcessToken
CryptHashData
TraceEvent
CryptGetHashParam
CryptCreateHash
CryptDestroyHash
RegCloseKey

netapi32

NetApiBufferFree
NetAlertRaiseEx
NetpIsRemote

rpcrt4

MesHandleFree
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeEncode2
MesDecodeIncrementalHandleCreate
MesEncodeIncrementalHandleCreate
RpcImpersonateClient
RpcRevertToSelf
RpcServerListen
I_RpcMapWin32Status
RpcServerUseProtseqW

Exports

Exports

CredentialUpdateFree
CredentialUpdateNotify
CredentialUpdateRegister
InitializeChangeNotify
KdcAccountChangeNotification
KdcChangePassword
KdcFreeMemory
KdcGetTicket
KdcGetUserPac
KdcServiceMain
KdcUpdateKrbtgtPassword
KdcVerifyPac
PasswordChangeNotify

Sections

.text
Size: 362KB - Virtual size: 361KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ff5fe13384a4a9bb35aacf2c151227c

Headers

File Characteristics

Imports

msvcrt

ntdll

kerberos

ntdsa

cryptdll

lsasrv

ntdsatq

msasn1

msv1_0

crypt32

authz

ws2_32

samsrv

user32

kernel32

advapi32

netapi32

rpcrt4

Exports

Exports

Sections

.text Size: 362KB - Virtual size: 361KB

.data Size: 3KB - Virtual size: 5KB

.pdata Size: 31KB - Virtual size: 30KB

.rsrc Size: 12KB - Virtual size: 12KB

.reloc Size: 1024B - Virtual size: 584B

.text
Size: 362KB - Virtual size: 361KB

.data
Size: 3KB - Virtual size: 5KB

.pdata
Size: 31KB - Virtual size: 30KB

.rsrc
Size: 12KB - Virtual size: 12KB

.reloc
Size: 1024B - Virtual size: 584B