NEAS[.]41c5b0a7ec8374055a9c190b3e8d8970[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.41c5b0a7ec8374055a9c190b3e8d8970.exe
Size

747KB
MD5

41c5b0a7ec8374055a9c190b3e8d8970
SHA1

79842fd2bf3a7c46934082f6f6ae770976ccc203
SHA256

b90e77bf388350231fa7ef322eff416c71f0cd47845a2c4f04ce4650a160081f
SHA512

1f90d9068c73d48ca03c7016703d3d40556c2d12dd842e4fd26fb7415374e3cd71f82bc7534db2b5b1f9d2db0c13f0f661025306dd052eb00caad7e37318d180
SSDEEP

12288:yaj3pZeiHViu9i75YiWR8TKT0wu02OYAAQNSBf7Nfpgph3htsh03XQ4RlpZBMYgY:rDpQ5TwvtKCXQ4RlpPxlLp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
NEAS.41c5b0a7ec8374055a9c190b3e8d8970.exe

Files

NEAS.41c5b0a7ec8374055a9c190b3e8d8970.exe
.dll regsvr32 windows:6 windows x64

ae56bd09f6489911fbebd8ef9f3959d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileW
SetEndOfFile
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
Sleep
EncodePointer
DecodePointer
GetLocaleInfoEx
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
FatalAppExitA
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
GetStdHandle
GetFileType
InitOnceExecuteOnce
GetStartupInfoW
CloseHandle
GetProcessHeap
SetLastError
GetCurrentThread
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
WriteFile
GetModuleFileNameW
HeapSize
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetModuleHandleW
GetACP
IsValidCodePage
GetOEMCP
GetTimeFormatEx
GetDateFormatEx
CompareStringEx
GetUserDefaultLocaleName
LCMapStringEx
IsValidLocaleName
EnumSystemLocalesEx
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
SetConsoleCtrlHandler
GetTimeZoneInformation
SetStdHandle
FreeLibrary
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableA

ole32

CoLoadLibrary

crypt32

CryptStringToBinaryA

Exports

Exports

DllRegisterServer

Sections

.text
Size: 388KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ae56bd09f6489911fbebd8ef9f3959d6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

crypt32

Exports

Exports

Sections

.text Size: 388KB - Virtual size: 388KB

.rdata Size: 320KB - Virtual size: 319KB

.data Size: 12KB - Virtual size: 22KB

.pdata Size: 17KB - Virtual size: 16KB

.rsrc Size: 512B - Virtual size: 248B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 388KB - Virtual size: 388KB

.rdata
Size: 320KB - Virtual size: 319KB

.data
Size: 12KB - Virtual size: 22KB

.pdata
Size: 17KB - Virtual size: 16KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 8KB - Virtual size: 7KB