NEAS[.]a082d6a28f913e7ae2b2ce2514155db0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.a082d6a28f913e7ae2b2ce2514155db0.exe
Size

176KB
MD5

a082d6a28f913e7ae2b2ce2514155db0
SHA1

f550be87ccd6fc16a1543f2c1cddefb7f5776a3c
SHA256

e5b4573af4ebb19610b0ca21d3ca325fe33b1435c0c73b0732f46f4d66b463ac
SHA512

d5d2a89dd629e70de08cc142af83d6e963b8d1a4c77b356f1e279685d24c6cf5194fd3078cf65160ca8bb37b92b0a47908ff7e1f3b2631407f833d7632e9d6ea
SSDEEP

3072:q79ht0sZHwSYteJF/xnVVq+OYkdG3u89rMQLNyBknk7:q7qsKQ0jnAt4Bknk7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.a082d6a28f913e7ae2b2ce2514155db0.exe

Files

NEAS.a082d6a28f913e7ae2b2ce2514155db0.exe
.exe windows:5 windows x86

a05d88650e5594db2afe874ec2674b55

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

kernel32

GetCurrentProcess
SetHandleInformation
WaitForSingleObject
Sleep
GetVersionExW
GetExitCodeProcess
GetLastError
CloseHandle
GetCurrentProcessId
HeapAlloc
HeapFree
InterlockedDecrement
GetProcessHeap
WideCharToMultiByte
GetModuleFileNameW
MultiByteToWideChar
DuplicateHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
CreateProcessW
GetCommandLineW
CreateFileW
HeapReAlloc
GetConsoleMode
HeapSize
OutputDebugStringW
CompareStringW
LoadLibraryExW
SetEnvironmentVariableW
GetStringTypeW
GetConsoleCP
SetEndOfFile
ReadConsoleW
ReadFile
SetLastError
WriteFile
FlushFileBuffers
GetProcAddress
GetModuleHandleExW
ExitProcess
FreeEnvironmentStringsW
LCMapStringW
QueryPerformanceCounter
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetEnvironmentStringsW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
lstrlenA
LocalFree
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW

user32

CharLowerW
wsprintfW

advapi32

ConvertSidToStringSidW
GetLengthSid
LsaNtStatusToWinError
RegOpenKeyExW
RegQueryValueExW
CopySid
GetTokenInformation
OpenProcessToken
RegCloseKey

shell32

ShellExecuteExW
SHCreateDirectoryExW

ole32

CoInitialize
CoUninitialize
CoCreateInstance
OleRun

oleaut32

SysFreeString
VariantInit
VariantClear
GetErrorInfo
SysAllocString

urlmon

URLOpenBlockingStreamW

wintrust

WinVerifyTrust

ws2_32

send
freeaddrinfo
socket
WSACleanup
shutdown
htons
WSAGetLastError
getaddrinfo
htonl
WSAStartup
connect
closesocket
recv

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a05d88650e5594db2afe874ec2674b55

Headers

DLL Characteristics

File Characteristics

Imports

wtsapi32

secur32

kernel32

user32

advapi32

shell32

ole32

oleaut32

urlmon

wintrust

ws2_32

version

Sections

.text Size: 118KB - Virtual size: 118KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 5KB - Virtual size: 21KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 118KB - Virtual size: 118KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 5KB - Virtual size: 21KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 7KB - Virtual size: 6KB