NEAS[.]c135aeec803f8d9c4216e4edbb8aa6f0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c135aeec803f8d9c4216e4edbb8aa6f0.exe
Size

1.4MB
MD5

c135aeec803f8d9c4216e4edbb8aa6f0
SHA1

b81c93ae6fc085e25841110b92f8da659b032dd6
SHA256

bb89f8d477323abc4806045a04dc7d670c8d01f78f6f09914651b654e8355fe8
SHA512

cac176bf0d5f16a9020095a53ae367adfa5168f7b345bf4d31a498e6598341688f3cb7d729893093496d9cf946129be83a8ecf72251bf53b38937cac3d8e4b96
SSDEEP

24576:PqSZQorEkMtDu0wpoGjxDqLcboVAlNiUw3aROb1EyFl3DuE7x9r+gqPqKK:PnQorEkMhlwpoMh6Al7w3aJyTTuEV9zj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c135aeec803f8d9c4216e4edbb8aa6f0.exe

Files

NEAS.c135aeec803f8d9c4216e4edbb8aa6f0.exe
.exe windows:4 windows x86

503adab44175f5b2d3a4a6dd05d74268

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemInfo
GetComputerNameW
ReleaseMutex
CreateMutexW
LocalFree
CreateDirectoryW
GetCurrentDirectoryW
CopyFileW
MoveFileExW
Sleep
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
SetCurrentDirectoryW
FindNextFileW
ExpandEnvironmentStringsW
InterlockedExchange
OutputDebugStringA
GetFileType
GetFileSize
SetFilePointer
SetLastError
CreateFileA
ReadFile
WriteFile
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetStringTypeA
GetStringTypeW
GetVersionExW
GetCPInfo
GetLocaleInfoA
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
lstrcmpiA
EnumSystemLocalesA
GetUserDefaultLCID
GetVersionExA
FileTimeToLocalFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
LoadLibraryA
SystemTimeToTzSpecificLocalTime
GetTickCount
OutputDebugStringW
OpenEventW
CreateEventW
CreateSemaphoreW
FindFirstFileExW
FindFirstFileW
CreateFileW
GetCurrentProcessId
OpenProcess
FindClose
FormatMessageW
WideCharToMultiByte
GetCurrentThread
GetCurrentProcess
CloseHandle
lstrcatW
lstrcpyW
LoadLibraryW
GetProcAddress
lstrcpynW
lstrcmpiW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
lstrlenA
MultiByteToWideChar
FreeLibrary
GetModuleHandleW
GetShortPathNameW
InterlockedIncrement
GetModuleFileNameW
lstrlenW
GetCommandLineW
lstrcmpW
InterlockedDecrement
GetCurrentThreadId
CreateProcessW
GetLastError
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEndOfFile
InitializeCriticalSection
GetStartupInfoW

user32

LoadStringW
DispatchMessageW
CharNextW
CharLowerW
LoadStringA
wsprintfW
GetMessageW
PostThreadMessageW

advapi32

GetSidIdentifierAuthority
GetSidSubAuthority
AllocateAndInitializeSid
FreeSid
EqualSid
RegConnectRegistryW
GetUserNameW
IsValidSid
InitializeAcl
AddAccessAllowedAce
IsValidAcl
IsValidSecurityDescriptor
MakeSelfRelativeSD
OpenEventLogW
CloseEventLog
GetTokenInformation
OpenThreadToken
OpenProcessToken
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetLengthSid
CopySid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
StartServiceCtrlDispatcherW
ControlService
DeleteService
CreateServiceW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegQueryValueExW
SetServiceStatus
RegisterServiceCtrlHandlerW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenSCManagerW
OpenServiceW
CloseServiceHandle
EqualPrefixSid
LookupAccountSidW
IsWellKnownSid
GetSidSubAuthorityCount

ole32

CoUninitialize
CoInitializeSecurity
CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoRevokeClassObject
CoCreateInstance
StringFromGUID2
CoInitializeEx
CoRegisterClassObject
CoTaskMemAlloc

oleaut32

VarDateFromStr
DosDateTimeToVariantTime
SysAllocStringLen
SysAllocStringByteLen
SysStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
SysAllocString
VarUI4FromStr
SysFreeString

msvcrt

_stricmp
_wcsicmp
_memicmp
_fstat
_wcsupr
_wcslwr
_controlfp
isspace
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
strcspn
putc
__CxxFrameHandler
_CxxThrowException
_getpid
??2@YAPAXI@Z
malloc
free
_putws
vswprintf
memcpy
realloc
memset
memcmp
_ltow
_ultow
wcsncat
wcsncpy
_wcsnicmp
_wsplitpath
swprintf
iswdigit
wcsspn
iswspace
_wcsrev
memmove
strlen
wcslen
strcpy
wcscpy
strncpy
strstr
wcsstr
strcmp
wcscmp
strncmp
wcsncmp
strtol
wcstol
strtoul
wcstoul
strtod
wcstod
strchr
wcschr
_wtol
atol
_wtoi
atoi
_waccess
_wstat
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_purecall
_ftime
gmtime
wcsftime
wcscat
_itow
_ftol
modf
floor
fabs
ceil
_wfopen
fclose
fflush
fputws
swscanf
sprintf
div
_findclose
_wfindfirst
_wfindnext
tolower
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
strncat
setlocale
??0exception@@QAE@XZ
_iob
_vsnprintf
abort
_copysign
_isnan
_fpclass
_finite
_fcvt
_ecvt
__pioinfo
_get_osfhandle
memchr
setvbuf
fgetpos
fseek
fsetpos
ftell
feof
ungetc
getc

rpcrt4

UuidFromStringW

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

STLPORT_
Size: 4KB - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

503adab44175f5b2d3a4a6dd05d74268

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

msvcrt

rpcrt4

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 248KB - Virtual size: 247KB

.data Size: 52KB - Virtual size: 61KB

STLPORT_ Size: 4KB - Virtual size: 32B

.rsrc Size: 8KB - Virtual size: 4KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 248KB - Virtual size: 247KB

.data
Size: 52KB - Virtual size: 61KB

STLPORT_
Size: 4KB - Virtual size: 32B

.rsrc
Size: 8KB - Virtual size: 4KB