NEAS[.]f605380b537201bd3bc0cdfb5ad53530[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.f605380b537201bd3bc0cdfb5ad53530.exe
Size

159KB
MD5

f605380b537201bd3bc0cdfb5ad53530
SHA1

1f8b075a88ff2e4f244ac6f2bf718005b3995dd6
SHA256

b4e6cb6ee92c872ca47b02d61cadf15798ffeebbf9764439b1f92473bb4b3c32
SHA512

4fedbc76dbd636822a23d0ee1372820657d6387e02dfdd34e5b0ac9b49f205a72a07e58f1ac47feb0dcaa52bba996bb66f9675f0ad0d787d465ebd77702a55cd
SSDEEP

3072:mx1CNumNkRwR/9UCQm7vCrOqbAqLVrjs4hYJeFm1ZlHIhOlHoPOlHIanlHDKOQCP:u1Wu+kRazQ8XlHXlHplH1lH0CGxDb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f605380b537201bd3bc0cdfb5ad53530.exe

Files

NEAS.f605380b537201bd3bc0cdfb5ad53530.exe
.dll windows:10 windows x64

a7333ef692c0070edd75da7a58e55102

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcp110_win

?_Winerror_map@std@@YAPEBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z

msvcrt

wcsstr
wcstok_s
memcpy_s
wcsnlen
wcsncmp
??1type_info@@UEAA@XZ
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_lock
swscanf
_initterm
_amsg_exit
_XcptFilter
_callnewh
wcscpy_s
memmove
_wcsicmp
_vsnwprintf
wcschr
_purecall
??_V@YAXPEAX@Z
wcstoul
??3@YAXPEAX@Z
malloc
free
_wtoi
isspace
strcmp
_CxxThrowException
memcpy
__C_specific_handler
memset

api-ms-win-eventing-provider-l1-1-0

EventWrite
EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
DisableThreadLibraryCalls
LoadLibraryExW
GetModuleHandleW
LoadLibraryExA
GetProcAddress
GetModuleHandleExW
GetModuleFileNameA

oleaut32

SysStringByteLen
VariantInit
SysFreeString
SysStringLen
VariantClear
SysAllocString

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
StringFromGUID2
CoWaitForMultipleHandles
CoTaskMemFree
CoRevertToSelf
CoUninitialize
CoGetApartmentType
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoInitializeEx

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapReAlloc
GetProcessHeap
HeapFree

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsCreateStringReference
WindowsDeleteString
WindowsGetStringRawBuffer

api-ms-win-core-synch-l1-2-0

WaitForMultipleObjectsEx
CreateEventExW
CreateEventW
WaitForSingleObject
SetEvent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
Sleep

api-ms-win-core-sysinfo-l1-2-1

GetTickCount
GetComputerNameExW
GetProductInfo
GetVersionExW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory
RoActivateInstance

api-ms-win-core-errorhandling-l1-1-1

RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalFree

api-ms-win-core-processthreads-l1-1-2

CreateProcessW
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
TerminateProcess
GetCurrentThreadId

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetValueExW
RegOpenKeyExW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

dmcmnutils

DmImpersonate
OmaDmRegistryGetString
CopyString
BigStrcat
DmRevertToSelf
OmaDmRegistryGetDWORD
HexStringToBinary
InvStrCmpIW
DecodeBase64W
UnicodeToMB
EncodeBase64W
DMGetClientHardwareUID
OmDmRegistryAllocAndGetString
SafeMultiByteToWideChar
MBToUnicode
OmaDmRegistrySetString
DmGetCurrentUserSid

omadmapi

ord54
ord23
ord47

dmenrollengine

GetDatabaseManagerInstance

crypt32

CryptAcquireCertificatePrivateKey
CertFindCertificateInStore
CertCloseStore
CertGetCertificateChain
CertGetNameStringW
CryptFindOIDInfo
CryptEncodeObjectEx
CryptExportPublicKeyInfo
CryptSignAndEncodeCertificate
CryptExportPublicKeyInfoEx
CryptMsgCalculateEncodedLength
CryptMsgOpenToEncode
CryptMsgUpdate
CryptMsgGetParam
CertOpenStore
CertFreeCertificateChain
CertFreeCertificateContext
CryptMsgClose
CryptEncodeObject

api-ms-win-core-file-l1-2-1

CreateFileW
WriteFile
GetTempPathW

api-ms-win-core-io-l1-1-1

DeviceIoControl

ncrypt

NCryptFinalizeKey
NCryptOpenStorageProvider
NCryptOpenKey
NCryptCreatePersistedKey
NCryptSetProperty
NCryptFreeObject

winhttp

WinHttpSetStatusCallback
WinHttpQueryHeaders
WinHttpOpen
WinHttpSetOption
WinHttpConnect
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpReadData
WinHttpQueryOption

api-ms-win-core-memory-l1-1-2

VirtualProtect
VirtualQuery

ntdll

RtlGetVersion
RtlNtStatusToDosError

devobj

DevObjDestroyDeviceInfoList
DevObjGetDeviceInterfaceDetail
DevObjEnumDeviceInterfaces
DevObjGetClassDevs
DevObjCreateDeviceInfoList

Exports

Exports

CanDeviceBeRenewed
ClearAllSavedUserAcceptedARDs
DeleteEnrollmentDataStore
DisableEnterpriseApps
DiscoverEndpoint
DiscoveryAsync
FindDiscoveryService
FindDiscoveryServiceAsync
GetCompanyHubInfo
GetEnrolledCompanyName
GetEnrollmentInfo
GetEnterpriseManagementAppURL
GetOMADMAccountInfo
InstallCompanyHub
IsDeviceEnrolled
ResumeEnrollmentAsync
SafeHeapAlloc
SafeHeapFree
ScheduleOmaDmSession
ShowCertExpiryWarning
ShowUnerollSuccess
StartEnrollmentAsync
StartEnrollmentAsyncEx
StartUnenrollmentAsync
StopEnrollmentAsync

Sections

.text
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 356B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a7333ef692c0070edd75da7a58e55102

Headers

DLL Characteristics

File Characteristics

Imports

msvcp110_win

msvcrt

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

oleaut32

api-ms-win-core-com-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-profile-l1-1-0

dmcmnutils

omadmapi

dmenrollengine

crypt32

api-ms-win-core-file-l1-2-1

api-ms-win-core-io-l1-1-1

ncrypt

winhttp

api-ms-win-core-memory-l1-1-2

ntdll

devobj

Exports

Exports

Sections

.text Size: 78KB - Virtual size: 77KB

.rdata Size: 74KB - Virtual size: 73KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 3KB - Virtual size: 2KB

.didat Size: 512B - Virtual size: 136B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 356B

.text
Size: 78KB - Virtual size: 77KB

.rdata
Size: 74KB - Virtual size: 73KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 3KB - Virtual size: 2KB

.didat
Size: 512B - Virtual size: 136B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 356B