NEAS[.]117fd31e8c7449d2b853da39b8924330[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.117fd31e8c7449d2b853da39b8924330.exe
Size

470KB
MD5

117fd31e8c7449d2b853da39b8924330
SHA1

29d1defcbde49ed94c708b6d9c7f678504b37e98
SHA256

b5458908abd6599d3057fad6e2cd90f44d26c7e1ef5c4437f19205bc727a7f6b
SHA512

3ba7d7fbf3c71ed8856ab3df3a474b4c507c9d47ec47ba60cf29d03b33fefcf3e831abc1afd0a770baf3adb3a2f6f3e7ef1a98e0dd2ca1594a1f4238dc1b335f
SSDEEP

12288:Yi9PaqBk47PM7E2klL0DeAQClMmDPPKFn8epA/cJmq4g8Dxqc:HX7M42kB0DnQCDPPSxA/BEc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.117fd31e8c7449d2b853da39b8924330.exe

Files

NEAS.117fd31e8c7449d2b853da39b8924330.exe
.exe windows:5 windows x86

a46ced863965038fddfc8c4489a02260

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA

user32

DefWindowProcA
InvalidateRect
SetWindowLongA
GetDC
ReleaseDC
ShowWindow
IsIconic
GetParent
ScreenToClient
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ModifyMenuA
AppendMenuA
EnableMenuItem
CheckMenuItem
CreateMenu
GetClassInfoExA
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetWindowTextA
MessageBoxA
SetForegroundWindow
SetFocus
BringWindowToTop
DestroyWindow
MoveWindow
SetWindowPos
EnableWindow
IsWindowEnabled
DestroyMenu
SetWindowTextA
GetClientRect
GetWindowRect
GetWindowLongA
GetClassNameA
CreateWindowExA
SetTimer
KillTimer
SetMenu
SendMessageA
GetMessageA
TranslateMessage
DispatchMessageA
PeekMessageA
RegisterClassExA
PostQuitMessage
RegisterClassA
UnregisterClassA
SetCapture
ReleaseCapture
CreateAcceleratorTableA
DestroyAcceleratorTable
TranslateAcceleratorA
GetSystemMetrics
LoadCursorA
LoadIconA
UpdateWindow

advapi32

RegCreateKeyExA
RegQueryValueExA
RegSetValueExA

gdi32

GetStockObject
GetPixel

tier0

Error
DevWarning
ThreadInterlockedAssignIf64
?Lock@CThreadFastMutex@@ACEXII@Z
g_pMemAlloc
Warning
CommandLine_Tier0
Plat_FloatTime
Plat_IsInDebugSession
HushAsserts
Msg
SpewOutputFunc
?ConWarning@@YAXPBDZZ
WriteMiniDump
GetCPUInformation
?LockForRead@CThreadSpinRWLock@@QAEXXZ
?UnlockRead@CThreadSpinRWLock@@QAEXXZ
?LockForWrite@CThreadSpinRWLock@@QAEXXZ
?UnlockWrite@CThreadSpinRWLock@@QAEXXZ
?DevWarning@@YAXPBDZZ
CreateSimpleThread
ReleaseThreadHandle
GetThreadedLoadLibraryFunc
ThreadWaitForObjects
?DevMsg@@YAXPBDZZ
COM_TimestampedLog
g_Telemetry
??0CThreadSpinRWLock@@QAE@XZ

rpcrt4

UuidEqual
UuidFromStringA
UuidCreate
UuidToStringA
RpcStringFreeA

vstdlib

KeyValuesSystem
VStdLib_GetICVarFactory

kernel32

WriteConsoleW
LCMapStringW
SetEndOfFile
HeapFree
IsValidCodePage
CreateFileW
QueryPerformanceCounter
CompareStringW
FlushFileBuffers
SetStdHandle
CreateProcessA
GetExitCodeProcess
OutputDebugStringW
LoadLibraryExW
GetStringTypeW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
SetFilePointerEx
ReadConsoleW
GetConsoleMode
RtlUnwind
GetFileAttributesExW
GetCurrentDirectoryW
UnhandledExceptionFilter
GetConsoleCP
GetCPInfo
GetOEMCP
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleA
GetLastError
ReleaseMutex
WaitForSingleObject
CloseHandle
SetNamedPipeHandleState
TransactNamedPipe
MapViewOfFile
UnmapViewOfFile
CreateMutexA
OpenMutexA
CreateFileMappingA
CreateFileA
Sleep
GetCurrentProcess
CreateThread
GetOverlappedResult
ResumeThread
SetEvent
ResetEvent
WriteFile
ReadFile
DuplicateHandle
ConnectNamedPipe
DisconnectNamedPipe
CreateEventA
OutputDebugStringA
DeleteFileA
CreateNamedPipeA
VirtualQuery
HeapAlloc
GetProcessHeap
TerminateProcess
GetTickCount
GlobalAlloc
GlobalLock
GlobalUnlock
GetCommandLineA
SetCurrentDirectoryA
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryExA
RaiseException
GetDriveTypeW
GetFullPathNameA
IsDebuggerPresent
IsProcessorFeaturePresent
SetEnvironmentVariableA
GetSystemTimeAsFileTime
SetLastError
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
SetEnvironmentVariableW
GetACP

comdlg32

GetOpenFileNameA
GetSaveFileNameA
ChooseColorA

comctl32

ord17

Exports

Exports

CreateInterface
cvar

Sections

.text
Size: 343KB - Virtual size: 342KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a46ced863965038fddfc8c4489a02260

Headers

DLL Characteristics

File Characteristics

Imports

shell32

user32

advapi32

gdi32

tier0

rpcrt4

vstdlib

kernel32

comdlg32

comctl32

Exports

Exports

Sections

.text Size: 343KB - Virtual size: 342KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 7KB - Virtual size: 1.9MB

.rsrc Size: 31KB - Virtual size: 30KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 343KB - Virtual size: 342KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 7KB - Virtual size: 1.9MB

.rsrc
Size: 31KB - Virtual size: 30KB

.reloc
Size: 17KB - Virtual size: 16KB