NEAS[.]da3640f74d78d97f2a4976f419be6ea0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.da3640f74d78d97f2a4976f419be6ea0.exe
Size

705KB
MD5

da3640f74d78d97f2a4976f419be6ea0
SHA1

5a27ad0642787f76bfe03cbd27c1f9279e8d3527
SHA256

b29172fd8d82adf77e796d50f147d7d5e04d6121ce2429bfc436c8725846784e
SHA512

b6bd50df50ab23150bbd5c1cdc18b51de595cd097ed12b2fcb7d70017fc95c701f0075c1342e2176aa224a5ce33d279e5c82a23a2d3f76ff90756040de54a68d
SSDEEP

12288:ukya9CqY8xewVHK6RgIZOWzxZqfny+LSe5/9qRA8YAC88iA0QWNtM:5yh8xNqPIDnITSe5/9jSC8A0LE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.da3640f74d78d97f2a4976f419be6ea0.exe

Files

NEAS.da3640f74d78d97f2a4976f419be6ea0.exe
.exe windows:6 windows x64

364ce282a93e03a146321d365523e1d1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCommandLineW
TlsGetValue
UnregisterWait
TlsFree
TlsAlloc
LocalAlloc
ExpandEnvironmentStringsW
SetFileAttributesW
LocalFree
DeleteFileW
DeleteCriticalSection
FindNextFileW
IsDebuggerPresent
LockResource
FindClose
GetModuleFileNameW
GetExitCodeProcess
FormatMessageW
GetCurrentThread
CreateDirectoryW
LoadLibraryExW
CreateProcessW
LoadResource
FindResourceW
FindFirstFileW
GetThreadContext
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetFullPathNameW
FreeLibrary
SetEvent
WaitForSingleObjectEx
OutputDebugStringW
QueryFullProcessImageNameW
CreateEventA
CreateFileW
GetLastError
GetProcAddress
ResetEvent
GetLocalTime
LoadLibraryA
QueueUserWorkItem
CloseHandle
DebugBreak
GetSystemWindowsDirectoryA

ole32

CoCreateInstance
StringFromGUID2
CoGetObjectContext
CoInitializeEx
CoUninitialize

msvcrt

__CxxFrameHandler3
??1type_info@@UEAA@XZ
_wfopen
memcpy
_CxxThrowException
memset
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_fmode
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBDH@Z
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_purecall
_commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
free
_callnewh
malloc
wcschr
_wstrdate
_waccess
_wstrtime
_wcsicmp
_vsnwprintf
fwprintf
fflush
fopen
fprintf
fclose
wcsrchr
_local_unwind

msdtctm

ord4

ntdll

RtlReportException
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

version

VerQueryValueW

user32

GetWindowRect
GetThreadDesktop
CloseWindowStation
DialogBoxParamW
GetProcessWindowStation
OpenDesktopW
GetClientRect
SetProcessWindowStation
EndDialog
GetDesktopWindow
SetWindowPos
SetThreadDesktop
SetDlgItemTextW
OpenWindowStationW
MapWindowPoints
LoadStringW
CloseDesktop

advapi32

RegOpenKeyExW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExA
DeregisterEventSource
RegQueryValueExW
RegQueryValueExA

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

364ce282a93e03a146321d365523e1d1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

msvcrt

msdtctm

ntdll

version

user32

advapi32

Sections

.text Size: 39KB - Virtual size: 38KB

.data Size: 1KB - Virtual size: 10KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 94KB - Virtual size: 94KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 39KB - Virtual size: 38KB

.data
Size: 1KB - Virtual size: 10KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 94KB - Virtual size: 94KB

.reloc
Size: 568KB - Virtual size: 572KB