NEAS[.]003b9ab71f61176f57797984f935b5d0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.003b9ab71f61176f57797984f935b5d0.exe
Size

330KB
MD5

003b9ab71f61176f57797984f935b5d0
SHA1

63c87c2a2e1fed816e29fc61196cf8b72169cc4b
SHA256

17e0bcdf819455e7160138b1f108e6be57035515631e85e014e5b1a7a1111d51
SHA512

b96f22ab8e42704fb8c55242926d4b1f2241cba02c499cd96ab8a97a77b8611d7604c54fa0aeee2baf64bb03af32ba5475ccef85bba99a763c1b99c0a90b9310
SSDEEP

6144:TobnuyeGVwGYm97O+v2wy9nLs8qxK84/3gBM:cnuyeGi1mpO+v2hLs8IK8a3g2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.003b9ab71f61176f57797984f935b5d0.exe

Files

NEAS.003b9ab71f61176f57797984f935b5d0.exe
.exe windows:5 windows x86

e5fb16ce0098b76a4e69f478f2d17b4b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
SizeofResource
MultiByteToWideChar
LockResource
GetWindowsDirectoryW
GetVolumeInformationW
LoadLibraryExW
LoadLibraryW
FindResourceW
GetProcAddress
LoadLibraryA
LoadLibraryExA
GetLastError
WaitForSingleObject
WideCharToMultiByte
DeleteFileW
Sleep
FindResourceExW
CloseHandle
CreateFileW
FlushFileBuffers
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
HeapAlloc
HeapFree
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringW
GetStringTypeW
HeapReAlloc
SetStdHandle
WriteConsoleW
GetProcessHeap

advapi32

ChangeServiceConfig2W

wininet

InternetConnectW
InternetOpenW
InternetCloseHandle

Sections

.text
Size: 251KB - Virtual size: 251KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5fb16ce0098b76a4e69f478f2d17b4b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

wininet

Sections

.text Size: 251KB - Virtual size: 251KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 7KB - Virtual size: 14KB

.reloc Size: 19KB - Virtual size: 19KB

.text
Size: 251KB - Virtual size: 251KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 7KB - Virtual size: 14KB

.reloc
Size: 19KB - Virtual size: 19KB