NEAS[.]5df0ccd96d24de67fdacbd089df9d600[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NEAS.5df0ccd96d24de67fdacbd089df9d600.exe
Size 182KB
Sample231112-3nfcnsed36
SHA256 5e124ff4fd05b4a965ae522c138590c5b78682a76a57f83f6e73664bbbf98fba
MD5 5df0ccd96d24de67fdacbd089df9d600
SHA1 56c0bdda19a6fa87c1fa096e262d7e3e7f32a930
SHA512 06f27b6efceaff714af45899f02f80956345853eb7e945a9c2a0aee89d430879436791d4b5abc8dd57aa3640b3d3069c83b7cdf1ccb538e404b9e581c060f7f9
SSDEEP 3072:PT7E5rMbL4bOi2omRbSkYSGY9GYCmoFqihpjRoIeXBJKDcQy:P8rMbL4bOR6i7ihpjOK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.5df0ccd96d24de67fdacbd089df9d600.exe

File Explorer

NEAS.5df0ccd96d24de67fdacbd089df9d600.exe

.exe 182KB

NEAS.5df0ccd96d24de67fdacbd089df9d600.exe

IMPHASH e5572fada1e7f918bbbaa808b26bb150
SHA256 5e124ff4fd05b4a965ae522c138590c5b78682a76a57f83f6e73664bbbf98fba
MD5 5df0ccd96d24de67fdacbd089df9d600
SHA1 56c0bdda19a6fa87c1fa096e262d7e3e7f32a930
SHA512 06f27b6efceaff714af45899f02f80956345853eb7e945a9c2a0aee89d430879436791d4b5abc8dd57aa3640b3d3069c83b7cdf1ccb538e404b9e581c060f7f9
SSDEEP 3072:PT7E5rMbL4bOi2omRbSkYSGY9GYCmoFqihpjRoIeXBJKDcQy:P8rMbL4bOR6i7ihpjOK
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcp_win

?_Xlength_error@std@@YAXPBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vsnprintf_s _o___stdio_common_vswprintf _o__callnewh _o__cexit _o__configthreadlocale _o__configure_wide_argv _o__controlfp_s _o__crt_atexit _o__errno _o__exit _o__get_initial_wide_environment _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__register_onexit_function _o__seh_filter_exe memmove _o__set_app_type _o__set_fmode _o__set_new_mode _o_exit _o_free _o_malloc _o_realloc _o_terminate _o_toupper _o_wcstoll _except_handler4_common _CxxThrowException _o___std_exception_destroy _o___std_exception_copy _o___p__commode _o___p___wargv _o___p___argc __CxxFrameHandler3 memcpy

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleHandleW GetModuleFileNameW GetModuleFileNameA GetModuleHandleExW

api-ms-win-core-heap-l1-1-0

HeapAlloc GetProcessHeap HeapFree

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess GetCurrentThreadId TerminateProcess GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

FormatMessageW

oleaut32

VariantChangeType SysAllocStringByteLen VariantInit LoadTypeLi VariantClear DispGetIDsOfNames SysStringByteLen SysFreeString

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW DebugBreak

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags UnregisterTraceGuids RegisterTraceGuidsW TraceMessage

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive CreateEventW InitializeCriticalSection AcquireSRWLockExclusive WaitForSingleObject DeleteCriticalSection SetEvent

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter SetLastError RaiseException

api-ms-win-core-com-l1-1-0

CoUninitialize CoInitializeEx CoCreateInstance CLSIDFromProgID

api-ms-win-core-io-l1-1-1

CancelIo

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-namedpipe-l1-1-0

ConnectNamedPipe CreateNamedPipeW

api-ms-win-core-file-l1-1-0

ReadFile WriteFile

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjects

api-ms-win-rtcore-ntuser-window-l1-1-0

PeekMessageW TranslateMessage DispatchMessageW

api-ms-win-eventing-provider-l1-1-0

EventUnregister EventWriteTransfer EventSetInformation EventProviderEnabled EventRegister

api-ms-win-core-heap-l2-1-0

LocalAlloc

api-ms-win-core-synch-l1-2-0

Sleep