NEAS[.]4f996da81fb5fecf12e9e24d7bf8dd40[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.4f996da81fb5fecf12e9e24d7bf8dd40.exe
Size

2.5MB
MD5

4f996da81fb5fecf12e9e24d7bf8dd40
SHA1

912881d5584e408f53aed622ecd7393e36026630
SHA256

75a50b715646e30c40e2c5a9055cde3904444c4e1b152db7f66687e321c28276
SHA512

9ae49fcb02e9248973f3597ef3f8b30de924141e1feeecd61d9b42d34cc2271e7d5142570661ebd46c50e844a27539541db4542538fd97fbe6b8fea4a1229b46
SSDEEP

24576:SUswc89pB3HnmuK+EJiXHA822fw+vEzTnUwIvZIADvuizs6Ahie1aZ:/nmuK9JiXHA826vEzzUwIvbBs68aZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.4f996da81fb5fecf12e9e24d7bf8dd40.exe

Files

NEAS.4f996da81fb5fecf12e9e24d7bf8dd40.exe
.dll windows:6 windows x64

83b688126ee969f2f6ef8eb1d8362761

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

iswdigit
iswascii
iswalpha
iswcntrl
wcschr
??0exception@@QEAA@XZ
_wcsicmp
isalpha
iswalnum
iswxdigit
_snwprintf_s
wcstoul
wcsncpy_s
memmove_s
iswpunct
iswspace
??0exception@@QEAA@AEBV0@@Z
_wtoi
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBD@Z
wcsnlen
isspace
strncmp
wcstok_s
_wcsnicmp
wcsstr
bsearch
memset
_vsnwprintf
wcstod
wcsncat_s
wcsncmp
swprintf_s
memcmp
__CxxFrameHandler3
_onexit
__dllonexit
_unlock
_wtoi64
isxdigit
realloc
strncat
??0exception@@QEAA@AEBQEBDH@Z
_strlwr
_lock
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_itow_s
_CxxThrowException
strstr
wcscpy_s
malloc
free
wcsrchr
wcstol
_wcslwr
memmove
wcscspn
memcpy_s
??1type_info@@UEAA@XZ
memcpy

ntdll

RtlIpv6StringToAddressExW
RtlIpv4AddressToStringExW
RtlIpv6AddressToStringExW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlIpv4StringToAddressExW

kernel32

CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindClose
LoadLibraryExA
GetLocaleInfoEx
VerifyScripts
GetUserDefaultLocaleName
LoadLibraryA
IsDBCSLeadByteEx
GetStringScripts
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeSRWLock
AcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockExclusive
ReleaseSRWLockShared
LoadLibraryExW
FreeLibrary
GetProcAddress
GetModuleHandleExW
HeapFree
CloseHandle
GetProcessHeap
UnmapViewOfFile
MapViewOfFileEx
HeapAlloc
GetLastError
GetModuleHandleW
SetLastError
DisableThreadLibraryCalls
InitializeCriticalSectionAndSpinCount
ClosePrivateNamespace
GetCurrentThreadId
GetTickCount
RaiseException
GetSystemTimeAsFileTime
LocalFree
HeapReAlloc
lstrlenW
lstrlenA
GetCurrentProcess
OpenProcess
CreateFileW
LocalAlloc
GetCurrentProcessId
GetCurrentThread
GetModuleFileNameW
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
LoadLibraryW
InitializeProcThreadAttributeList
GetVersionExA
OpenEventW
WaitForSingleObject
IsWow64Process
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
CreateMutexW
OpenMutexW
DuplicateHandle
TlsGetValue
TlsSetValue
lstrcmpA
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
GetEnvironmentVariableW
Sleep
QueryPerformanceCounter
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
CompareStringOrdinal
LocalReAlloc
VirtualQuery
UnregisterWaitEx
FindNextFileW
GetSystemDirectoryW
lstrcmpW
ExpandEnvironmentStringsW
CompareFileTime
GetVersionExW
TrySubmitThreadpoolCallback
TlsFree
TlsAlloc
QueryPerformanceFrequency
GlobalAlloc
GetStringTypeExW
GlobalFree
GlobalReAlloc
EncodePointer
DecodePointer
CreateBoundaryDescriptorW
OpenPrivateNamespaceW
CreatePrivateNamespaceW
DeleteBoundaryDescriptor
IsProcessInJob
CreateJobObjectW
SetInformationJobObject
CreateThread
ResumeThread
UnregisterWait
AssignProcessToJobObject
RegisterWaitForSingleObject
TerminateThread
FindFirstFileExW
SetEvent
CreateEventW
GetShortPathNameW
ReleaseMutex

api-ms-win-downlevel-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

api-ms-win-downlevel-advapi32-l1-1-0

RegDeleteValueW
RegEnumValueW
CheckTokenMembership
AddAce
InitializeSid
GetSidLengthRequired
FreeSid
AddAccessAllowedAce
AllocateAndInitializeSid
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
RegQueryValueExW
CreateRestrictedToken
GetAclInformation
OpenThreadToken
AddMandatoryAce
SetSecurityDescriptorSacl
GetLengthSid
GetSecurityDescriptorSacl
IsValidSid
RegQueryInfoKeyW
SetKernelObjectSecurity
GetAce
InitializeSecurityDescriptor
EqualSid
CopySid
GetKernelObjectSecurity
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegGetValueW
RegCreateKeyExW
DuplicateToken
CreateWellKnownSid
TraceMessageVa
RegOpenKeyExA
GetSidIdentifierAuthority
SetSecurityDescriptorDacl
AddAccessAllowedAceEx
InitializeAcl
DeleteAce
GetSecurityDescriptorDacl

api-ms-win-downlevel-user32-l1-1-0

CharLowerW
CharLowerA

api-ms-win-downlevel-normaliz-l1-1-0

IdnToAscii

Exports

Exports

CreateIUriBuilder
CreateStringHashN
CreateUri
CreateUriFromMultiByteString
CreateUriPriv
CreateUriWithFragment
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
FastMimeGetFileExtension
FastMimeGetIsMimeFilterEnabled
FastMimeLookupKnownType
FastMimeSetIsMimeFilterEnabled
GetIDNSettingsForIE
GetIUriPriv
GetIUriPriv2
GetPortFromUrlScheme
GetPropertyFromName
GetPropertyName
IEDllLoader
IEGetFrameUtilExports
IEGetProcessModule
IEGetTabWindowExports
IERT_DelayLoadFailureHook
IUriBuilderInternalCreateDomain
ImpersonateUser
IntlPercentEncodeNormalize
IsDWORDProperty
IsStringProperty
LCIECalculatePackedStringSize
LCIEPackString
LCIEUnpackString
PrivateCoInternetCanonicalizeIUri
PrivateCoInternetCombineIUri
PrivateCoInternetParseIUri
ResetIDNLanguageData
ResetIEExtensibility
ResetIERegistrySettings
RevertImpersonate
UriFromHostAndScheme

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

minATL
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83b688126ee969f2f6ef8eb1d8362761

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

ntdll

kernel32

api-ms-win-downlevel-version-l1-1-0

api-ms-win-downlevel-advapi32-l1-1-0

api-ms-win-downlevel-user32-l1-1-0

api-ms-win-downlevel-normaliz-l1-1-0

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

.wpp_sf Size: 1KB - Virtual size: 1KB

.data Size: 32KB - Virtual size: 32KB

.pdata Size: 67KB - Virtual size: 67KB

.idata Size: 9KB - Virtual size: 8KB

minATL Size: 512B - Virtual size: 40B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 118KB - Virtual size: 118KB

.text
Size: 2.3MB - Virtual size: 2.3MB

.wpp_sf
Size: 1KB - Virtual size: 1KB

.data
Size: 32KB - Virtual size: 32KB

.pdata
Size: 67KB - Virtual size: 67KB

.idata
Size: 9KB - Virtual size: 8KB

minATL
Size: 512B - Virtual size: 40B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 118KB - Virtual size: 118KB