NEAS[.]dbd087566420d945303c278a4fd90e60[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.dbd087566420d945303c278a4fd90e60.exe
Size

430KB
MD5

dbd087566420d945303c278a4fd90e60
SHA1

81035bdb3f4af54dde89bf6aa8c541e905a78479
SHA256

7d2b4e9f401bc89e8f0d4a81f46efd25c28aa7e9a38c2e444c9931c0fd645b46
SHA512

834afbc4c01944e31f405f10c46894bf5abe736ec71e763fe4bc414d51ac6e23c487ebb7ef6b36c6eb4c7339d178324a2693fe9934508fbccbc2fa8018b160e3
SSDEEP

6144:gx4jDiXU5kI6Ld6mmp5MBGR8zhqPKClCCFARE9y/ek+1TXl0O:gqjQI6Ld6X5cM8zSKClCCF+et1T10O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.dbd087566420d945303c278a4fd90e60.exe

Files

NEAS.dbd087566420d945303c278a4fd90e60.exe
.dll windows:10 windows x64

bdc74dcbf3152cd9af67a377f0a394cd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

_lock
??1type_info@@UEAA@XZ
_unlock
__dllonexit
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_purecall
_vsnwprintf
_onexit
malloc
free
memmove
memmove_s
realloc
_set_errno
_get_errno
__CxxFrameHandler3
_callnewh
_CxxThrowException
memcmp
memcpy
memset

shcore

CreateRandomAccessStreamOnFile
ord244

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
GetModuleFileNameA
DisableThreadLibraryCalls

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventActivityIdControl
EventWriteTransfer
EventSetInformation
EventRegister

api-ms-win-core-debug-l1-1-1

OutputDebugStringW

api-ms-win-core-processthreads-l1-1-2

TerminateProcess
GetCurrentThreadId
OpenProcess
OpenProcessToken
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-1

FormatMessageW

api-ms-win-core-synch-l1-2-0

AcquireSRWLockShared
ReleaseSRWLockShared
InitializeSRWLock
Sleep
AcquireSRWLockExclusive
InitOnceExecuteOnce
InitOnceComplete
ReleaseSRWLockExclusive
InitOnceBeginInitialize

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo
IsErrorPropagationEnabled
GetRestrictedErrorInfo
RoOriginateError
RoTransformError
RoReportFailedDelegate
SetRestrictedErrorInfo
RoOriginateErrorW

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty
WindowsCreateString
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsDuplicateString

api-ms-win-core-rtlsupport-l1-2-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter
GetLastError
RaiseException
UnhandledExceptionFilter
SetLastError

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-com-l1-1-1

CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoTaskMemFree
CreateStreamOnHGlobal
CoMarshalInterface
StringFromCLSID
CoCreateInstance
RoGetAgileReference
CoTaskMemRealloc
CoReleaseMarshalData
CoGetMalloc

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-security-base-l1-2-0

GetTokenInformation

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 318KB - Virtual size: 317KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bdc74dcbf3152cd9af67a377f0a394cd

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

shcore

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-localization-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-winrt-l1-1-0

Exports

Exports

Sections

.text Size: 318KB - Virtual size: 317KB

.rdata Size: 76KB - Virtual size: 76KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 25KB - Virtual size: 24KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 318KB - Virtual size: 317KB

.rdata
Size: 76KB - Virtual size: 76KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 7KB