NEAS[.]e3bd9729be1e0d8f37adcabfe421e000[.]exe

General

Target

NEAS.e3bd9729be1e0d8f37adcabfe421e000.exe
Size

20KB
MD5

e3bd9729be1e0d8f37adcabfe421e000
SHA1

ac51e1ac5f85618dbb5156ca47c10da1d332d10d
SHA256

9c372d09dde0ad916fea0adda6fd12fa6828f27c16d9dbd47abb5bd8c398ba3c
SHA512

e1c46add4c975588b10cbef90f090664f31681687f22b534509b758e04bea7351e8a22d98fc876143b00f15ddeb8e16dfe30cba432b6366372b7d0d85ef243be
SSDEEP

384:eH+f/tNxhdi3Las4O3R8v0qIuoskBFHUEkzpTsx90H8kyV9j3T3s+29yVX1R4d:eH+f/tzi3WO2vmAkBS5z6x9C8kmjsX9D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.e3bd9729be1e0d8f37adcabfe421e000.exe

Files

NEAS.e3bd9729be1e0d8f37adcabfe421e000.exe
.dll windows:5 windows x64

66546c6f2293f35ade72e797d3fc07b2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ntoskrnl.exe

KeDelayExecutionThread
MmGetSystemRoutineAddress
RtlInitUnicodeString
KeInitializeEvent
PsRemoveLoadImageNotifyRoutine
PsSetLoadImageNotifyRoutine
DbgPrint
PsSetCreateProcessNotifyRoutineEx
MmIsAddressValid
ObfDereferenceObject
IoThreadToProcess
PsLookupThreadByThreadId
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
RtlGetVersion
ZwClose
ZwQueryInformationFile
ZwCreateFile
_itoa_s
RtlTimeToTimeFields
ExSystemTimeToLocalTime
RtlCompareMemory
ExAllocatePoolWithTag
ExFreePoolWithTag
PsCreateSystemThread
IoCreateSymbolicLink
IoCreateDevice
__C_specific_handler
atoi
strstr
strlen
_vsnprintf
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetLowerDeviceObject
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
KeSetEvent
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

66546c6f2293f35ade72e797d3fc07b2

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 14KB - Virtual size: 14KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 18KB

.pdata Size: 512B - Virtual size: 456B

INIT Size: 1KB - Virtual size: 1KB

.text
Size: 14KB - Virtual size: 14KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 18KB

.pdata
Size: 512B - Virtual size: 456B

INIT
Size: 1KB - Virtual size: 1KB