General

Malware Config

Signatures

Files

• NEAS.6e91238e9bfe5289368814bb30eda6d0.exe

  .dll windows:4 windows x86

  6863f015b2b165bb653e384b97196ce9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  CreateEventW

  WaitForSingleObject

  SetEvent

  LoadLibraryW

  FreeLibrary

  GetProcAddress

  DeleteCriticalSection

  VirtualFree

  LeaveCriticalSection

  EnterCriticalSection

  VirtualAlloc

  CloseHandle

  ResetEvent

  InterlockedExchange

  CancelIo

  Sleep

  DeleteFileW

  GetLastError

  CreateDirectoryW

  GetFileAttributesW

  lstrcpyW

  lstrlenW

  CreateProcessW

  lstrcatW

  FindClose

  FindNextFileW

  lstrcmpW

  FindFirstFileW

  RemoveDirectoryW

  LocalFree

  LocalAlloc

  GetFileSize

  CreateFileW

  ReadFile

  SetFilePointer

  WriteFile

  MoveFileW

  WideCharToMultiByte

  DeviceIoControl

  GetModuleFileNameW

  GetLocalTime

  GetModuleHandleW

  lstrcmpiW

  GetTickCount

  GetModuleHandleA

  GlobalFree

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  GlobalSize

  CopyFileW

  GetStartupInfoW

  PeekNamedPipe

  WaitForMultipleObjects

  OpenProcess

  LocalReAlloc

  LocalSize

  CreateThread

  GetCurrentThreadId

  ReleaseMutex

  OpenEventW

  SetErrorMode

  CreateMutexW

  DuplicateHandle

  GetCurrentProcess

  SetLastError

  SetFileAttributesW

  GetDriveTypeW

  GetExitCodeProcess

  GetVersionExW

  FreeConsole

  lstrcpynW

  GetLocaleInfoW

  GlobalMemoryStatus

  GetComputerNameW

  ExitProcess

  GetSystemDirectoryW

  user32

  CreateWindowExW

  GetProcessWindowStation

  OpenWindowStationW

  SetProcessWindowStation

  PostMessageW

  IsWindow

  ShowWindow

  CloseWindow

  GetWindowTextW

  GetClassNameW

  IsWindowVisible

  GetWindowThreadProcessId

  ReleaseDC

  GetCursorInfo

  GetCursorPos

  GetDC

  SetRect

  GetSystemMetrics

  GetClipboardData

  OpenClipboard

  EmptyClipboard

  SetClipboardData

  CloseClipboard

  WindowFromPoint

  MapVirtualKeyW

  SystemParametersInfoW

  SendMessageW

  DestroyCursor

  wsprintfW

  LoadCursorW

  CharNextW

  msvcrt

  ??2@YAPAXI@Z

  ??1exception@@UAE@XZ

  ??0exception@@QAE@ABV0@@Z

  _adjust_fdiv

  _initterm

  _onexit

  __dllonexit

  ??1type_info@@UAE@XZ

  wcschr

  wcstol

  srand

  rand

  strlen

  strcmp

  wcslen

  wcsrchr

  wcsstr

  _except_handler3

  malloc

  free

  _CxxThrowException

  memcmp

  __CxxFrameHandler

  _ftol

  ceil

  memmove

  memcpy

  ??3@YAXPAX@Z

  ??0exception@@QAE@ABQBD@Z

  memset

  ws2_32

  socket

  Exports

  Exports

  COMResModuleInstance

  DoMain

  Launch

  LpkPresent

  ScriptApplyDigitSubstitution

  ScriptApplyLogicalWidth

  ScriptBreak

  ScriptCPtoX

  ScriptCacheGetHeight

  ScriptFreeCache

  ScriptGetCMap

  ScriptGetFontProperties

  ScriptGetGlyphABCWidth

  ScriptGetLogicalWidths

  ScriptGetProperties

  ScriptIsComplex

  ScriptItemize

  ScriptJustify

  ScriptLayout

  ScriptPlace

  ScriptRecordDigitSubstitution

  ScriptShape

  ScriptStringAnalyse

  ScriptStringCPtoX

  ScriptStringFree

  ScriptStringGetLogicalWidths

  ScriptStringGetOrder

  ScriptStringOut

  ScriptStringValidate

  ScriptStringXtoCP

  ScriptString_pLogAttr

  ScriptString_pSize

  ScriptString_pcOutChars

  ScriptTextOut

  ScriptXtoCP

  ServiceMain

  UspAllocCache

  UspAllocTemp

  UspFreeMem

  Sections

  .text

  Size: 76KB - Virtual size: 73KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 24KB - Virtual size: 22KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 8KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ