NEAS[.]9c9d3896bc750759be3b7a543e57abf0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.9c9d3896bc750759be3b7a543e57abf0.exe
Size

2.1MB
MD5

9c9d3896bc750759be3b7a543e57abf0
SHA1

6cccd0edf171342c55b7842f0514c4129acc9728
SHA256

244b76b5b721c7e2ad27082ff593da61f4198f62c0dc0f7799ca199881102720
SHA512

ababd1f331939fe0adb853c2e71009ec9034fe600daf867145b9e9600c94bbc8ccced8ecd3a82b54336c8413c6114cfa1ab3a12c897414334652ca76dcb681c6
SSDEEP

49152:qrLkViBYTRDt8FywiAaXE8bxw9VdJIuVAsh4rflqPGS0L:Hp7w7PlXVAsA1S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.9c9d3896bc750759be3b7a543e57abf0.exe

Files

NEAS.9c9d3896bc750759be3b7a543e57abf0.exe
.exe windows:6 windows x64

400b4b1fac192a70f9a2e16cc8127263

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mpir

__gmpz_fdiv_q
__gmpz_pow_ui
__gmpz_init
__gmpz_import
__gmpz_cmp
__gmpz_init_set_str
__gmp_snprintf

kernel32

DeleteCriticalSection
FreeLibrary
Sleep
SleepEx
GetTickCount64
CloseHandle
WaitForSingleObjectEx
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VerifyVersionInfoA
InitializeCriticalSectionEx
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SetLastError
FormatMessageA
CreateFileA
GetFileSizeEx
FindNextFileA
FindFirstFileExA
LeaveCriticalSection
EnterCriticalSection
SetConsoleMode
ReadConsoleW
ReadConsoleA
GetConsoleMode
GetEnvironmentVariableW
ConvertFiberToThread
GetSystemTimeAsFileTime
WideCharToMultiByte
DeleteFiber
MultiByteToWideChar
WriteFile
GetFileType
GlobalMemoryStatus
GetTickCount
GetCurrentProcessId
QueryPerformanceCounter
SetConsoleCtrlHandler
SetConsoleWindowInfo
SetConsoleScreenBufferSize
GetStdHandle
GetProcAddress
GetModuleHandleW
GetLastError
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
ExpandEnvironmentStringsA
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
HeapSize
SetEndOfFile
WriteConsoleW
GetFileAttributesExW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
FindClose
GetFullPathNameW
GetCurrentDirectoryW
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetConsoleCP
GetACP
GetCommandLineW
GetCommandLineA
HeapAlloc
HeapFree
GetModuleFileNameW
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
InitializeSListHead
DuplicateHandle
GetCurrentThread
GetExitCodeThread
GetNativeSystemInfo
QueryPerformanceFrequency
TryEnterCriticalSection
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlUnwindEx
LoadLibraryExW
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
CreateFileW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
SetFilePointerEx
GetModuleFileNameA
IsValidCodePage

user32

GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW

advapi32

CryptHashData
CryptReleaseContext
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEncrypt
CryptImportKey
CryptAcquireContextW
CryptGetHashParam
CryptAcquireContextA
CryptEnumProvidersW

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain

ws2_32

ntohl
htonl
gethostname
sendto
recvfrom
WSAIoctl
htons
getpeername
select
__WSAFDIsSet
socket
setsockopt
listen
connect
closesocket
bind
accept
WSASetLastError
send
recv
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
WSAStartup
ntohs
getsockopt
getsockname
ioctlsocket

wldap32

ord35
ord33
ord32
ord27
ord26
ord79
ord50
ord45
ord60
ord211
ord46
ord143
ord30
ord200
ord41
ord301
ord22

normaliz

IdnToAscii

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 560KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

400b4b1fac192a70f9a2e16cc8127263

Headers

DLL Characteristics

File Characteristics

Imports

mpir

kernel32

user32

advapi32

crypt32

ws2_32

wldap32

normaliz

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 560KB - Virtual size: 560KB

.data Size: 46KB - Virtual size: 68KB

.pdata Size: 81KB - Virtual size: 80KB

.tls Size: 2KB - Virtual size: 1KB

.gfids Size: 3KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 560KB - Virtual size: 560KB

.data
Size: 46KB - Virtual size: 68KB

.pdata
Size: 81KB - Virtual size: 80KB

.tls
Size: 2KB - Virtual size: 1KB

.gfids
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 22KB - Virtual size: 21KB