NEAS[.]0578221bafa4223bd513e5d2af956cc0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.0578221bafa4223bd513e5d2af956cc0.exe
Size

106KB
MD5

0578221bafa4223bd513e5d2af956cc0
SHA1

2ed12952de11d2f268198e58e099f3480ce85295
SHA256

029c06721b0fde24a5be358e06190a023f8cd40521454d95b9c16c5801474caf
SHA512

dbd8df3e184346b91a0adefe2e8fc87011a2b72847524e24591dd56064e0b65d93c251378d06782737b6e6020713ffb75ff104b2ba170c880055566aeb225927
SSDEEP

3072:6Gppo1+VUBHz5OVByQORnc6WVg2mMMPWV:6G3oAeHz5OTPOS6WV3p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.0578221bafa4223bd513e5d2af956cc0.exe

Files

NEAS.0578221bafa4223bd513e5d2af956cc0.exe
.dll windows:5 windows x86

18bf44f853f63244c6d95aed3e82cbf5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupDiGetDeviceInstallParamsW
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiDestroyDeviceInfoList
SetupDiSetDeviceInstallParamsW
SetupDiGetSelectedDriverW
SetupDiGetDriverInfoDetailW
SetupOpenInfFileW

kernel32

GetModuleHandleW
Sleep
GetProcAddress
GetShortPathNameW
GetCurrentProcess
GetVersionExW
GetSystemInfo
FindFirstFileW
FindClose
CreateProcessW
WaitForSingleObject
CloseHandle
GetLastError
LoadLibraryW
HeapFree
HeapAlloc
GetProcessHeap
GetModuleFileNameW
GetTickCount
VirtualQuery
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentThreadId
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
LoadLibraryA
FreeLibrary
GetVersionExA
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
WideCharToMultiByte
MultiByteToWideChar
lstrlenA

advapi32

ControlService
DeleteService
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatusEx
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW

difxapi

DriverPackageInstallW

msvcr100

_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_CRT_RTC_INITW
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
strcpy_s
__CxxFrameHandler3
_wcslwr_s
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
_wtoi
wcsncpy_s
wcscpy_s
wcslen
wcscat_s

user32

EnumDisplayDevicesA

Exports

Exports

CoInstallerEntry

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

18bf44f853f63244c6d95aed3e82cbf5

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

kernel32

advapi32

difxapi

msvcr100

user32

Exports

Exports

Sections

.text Size: 27KB - Virtual size: 26KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 27KB - Virtual size: 26KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

.rmnet
Size: 56KB - Virtual size: 60KB