NEAS[.]b5d38b559cc0c5465cc138828396e8d0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.b5d38b559cc0c5465cc138828396e8d0.exe
Size

238KB
MD5

b5d38b559cc0c5465cc138828396e8d0
SHA1

b3d8e4c8a25d7ff8149153223f420c8a7012a7fa
SHA256

1d7c16c1e0a12b129ca9027d6d9ace7be8aac6d98b43e79e34e617f8879b895f
SHA512

b77944275edee96762203288f363b55feeeadceb8b7c018f47caa7233740e86ae235ee0983a7cd59fe3aa16cea33637e8f37f5ca021503cc7343215db3df1dcb
SSDEEP

3072:9NhHzOE9opb9Bj4zPVr1UM8W3N88QUrqm3OBDHWBFdlIN+0PF6eDQKWQ7:9NhTBiLBj4O688NeF8wqKWi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.b5d38b559cc0c5465cc138828396e8d0.exe

Files

NEAS.b5d38b559cc0c5465cc138828396e8d0.exe
.exe windows:6 windows x86

0f6519c66222fafec2310abbbdca3ed0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRenameExtensionA
StrChrIW
PathIsUNCServerShareW
PathGetCharTypeW
SHRegQueryInfoUSKeyW
UrlApplySchemeW
SHRegGetUSValueW
PathRemoveBlanksW

kernel32

WriteConsoleW
SetStdHandle
OutputDebugStringW
LoadLibraryExW
SetCurrentDirectoryW
CreateSemaphoreA
GlobalFlags
Sleep
VirtualAlloc
EnumSystemCodePagesA
GetConsoleWindow
ReadConsoleW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetCurrentThreadId
CreateFileW
SetEndOfFile
HeapFree
SetFilePointerEx
ReadFile
GetFileType
GetConsoleMode
GetConsoleCP
FlushFileBuffers
CloseHandle
GetModuleFileNameW
WriteFile
GetStdHandle
GetProcessHeap
IsDebuggerPresent
HeapSize
AreFileApisANSI
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
GetLastError
HeapAlloc
RaiseException
RtlUnwind
GetCommandLineA
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress

odbc32

ord8
ord12
ord250
ord153
ord127
ord49

mswsock

sethostname
GetAddressByNameW
MigrateWinsockConfiguration
rcmd
GetNameByTypeA

comdlg32

CommDlgExtendedError
ChooseColorA
ReplaceTextA

wsnmp32

ord401
ord202
ord903
ord601
ord100

resutils

ResUtilFreeParameterBlock
ResUtilGetBinaryValue
ResUtilStopService

user32

GetKeyboardType
ShowWindow
CallMsgFilterW
IsDialogMessageA
CreatePopupMenu
EndDeferWindowPos
BlockInput
GetClipCursor
ModifyMenuW

ole32

CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SysAllocString
VariantInit

Sections

.text
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f6519c66222fafec2310abbbdca3ed0

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

odbc32

mswsock

comdlg32

wsnmp32

resutils

user32

ole32

oleaut32

Sections

.text Size: 188KB - Virtual size: 187KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 7KB - Virtual size: 15KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 188KB - Virtual size: 187KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 7KB - Virtual size: 15KB

.reloc
Size: 7KB - Virtual size: 6KB