NEAS[.]cf6172a33f52e3c831f0a4c41376e670[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.cf6172a33f52e3c831f0a4c41376e670.exe
Size

584KB
MD5

cf6172a33f52e3c831f0a4c41376e670
SHA1

c41d29d86f7196a542eb0950ebc3d05f0001f11a
SHA256

f44825f8cc98b7e4a5d7addcac0c07b93dc3c49059d4998cefe6bc1c11ff62dc
SHA512

c840a618ae842eaa1ec70ba5cbee9b0fa01fe95fdc404ba4f9b9171ba2c22d9856322334cb5788d30a52eec6f5726371e97d4d202bb9db0e03dc26470ef4c148
SSDEEP

12288:1yAkDd7wqQw2WeDtOTv39JdO5z8P4tBcbbGPMVTHF9Sa6qpO:YFDVZQWepKvdEYbGPeua6q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.cf6172a33f52e3c831f0a4c41376e670.exe

Files

NEAS.cf6172a33f52e3c831f0a4c41376e670.exe
.exe windows:4 windows x86

3dbaede8c40adc56acadcba4c42aebfa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForSingleObject
SetEvent
CreateThread
CreateEventA
CopyFileA
CreateDirectoryA
GetModuleFileNameW
GetModuleFileNameA
GetTempPathA
ExitProcess
lstrcmpiW
VirtualAlloc
GetCommandLineW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
WriteFile
LoadLibraryExA
FindResourceA
SizeofResource
LoadResource
LockResource
GlobalAlloc
GetTickCount
lstrcpyW
CloseHandle
lstrcatW
Sleep
DeleteFileW
CopyFileW
CreateFileW
GetModuleHandleA
GetCurrentProcess
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
lstrcmpiA
LoadLibraryA
GetProcAddress
CreateFileA
GetLastError
GetLocalTime
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapReAlloc
VirtualFree
HeapCreate
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
HeapFree
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
LCMapStringW

user32

GetKeyState
wsprintfA

gdi32

DeleteDC
CreateCompatibleDC
SelectObject
GetMapMode
SetMapMode
GetObjectW
DPtoLP
StretchBlt
BitBlt

advapi32

AdjustTokenPrivileges
RegSetValueExA
StartServiceCtrlDispatcherA
RegOpenKeyExA
RegQueryValueExA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegisterServiceCtrlHandlerA
SetServiceStatus
RegCreateKeyExA
RegQueryValueExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA

shell32

CommandLineToArgvW

shlwapi

PathFileExistsW

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 540KB - Virtual size: 538KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3dbaede8c40adc56acadcba4c42aebfa

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

Sections

.text Size: 24KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 540KB - Virtual size: 538KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 540KB - Virtual size: 538KB