NEAS[.]73ed447c2870097bc6fd23c353162450[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.73ed447c2870097bc6fd23c353162450.exe
Size

443KB
MD5

73ed447c2870097bc6fd23c353162450
SHA1

ca639566920b6e9255e7b8a05403396f922f1ece
SHA256

26e8eaf3b47595edf7f577e3dbbfde6563bc456c64c75a4923bc6dc8c0e65761
SHA512

eed44a26f76390e474156548997b524c481328b1e27282e4586c7af562b7cf90d8224105f843d417ccd9732f36bae8b2d9ca45dacf5a094078ce8b7cdcc526f3
SSDEEP

6144:w7dfpiMnohUjv5pfPgvKnKnPLIIfvAK7aVKK8627vdgS9z/rLyqbgihp8oqFh:wJfpihAhi6KnPPz7aVKNvdx9LyqE1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.73ed447c2870097bc6fd23c353162450.exe

Files

NEAS.73ed447c2870097bc6fd23c353162450.exe
.dll windows:10 windows x86

9ecc07e602d22f0afd7c8a0281cf472c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

wcspbrk
malloc
swprintf_s
_heapmin
_snprintf_s
_splitpath_s
towupper
bsearch
_wsplitpath_s
modf
_itow
memmove
_wcsnicmp
iswctype
_except_handler4_common
_initterm
_amsg_exit
_XcptFilter
strtod
_errno
strncpy_s
_ecvt
_mbsrev
_strnicmp
localtime
time
strchr
_ultoa
_ltoa
towlower
_wstat
wcscspn
swscanf_s
sprintf_s
strcat_s
wcstol
wcsstr
wcsncat_s
_wchdir
wcscat_s
wcschr
strcpy_s
_getcwd
wcsrchr
wcstok
_ltow
_snwprintf_s
floor
_ftol2_sse
_vsnwprintf_s
calloc
free
_wtol
_wfullpath
_wcsicmp
_wtoi
wcsncmp
wcscpy_s
wcsncpy_s
memcpy
_ftol2
memset

kernel32

LoadLibraryA
OutputDebugStringW
ExpandEnvironmentStringsA
GetModuleFileNameW
EnterCriticalSection
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetNumberFormatA
GetCurrencyFormatA
GetTimeFormatA
GetDateFormatA
FreeResource
LockResource
LoadResource
FindResourceW
CloseHandle
CreateFileW
MoveFileW
GetTempFileNameW
GetTempPathW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
lstrlenW
GetCurrentProcessId
GetProcessVersion
DeleteCriticalSection
InitializeCriticalSection
WritePrivateProfileStringW
GetWindowsDirectoryW
GetCurrentDirectoryW
GetSystemDirectoryW
LeaveCriticalSection
GetUserDefaultLCID
GetPrivateProfileStringW
MultiByteToWideChar
GetModuleFileNameA
LoadLibraryExA
GetLastError
GetProcAddress
FreeLibrary
WideCharToMultiByte
GetCurrentThreadId
GetSystemDefaultLCID

user32

ReleaseDC
SetCursor
GetDC
CharToOemA
DestroyWindow
CreateDialogParamW
CharUpperW
SetWindowPos
LoadStringW
MoveWindow
ClientToScreen
GetClientRect
GetWindowRect
GetDesktopWindow
GetParent
RegisterWindowMessageA
GetWindowTextLengthW
ShowWindow
GetWindow
SetFocus
IsWindowEnabled
LoadCursorA
EnableWindow
CharLowerW
DialogBoxParamA
EndDialog
SetWindowLongA
GetWindowLongA
GetWindowTextW
DialogBoxParamW
SendMessageW
GetDlgItem
SetWindowTextW
LoadCursorW
MessageBoxW

advapi32

RegOpenKeyExW
RegOpenKeyExA
GetUserNameW
RegQueryValueExW
RegEnumKeyExW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
RegCloseKey

gdi32

GetTextExtentPointW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

msjet40

ord110
ord112
ord185
ord157
ord56
ord304
ord108
ord316
ord158
ord172
ord179
ord159
ord120
ord310
ord126
ord317
ord136
ord145
ord133
ord140
ord132
ord151
ord138
ord178
ord137
ord319
ord302
ord156
ord311
ord146
ord107
ord104
ord109
ord169
ord153
ord130
ord176
ord103
ord154
ord150
ord906
ord167

mswstr10

ord3

Exports

Exports

AdvancedDialogProc
ConfigDSN
ConfigDSNExW
ConfigDSNW
ConfigDialogProc
ConfigDriverW
DefTxtFmtDlgProc
DllMain
InitDialogAgain
InitializeLoginDialog
InvisibleSelectDb
LoadByOrdinal
LoginDialogProc
OpenDirHook
RepairCompactProc
SQLAllocConnect
SQLAllocEnv
SQLAllocHandle
SQLAllocStmt
SQLBindCol
SQLBindParameter
SQLBulkOperations
SQLCancel
SQLCloseCursor
SQLColAttributeW
SQLColumnsW
SQLConnectW
SQLCopyDesc
SQLDescribeColW
SQLDisconnect
SQLDriverConnectW
SQLEndTran
SQLExecDirectW
SQLExecute
SQLExtendedFetch
SQLFetch
SQLFetchScroll
SQLFreeConnect
SQLFreeEnv
SQLFreeHandle
SQLFreeStmt
SQLGetConnectAttrW
SQLGetCursorNameW
SQLGetData
SQLGetDescFieldW
SQLGetDescRecW
SQLGetDiagFieldW
SQLGetDiagRecW
SQLGetFunctions
SQLGetInfoW
SQLGetStmtAttrW
SQLGetTypeInfoW
SQLMoreResults
SQLNativeSqlW
SQLNumParams
SQLNumResultCols
SQLParamData
SQLPrepareW
SQLProcedureColumnsW
SQLProceduresW
SQLPutData
SQLRowCount
SQLSetConnectAttrW
SQLSetCursorNameW
SQLSetDescFieldW
SQLSetDescRec
SQLSetEnvAttr
SQLSetPos
SQLSetScrollOptions
SQLSetStmtAttrW
SQLSpecialColumnsW
SQLStatisticsW
SQLTablesW
SelectIndexDlgProc
SelectUIdxDlgProc

Sections

.text
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9ecc07e602d22f0afd7c8a0281cf472c

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

user32

advapi32

gdi32

comdlg32

msjet40

mswstr10

Exports

Exports

Sections

.text Size: 236KB - Virtual size: 235KB

.data Size: 20KB - Virtual size: 21KB

.idata Size: 4KB - Virtual size: 4KB

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 147KB - Virtual size: 147KB

.text
Size: 236KB - Virtual size: 235KB

.data
Size: 20KB - Virtual size: 21KB

.idata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 147KB - Virtual size: 147KB