NEAS[.]2a3de1827a32ea086df6ca244e5d36d0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.2a3de1827a32ea086df6ca244e5d36d0.exe
Size

767KB
MD5

2a3de1827a32ea086df6ca244e5d36d0
SHA1

85ac7c9c91f6bd318e28f5c89590edd0e8a1c340
SHA256

2dfd0f631df7eb9559dddfa478b69051011da74b9b712b5cd2cceb9254ca5b8d
SHA512

85966f04cbfd9550a9ada5618ffdd07e30173e2fc8ccad88eb8201aa146b65cff4409b4cd1b557e2b758a8f9e25949d7113f9d5a772f9ba3f4a5ddad3efe432e
SSDEEP

12288:7SLAYjG3FN92mrRUDkDTYNmN3Rus3SAFYq8Noz9qirzrEX1fsd7TOoOTd:7IXjG1N3RUDHNmdPCAaq8Nozgi/rE0TY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.2a3de1827a32ea086df6ca244e5d36d0.exe

Files

NEAS.2a3de1827a32ea086df6ca244e5d36d0.exe
.exe windows:5 windows x64

1066a3b782ba8bdf778ff30602f54812

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

crlsci

?GetInst@IIPMMessagingSystem@CrlSCI@@SAAEAV12@XZ

crlconfig

?GetBoxMajorVersionNum@IAppStartupInit@@UEBAHXZ
?GetAppVersion@IAppStartupInit@@UEBAXAEAH000@Z
?GetBoxVersion@IAppStartupInit@@UEBAXAEAH000@Z
??0IAppStartupInit@@QEAA@XZ
?FindInterface@IAppStartupInit@@UEBAPEBXAEBU_GUID@@@Z
?FindInterface@IAppStartupInit@@UEAAPEAXAEBU_GUID@@@Z
?IsOnlyInitializeAndLoadDll@IAppStartupInit@@UEBA_NXZ
?IsWindowPainterSkinScaleSupported@IAppStartupInit@@UEBA_NXZ
?GetAppResourceDLLName@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?IsSDIDefaultInterfaceMode@IAppStartupInit@@UEBA_NXZ
?GetTypeAssistFileName@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetDefaultExtension@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetClassID@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetProgId@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetAppTlbFilename@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetAppHintsFile@IAppStartupInit@@UEBA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?GetProductSummaryType@IAppStartupInit@@UEBAGXZ
??0BaseAppStartup@@QEAA@AEAUIAppStartupInit@@@Z
??1BaseAppStartup@@UEAA@XZ
?Initialize@BaseAppStartup@@MEAAXXZ
?Initialize@BaseAppStartup@@QEAAXPEB_W_N@Z
?Run@BaseAppStartup@@MEAAHXZ
?LoadAppDll@BaseAppStartup@@IEAA_NXZ
?RunAppDll@BaseAppStartup@@IEAAHXZ
?GetAppSkinSettingData@@YAAEAVWAppSkinSettingData@@XZ
?GetFireBallImagePath@WAppSkinSettingData@@QEAA_NAEAV?$CrlStringT@_W@CrlPlatform@@@Z
?BOXIDGetCopyrightInfo@@YAPEB_WXZ
?GetAppUIName@WAppSkinSettingData@@QEAA?AV?$CrlStringT@_W@CrlPlatform@@XZ
?CommandLine@BaseAppStartup@@UEBAAEBUICommandLine@CrlUtils@@XZ
?GetCmdLine@BaseAppStartup@@UEAAPEA_WXZ
?IsSdiMode@BaseAppStartup@@UEBA_NXZ
?StartupInitialActionDisabled@BaseAppStartup@@UEBA_NXZ
?IsDDE@BaseAppStartup@@UEBA_NXZ
?IsCOMAutomation@BaseAppStartup@@UEBA_NXZ
?IsUserMode@BaseAppStartup@@UEBA_NXZ
?IsPrintAndExit@BaseAppStartup@@UEBA_NXZ
?IsNoSplash@BaseAppStartup@@UEBA_NXZ
?IsPrintABB@BaseAppStartup@@UEBA_NXZ
?IsPrintFull@BaseAppStartup@@UEBA_NXZ
?IsEmbedding@BaseAppStartup@@UEBA_NXZ
?IsAutomation@BaseAppStartup@@UEBA_NXZ

crlplatform

??B?$CrlStringT@_W@CrlPlatform@@QEBAPEB_WXZ
??4?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@PEB_W@Z
??1?$CrlStringT@_W@CrlPlatform@@QEAA@XZ
??0?$CrlStringT@_W@CrlPlatform@@QEAA@AEBV01@@Z
??0?$CrlStringT@_W@CrlPlatform@@QEAA@PEB_W@Z
??0?$CrlStringT@_W@CrlPlatform@@QEAA@XZ
??0?$CrlStringT@_W@CrlPlatform@@QEAA@PEB_WH@Z
?GetBuffer@?$CrlStringT@_W@CrlPlatform@@QEAAPEA_WXZ
?ReleaseBuffer@?$CrlStringT@_W@CrlPlatform@@QEAAXH@Z
?GetString@?$CrlStringT@_W@CrlPlatform@@QEBAPEB_WXZ
?IsEmpty@?$CrlStringT@_W@CrlPlatform@@QEBA_NXZ
??4?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@$$QEAV01@@Z
?FormatInternal@?$CrlStringT@_W@CrlPlatform@@AEAAXPEB_WZZ
??4?$CrlStringT@_W@CrlPlatform@@QEAAAEAV01@AEBV01@@Z
?Empty@?$CrlStringT@_W@CrlPlatform@@QEAAXXZ
?GetLength@?$CrlStringT@_W@CrlPlatform@@QEBAHXZ

crlutils

?wait@StickyEvent@CrlUtils@@UEAAXXZ
??1StickyEvent@CrlUtils@@UEAA@XZ
?set@StickyEvent@CrlUtils@@QEAAXXZ
?GetThreadID@CrlThread@CrlUtils@@YAKAEAPEAX@Z
?Join@CrlThread@CrlUtils@@YAXAEAPEAX_N@Z
?tryWait@StickyEvent@CrlUtils@@UEAA_NXZ
?getNativeHandle@StickyEvent@CrlUtils@@UEAAPEAXXZ
?wait_for@StickyEvent@CrlUtils@@UEAA_NK@Z
?Exists@File@SystemIO@@YA_NPEB_W@Z
?GetFolderName@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W@Z
?Combine@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W0@Z
?GetFileName@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEB_W@Z
?GetUserLocaleID@CrlLocale@@YAKXZ
?GetWorkAreaSizeWithoutTaskBarAndToolbarRectPixels@System@CrlUtils@@YA_NPEAX@Z
?Create@CrlThread@CrlUtils@@YAPEAXV?$function@$$A6AKPEAX@Z@std@@PEAX@Z
?DeleteAllSingletons@CrlUtils@@YAXXZ
?set@InterProcessEvent@CrlUtils@@QEAAXXZ
?GetProcessFileName@Path@SystemIO@@YA?AV?$CrlStringT@_W@CrlPlatform@@PEAUHINSTANCE__@@@Z
??0StickyEvent@CrlUtils@@QEAA@_N0@Z

crlutl

?CRLUTLIsCurLangFarEast@@YAHXZ
?CreateSilentEvent@IGLB_UILanguage@@SAPEAVInterProcessEvent@CrlUtils@@XZ
CRLUTLInitModule
UTLInitialize
UTLUninitialize
?GetInst@IGLB_UILanguage@@SAAEAV1@XZ

crlresources

?GetString@Resources@Framework@@SA?AV?$CrlStringT@_W@CrlPlatform@@AEBV34@@Z
?Preload@Resources@Framework@@SA_NXZ

gdiplus

GdipAlloc
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdiplusStartup
GdiplusShutdown
GdipFree
GdipDisposeImage

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

mfc140u

ord6631
ord11406
ord13354
ord5723
ord2629
ord11806
ord3279
ord3172
ord11850
ord5080
ord5363
ord5552
ord9041
ord5339
ord5582
ord5083
ord5229
ord5062
ord5916
ord7460
ord7461
ord7450
ord5227
ord7922
ord9946
ord8900
ord3278
ord2316
ord3812
ord13864
ord4859
ord1454
ord7651
ord9977
ord6549
ord6320
ord12761
ord12762
ord886
ord1369
ord878
ord13767
ord7813
ord1086
ord438
ord4721
ord13757
ord12746
ord2473
ord4726
ord2475
ord4656
ord1033
ord296
ord3756
ord14211
ord4782
ord4837
ord4853
ord2212
ord2369
ord2270
ord1489
ord4794
ord1491
ord14217
ord2967
ord4352
ord9384
ord4360
ord4828
ord4767
ord4752
ord990
ord4814
ord4800
ord4806
ord4788
ord4843
ord4776
ord1755
ord1734
ord1748
ord1722
ord1700
ord11940
ord11944
ord13513
ord3173
ord8947
ord10691
ord6729
ord11902
ord8656
ord14209
ord11625
ord3718
ord11415
ord11414
ord5451
ord9979
ord9975
ord9978
ord9976
ord14360
ord2698
ord7913
ord3209
ord3212
ord13401
ord6002
ord8830
ord266
ord265
ord7182
ord6247

kernel32

DeleteCriticalSection
OutputDebugStringA
QueryActCtxW
GetModuleHandleExW
GetModuleFileNameW
SetLastError
CreateActCtxW
FindActCtxSectionStringW
LoadLibraryW
DeactivateActCtx
ActivateActCtx
GetLastError
InitializeCriticalSectionEx
OutputDebugStringW
ReleaseActCtx
GetCurrentThreadId
lstrcmpiW
GetACP
lstrcpyW
GetCurrentProcess
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetSystemDirectoryW
CloseHandle
GetWindowsDirectoryW
SetDllDirectoryW
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW

user32

DispatchMessageW
GetSysColor
DdeCreateStringHandleW
DdeAccessData
DdeUnaccessData
GetMessageW
TranslateMessage
SendMessageW
GetDC
ReleaseDC
PostThreadMessageW
IsWindow
SetPropW
CopyRect
DrawTextW
GetClientRect
UpdateWindow
InvalidateRect
DdeNameService
PeekMessageW
GetWindowLongW
SetLayeredWindowAttributes
GetSystemMetrics
CreateDialogParamW
SetWindowLongW
ShowWindow
DdeInitializeW
DestroyWindow
EndDialog
InflateRect
SetWindowTextW
SetRect
AdjustWindowRect
SetWindowPos
OffsetRect
IsRectEmpty
GetWindowRect
LoadCursorW
UpdateLayeredWindow
DdeEnableCallback
DdeFreeStringHandle
EnableWindow
DdeCmpStringHandles
GetParent
DdeUninitialize

gdi32

CreateSolidBrush
CreateFontIndirectW
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
GetDeviceCaps
RectVisible
Rectangle
BitBlt
GetTextFaceW
GetTextMetricsW
SaveDC
RestoreDC
DeleteObject
CreateDIBSection
GetStockObject
GetNearestColor
SetBkMode
SetTextColor
DeleteDC
SetTextAlign
SetBkColor

advapi32

OpenProcessToken

ole32

CoUninitialize
CoInitialize
CoCreateInstance

userenv

ExpandEnvironmentStringsForUserW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler
wcschr
__current_exception
__std_terminate
__current_exception_context
memset
_CxxThrowException

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_c_exit
_initialize_onexit_table
terminate
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_cexit
_set_app_type
_seh_filter_exe
_register_onexit_function
_register_thread_local_exe_atexit_callback

api-ms-win-crt-string-l1-1-0

isalpha
wcscat_s
wcsncpy
wcscpy_s

api-ms-win-crt-math-l1-1-0

round
__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1066a3b782ba8bdf778ff30602f54812

Headers

DLL Characteristics

File Characteristics

Imports

crlsci

crlconfig

crlplatform

crlutils

crlutl

crlresources

gdiplus

msvcp140

mfc140u

kernel32

user32

gdi32

advapi32

ole32

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 25KB - Virtual size: 24KB

.data Size: 1KB - Virtual size: 9KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 142KB - Virtual size: 141KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 1KB - Virtual size: 9KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 142KB - Virtual size: 141KB

.reloc
Size: 568KB - Virtual size: 572KB