NEAS[.]cc3e338217bfe3f23c82650978f5fb30[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cc3e338217bfe3f23c82650978f5fb30.exe
Size

1.8MB
MD5

cc3e338217bfe3f23c82650978f5fb30
SHA1

06573bb636473cd9e3e9dc4f2f65be1dfcdd21b4
SHA256

b501a5712f48d6ca38f3b8c644462afe12631e74838bec3339daf94fb1bfee51
SHA512

fd19f641b877e094ee15fe81320f2f82804ab277266789c57edb0121b8629cc72da63dba367783ef290bfaa441367c86cfdd9ab6619bb3f9dfd9a2d2e8cb484b
SSDEEP

24576:wmTyISrfWxPVXvJph4rfWxPVXvJph67615cZL6p1tsqYCXZ00nyi:5DxPVXBr9xPVXBrc6cwpj1nyi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cc3e338217bfe3f23c82650978f5fb30.exe

Files

NEAS.cc3e338217bfe3f23c82650978f5fb30.exe
.dll windows:4 windows x86

ae5c6abe93db9591bc8bdfd0fc5b3204

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
GetPrivateProfileStringA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
SetCurrentDirectoryA
GetCurrentDirectoryA
DeviceIoControl
FindClose
FindNextFileA
FindFirstFileA
lstrlenA
WritePrivateProfileStringA
GetTempPathA
GetLastError
WriteFile
CopyFileA
ReadFile
SetFilePointer
lstrcatA
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetFileSize
GlobalAlloc
CloseHandle
GlobalUnlock
GetSystemDirectoryA
GlobalLock
GlobalFree
DeleteFileA
lstrcmpA
SetFileAttributesA
lstrcpyA
RemoveDirectoryA
CreateDirectoryA
CreateMutexA
GetDriveTypeA
HeapAlloc
HeapReAlloc
GetVersionExA
GetStringTypeW
GetStringTypeA
VirtualAlloc
LCMapStringA
MultiByteToWideChar
LCMapStringW
HeapCreate
HeapDestroy
RtlUnwind
GetCommandLineA
GetVersion
GetCPInfo
GetACP
GetOEMCP
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
HeapFree
TlsGetValue
GetEnvironmentStringsW
VirtualFree
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
GetEnvironmentStrings
GetStartupInfoA
SetHandleCount
GetStdHandle
GetFileType
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte

user32

MessageBoxA
GetKeyboardType
ToAscii
wsprintfA

advapi32

RegCreateKeyExA
OpenSCManagerA
RegSetValueExA
RegDeleteKeyA
CloseServiceHandle
RegOpenKeyExA
RegCloseKey
RegQueryValueExA

msi

ord158
ord144
ord79
ord138
ord146
ord31
ord73
ord49
ord163
ord17
ord124
ord50
ord8
ord57
ord134
ord121

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Exports

Exports

DriverCompareFileVersion
FileVersionGet
OAK_DetectKeyboard
ThinkPadCheckMessage
rins_AdminCheck
rins_AdminCheck_Reg
rins_Dialog_DeleteKeyFromReg
rins_Dialog_SetDataToReg
rins_End_FolderMake
rins_EnvDel_Check_All
rins_EnvDel_Check_Feature
rins_EnvDel_Check_Message
rins_Initialize_Code_Disp
rins_Initialize_Env_Reg_Exist_Check
rins_Initialize_Env_Reg_Exist_Check_V3
rins_Initialize_Env_Reg_Exist_Check_V4
rins_Initialize_Env_To_File
rins_Initialize_FindFileFolder
rins_Initialize_Floppy_Driver
rins_Initialize_Floppy_Driver_3Mode_Check
rins_Initialize_Floppy_Driver_File_Check
rins_Initialize_Floppy_Driver_Set_Check
rins_Initialize_FolderGet
rins_Initialize_FolderMake
rins_Initialize_Gaiji_Copy
rins_Initialize_GetDataFromReg
rins_Initialize_GetProperty
rins_Initialize_GetProperty_Directory
rins_Initialize_Keyboard_Check
rins_Initialize_Keyboard_Reg
rins_Initialize_Keyboard_Type
rins_Initialize_ListBox_Data
rins_Initialize_MachineCheck
rins_Initialize_MachineCheck_FJ
rins_Initialize_MachineCheck_FJ_RealCheck
rins_Initialize_MachineCheck_Reg
rins_Initialize_MachineCheck_Type
rins_Initialize_Main
rins_Initialize_NotesCheck
rins_Initialize_OSInfomation
rins_Initialize_Old_OASYS_Check
rins_Initialize_Old_OASYS_Env
rins_Initialize_Old_OASYS_Exist
rins_Initialize_SetProperty
rins_Initialize_SetProperty_Directory
rins_Initialize_SideBySide
rins_Initialize_SideBySide_Check
rins_Initialize_Sousa_Mode
rins_Initialize_Syorui_Folder
rins_Initialize_Syorui_Folder_FromDef
rins_Initialize_Syorui_Folder_FromEnv
rins_Initialize_Syorui_Folder_Reset
rins_Initialize_Syorui_Folder_Reset_OnVersion
rins_Initialize_Syorui_Folder_Reset_OnVersion_Sub
rins_Initialize_TempFolderDelete
rins_Initialize_TempFolderMake
rins_Initialize_YenMarkDelete
rins_InstallLes_Check
rins_LastStringCut
rins_Menu_Data_Get
rins_Menu_Feature_Set
rins_Menu_Feature_Set_Root
rins_Menu_Feature_Set_Root_Check
rins_Menu_Feature_Set_Root_Set
rins_Menu_InstallPath_Get
rins_Menu_InstallPath_Get_Path_Make
rins_Menu_Prop_Get
rins_Menu_Result_Return_Cancel
rins_Menu_Result_Return_Init
rins_Menu_Result_Return_Normal
rins_Menu_Silent_FolderCheck
rins_Menu_Sousa_Mode
rins_Result_Set
rins_Result_UserComapnyName
rins_Silent_CDView
rins_Silent_Feature_CDView
rins_Silent_Feature_Gakken
rins_Silent_Feature_OAK
rins_Silent_Gakken
rins_Silent_Main
rins_Silent_OAK
rins_VUP_Main
test_Prop_Get
test_Prop_Get2
test_Prop_Get3
test_Prop_Set
test_Prop_Syorui

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae5c6abe93db9591bc8bdfd0fc5b3204

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msi

version

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 60KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 72KB - Virtual size: 72KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 64KB - Virtual size: 60KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 72KB - Virtual size: 72KB

.reloc
Size: 8KB - Virtual size: 6KB