NEAS[.]c7800e456fa4fb0e1de99eea483b0c90[.]exe

General

Target

NEAS.c7800e456fa4fb0e1de99eea483b0c90.exe
Size

48KB
MD5

c7800e456fa4fb0e1de99eea483b0c90
SHA1

7ce944dd5c651de2a12e3ff3a07531ccc77f558d
SHA256

2aba258e3e40014e34816f724ee287f8cc32b2bb0415cdb212ac08ac25b6ceaa
SHA512

57a24b59d91374bd7bd6ca3694d09b7ad2d771250e8cdb2beff3564f92ab3aef2192a704a87a4e6552fe127cff28c3e75a75b7f295d8ee6cef9fa26d772ad1fc
SSDEEP

768:aaJd4lABRVI5lQa/DFLfcOLJFIxd1KfyXT0hSK9VY0Zl:1Jd42zVqlpFzcOLJFc1NT0hRJl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c7800e456fa4fb0e1de99eea483b0c90.exe

Files

NEAS.c7800e456fa4fb0e1de99eea483b0c90.exe
.exe windows:4 windows x86

2d5ef39be64ad92fbf2af2b44ba07b5c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
HeapAlloc
GetProcessHeap
CreateFileA
Sleep
CreateThread
HeapFree
DisconnectNamedPipe
FlushFileBuffers
ReadFile
ExitThread
ConnectNamedPipe
CreateNamedPipeA
SetFilePointer
GetExitCodeThread
GetSystemInfo
VirtualProtect
GetLocaleInfoA
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
TerminateProcess
GetCurrentProcess
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle

user32

wsprintfA

ws2_32

accept
gethostbyname
recv
socket
htons
listen
connect
send
closesocket
WSACleanup
WSAStartup
bind
inet_addr

Sections

.text
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2d5ef39be64ad92fbf2af2b44ba07b5c

Headers

File Characteristics

Imports

kernel32

user32

ws2_32

Sections

.text Size: 32KB - Virtual size: 28KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 4KB - Virtual size: 10KB

.text
Size: 32KB - Virtual size: 28KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 4KB - Virtual size: 10KB