NEAS[.]d5c39a51b487802f0d8c5238b8d5ba40[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.d5c39a51b487802f0d8c5238b8d5ba40.exe
Size

252KB
MD5

d5c39a51b487802f0d8c5238b8d5ba40
SHA1

cc57dc577f661d605a23e7aae7ac0a62320f1964
SHA256

722d49cead10e48fa63c487d75667c1cb7dc43d1aec7c06735d3eb342d8397dd
SHA512

439ad71f19c90560b480125b612b12ac5cf9fb77b8de61e530630156992497576a14d261372bee26285038c8f26a1be2c7e6b7432a525a10d475dc01110ef952
SSDEEP

3072:HhHzID1VjwhI3cVhpEof71kU2Kd/lAqdMcks5fWP:HhTIDvj2bEof71kUjVbdTfW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.d5c39a51b487802f0d8c5238b8d5ba40.exe

Files

NEAS.d5c39a51b487802f0d8c5238b8d5ba40.exe
.dll windows:10 windows x64

86a8cbb8561d3a11b75fd73a3163c24f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

msvcrt

free
_onexit
memcmp
memcpy
memset
_unlock
__dllonexit
_vsnwprintf
_purecall
_set_errno
_get_errno
memcpy_s
_wtoi
_callnewh
__CxxFrameHandler3
pow
_lock
__C_specific_handler
atan2
_initterm
malloc
_amsg_exit
_XcptFilter
sqrt
wcschr
memmove
wcscmp

propsys

InitPropVariantFromCLSID
PSCreateMemoryPropertyStore
PropVariantToUInt32
PropVariantToGUID
PropVariantToBoolean
PropVariantToStringAlloc

shlwapi

ord618
SHDeleteValueW
SHStrDupW
SHRegGetValueW
StrChrW

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventWrite
EventRegister
EventWriteTransfer
EventSetInformation

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW
LockResource
GetModuleHandleExW
SizeofResource
FindResourceExW
GetModuleFileNameA
GetModuleHandleW
GetProcAddress
DisableThreadLibraryCalls
LoadResource

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-synch-l1-2-0

InitOnceComplete
ReleaseSRWLockExclusive
InitializeSRWLock
AcquireSRWLockShared
InitOnceBeginInitialize
ReleaseSRWLockShared
Sleep
AcquireSRWLockExclusive

api-ms-win-core-winrt-error-l1-1-1

RoOriginateError

api-ms-win-core-heap-l1-2-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-sysinfo-l1-2-1

GetComputerNameExW
GetVersionExW
VerSetConditionMask
GetTickCount
GetSystemTimeAsFileTime
GetSystemTime

api-ms-win-core-rtlsupport-l1-2-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-com-l1-1-1

CoTaskMemFree
CoCreateInstance
CoCreateFreeThreadedMarshaler
CoGetMalloc
CoTaskMemAlloc
CoTaskMemRealloc
CLSIDFromString
StringFromCLSID
PropVariantClear

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc
LocalReAlloc

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW
ConvertStringSidToSidW

sspicli

LsaLookupAuthenticationPackage
LsaConnectUntrusted
SspiEncodeAuthIdentityAsStrings
SspiUnmarshalAuthIdentity
SspiMarshalAuthIdentity
SspiLocalFree
SspiGetTargetHostName
SspiCopyAuthIdentity
SspiEncryptAuthIdentityEx
SspiFreeAuthIdentity
LsaDeregisterLogonProcess

api-ms-win-core-registry-l1-1-0

RegUnLoadKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegLoadKeyW
RegGetValueW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-localization-l1-2-1

FormatMessageW
GetUserDefaultLCID

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-security-base-l1-2-0

GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
ImpersonateLoggedOnUser
RevertToSelf
GetLengthSid

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

netutils

NetApiBufferFree

api-ms-win-core-file-l1-2-1

GetFileSize
CreateFileW
ReadFile

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-security-lsapolicy-l1-1-0

LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
LsaLookupSids2

api-ms-win-core-kernel32-legacy-l1-1-1

GetComputerNameW
VerifyVersionInfoW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

ntdll

RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceExclusive
RtlInitializeResource
RtlGetDeviceFamilyInfoEnum
RtlInitString
RtlNtStatusToDosError

api-ms-win-core-delayload-l1-1-1

DelayLoadFailureHook
ResolveDelayLoadedAPI

samcli

NetUserGetInfo

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertFindExtension
CryptDecodeObjectEx
CryptUnprotectData
CertOpenStore
CryptBinaryToStringW

cryptsp

CryptReleaseContext
CryptGenRandom
CryptAcquireContextW

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

86a8cbb8561d3a11b75fd73a3163c24f

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

propsys

shlwapi

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-heap-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-rtlsupport-l1-2-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-com-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-security-sddl-l1-1-0

sspicli

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-registry-l1-1-1

api-ms-win-security-base-l1-2-0

api-ms-win-core-processenvironment-l1-2-0

netutils

api-ms-win-core-file-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

samcli

crypt32

cryptsp

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 140KB - Virtual size: 140KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 416B

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 140KB - Virtual size: 140KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 416B

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 2KB - Virtual size: 1KB