NEAS[.]66ee414aea220e37de34d85eb207dd40[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.66ee414aea220e37de34d85eb207dd40.exe
Size

407KB
MD5

66ee414aea220e37de34d85eb207dd40
SHA1

872a052d3d888ad8543f54115318105c9910aa0c
SHA256

db5500dbcc8423f01642cea52aa08c5f4a369421a740ce38f40d10d1e135184a
SHA512

3eaab021e6292b39c2a056b458aff58f2b0963a677dffd04be81067f482b61950a0d24a8ef91f9fd0a3a567b5b354a9f7ee65dec0aca3892af5ccbcc8998deb4
SSDEEP

12288:gxETh9t9h0TnWxKhph5hphxjYWktLpm1EwtLpm1ETYBjvrEH74:mETh9t9h0HktLpwbtLpwIqrEH74

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.66ee414aea220e37de34d85eb207dd40.exe

Files

NEAS.66ee414aea220e37de34d85eb207dd40.exe
.exe windows:10 windows x86

44885713369ff27fd3cd6b8c4fda6d04

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegGetValueW
RegSetValueExW
EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

kernel32

GetSystemDirectoryW
LoadLibraryExW
GetProcAddress
FreeLibrary
HeapFree
GetProcessHeap
GetVolumePathNameW
GetLastError
GetModuleHandleW
GetFirmwareType
GetPhysicallyInstalledSystemMemory
GlobalMemoryStatusEx
CreateFileW
ReadFile
SetFilePointer
FindFirstFileW
FindNextFileW
FindClose
GetSystemWow64DirectoryW
LeaveCriticalSection
SetFileAttributesW
DeleteFileW
RemoveDirectoryW
InitializeCriticalSection
SetCurrentDirectoryW
LoadLibraryW
FormatMessageW
GlobalLock
GlobalUnlock
GetFileSize
LocalFree
GlobalAlloc
GetComputerNameW
GetCommandLineW
HeapSetInformation
RegisterApplicationRestart
CreateEventW
GetNativeSystemInfo
MultiByteToWideChar
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
GetLocaleInfoW
TerminateThread
WaitForSingleObject
SetEvent
CreateThread
ResetEvent
CloseHandle
GetTempPathW
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
Sleep
GetTickCount
GetVersionExW
DeleteCriticalSection
DnsHostnameToComputerNameW
GetCurrentDirectoryW
EnterCriticalSection
CreateDirectoryExW

gdi32

CreateFontIndirectW
GetObjectW
CreateSolidBrush
SetTextColor
EndDoc
EndPage
StartDocW
CreateFontW
TextOutW
StartPage
GetDeviceCaps
GetTextExtentPoint32W

user32

SetCapture
PtInRect
OffsetRect
InflateRect
DestroyIcon
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
IsWindowEnabled
IsWindowVisible
GetFocus
LoadCursorW
SetCursor
SetFocus
UpdateWindow
InvalidateRect
DrawFocusRect
CopyRect
GetClientRect
SetClassLongW
FillRect
SetWindowPlacement
SystemParametersInfoW
LoadAcceleratorsW
MoveWindow
RedrawWindow
EnableWindow
GetWindowTextW
ReleaseCapture
ShowWindow
ReleaseDC
CheckDlgButton
IsDlgButtonChecked
LoadStringW
GetSubMenu
SetMenuItemInfoW
EmptyClipboard
PostMessageW
MessageBoxW
LoadMenuW
SetMenu
SetClipboardData
BeginPaint
GetDCEx
SetRect
ScreenToClient
SetDlgItemTextW
SetWindowTextW
SendMessageW
GetDlgItem
KillTimer
SetTimer
DialogBoxParamW
EndDialog
GetSysColor
EndPaint
PostQuitMessage
CreateDialogParamW
GetMessageW
TranslateAcceleratorW
IsDialogMessageW
TranslateMessage
DispatchMessageW
DestroyAcceleratorTable
LoadIconW
CheckRadioButton
GetWindowRect

mfc42u

ord1571
ord600
ord269
ord826
ord5781
ord5785
ord5871
ord6168
ord5790
ord2559
ord640
ord6921
ord6919
ord6867
ord6563
ord5597
ord2755
ord5618
ord2757
ord802
ord812
ord559
ord4182
ord6565
ord911
ord542
ord5588
ord698
ord396
ord2442
ord1172
ord6466
ord1634
ord3621
ord268
ord1560
ord2406
ord3614
ord1633
ord825
ord540
ord800
ord858
ord861
ord2910
ord5568
ord4124
ord2606
ord538
ord535
ord6140
ord5858
ord941
ord2810
ord940
ord6278
ord823
ord4155
ord1165
ord2756
ord922
ord5706
ord1594
ord398
ord700
ord4184
ord913
ord2809
ord773
ord394
ord696
ord501
ord998
ord5617
ord4180
ord909
ord1083
ord5596
ord3430
ord5586
ord6218
ord4199
ord4197
ord6279
ord927
ord925
ord834
ord2805
ord5852
ord2768
ord6928
ord1184
ord3432
ord349
ord3658
ord5647
ord3121
ord3608
ord2385
ord352
ord537
ord3806
ord2813
ord942
ord2819
ord2776
ord860
ord323

msvcrt

_except_handler4_common
memcpy
_controlfp
??1type_info@@UAE@XZ
_ftol2_sse
_ftol2
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@XZ
malloc
wcsncpy_s
_vsnwprintf
iswascii
wcstod
_wtol
_wcsupr
free
iswalpha
wcstoul
wcstol
_wcsicmp
swprintf_s
_purecall
_wcsicoll
_wtoi
__CxxFrameHandler3
??0exception@@QAE@ABV0@@Z
memset

atl

ord30

ntdll

NtQuerySystemInformation

oleaut32

VariantInit
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
VariantClear
VariantChangeType
SysAllocStringLen
SysStringLen
SysFreeString
SysAllocString

ole32

CoInitializeSecurity
CoCreateGuid
CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize
StringFromCLSID

shlwapi

StrFormatByteSizeEx

setupapi

SetupIterateCabinetW

comdlg32

PrintDlgExW
GetOpenFileNameW
GetSaveFileNameW

shell32

CommandLineToArgvW
ShellAboutW

comctl32

InitCommonControlsEx

powrprof

PowerDeterminePlatformRoleEx

slc

SLGetWindowsInformationDWORD

Sections

.text
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

44885713369ff27fd3cd6b8c4fda6d04

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

mfc42u

msvcrt

atl

ntdll

oleaut32

ole32

shlwapi

setupapi

comdlg32

shell32

comctl32

powrprof

slc

Sections

.text Size: 154KB - Virtual size: 154KB

.data Size: 5KB - Virtual size: 20KB

.idata Size: 7KB - Virtual size: 7KB

.rsrc Size: 147KB - Virtual size: 146KB

.reloc Size: 16KB - Virtual size: 15KB

.text
Size: 154KB - Virtual size: 154KB

.data
Size: 5KB - Virtual size: 20KB

.idata
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 147KB - Virtual size: 146KB

.reloc
Size: 16KB - Virtual size: 15KB