NEAS[.]11bfb7d14dcf76506fe0b27f5edaf470[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.11bfb7d14dcf76506fe0b27f5edaf470.exe
Size

1.1MB
MD5

11bfb7d14dcf76506fe0b27f5edaf470
SHA1

2870d8dbfc0b9d7f0ede8ad0c64f64252ce1cb54
SHA256

319169e51dd4b0daf9b1f7789679d70791ed1acf92fcba2c0596d84a667e8c9e
SHA512

e13f27bd3a60d91f459791b88fb97d693313f7ce15d30c3c798512d10e4e585ec39738d948fc19176cba8661fc7ba8b6c582a6ed8d0fb09bbe8816915f30a0ca
SSDEEP

24576:iFDe+T1zY4PABNnCmtfKxhqtyZTbm/KMZvTQaFD43WAp0E7ch:Sy4I/DtTQv3Rp0E7c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.11bfb7d14dcf76506fe0b27f5edaf470.exe

Files

NEAS.11bfb7d14dcf76506fe0b27f5edaf470.exe
.dll windows:6 windows x86

41bebae527fe60181304d1fa15e5e4a3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

__dllonexit
?terminate@@YAXXZ
_lock
_onexit
memcpy
??1type_info@@UAE@XZ
_unlock
_CIsqrt
_CIexp
_CIcos
_except_handler4_common
_amsg_exit
_initterm
realloc
sscanf
_CxxThrowException
free
malloc
_ftol2_sse
_CIpow
_strlwr
wcsrchr
fclose
fprintf
atoi
_stricmp
memset
_errno
exp
_CIlog10
_vsnprintf
__CxxFrameHandler3
_purecall
_XcptFilter
_aligned_malloc
_aligned_free
_CIlog
memmove
fflush
fwrite
fopen
floor

user32

SetClipboardData
CloseClipboard
SetWindowPos
EmptyClipboard
GetForegroundWindow
IsWindowVisible
ShowWindow
IsZoomed
SetRectEmpty
UnionRect
SystemParametersInfoA
GetSystemMetrics
SetRect
GetWindowInfo
OffsetRect
EnumDisplaySettingsA
GetDC
ReleaseDC
GetMonitorInfoA
IntersectRect
DefWindowProcA
OpenClipboard
GetWindowRect
GetKeyState
PostMessageA
IsIconic
SendMessageA
CallWindowProcA
SetForegroundWindow
DestroyIcon
SetCursor
GetCursor
CreateIconIndirect
GetWindowDC
GetDesktopWindow
GetIconInfo
SetCursorPos
GetCursorPos
SetWindowLongA
GetWindowThreadProcessId
IsWindow
UnregisterHotKey
RegisterHotKey
GetThreadDesktop
CloseDesktop
GetUserObjectInformationA
OpenInputDesktop
EnumDisplayDevicesA
ClientToScreen
GetClientRect
GetWindowLongA

advapi32

RegOpenKeyA
RegEnumKeyA
RegCloseKey
InitializeAcl
RegCreateKeyA
RegSetValueExA
GetLengthSid
IsValidSid
SetSecurityInfo
ConvertStringSidToSidA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
GetSidSubAuthority
InitializeSid
GetSidLengthRequired
RegOpenKeyExA
RegQueryValueExA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ntdll

VerSetConditionMask
WinSqmIsOptedIn
WinSqmAddToStreamEx

d3d8thk

OsThunkD3dContextDestroyAll
OsThunkDdUnlockD3D
OsThunkDdUnlock
OsThunkDdSetExclusiveMode
OsThunkDdFlipToGDISurface
OsThunkDdGetDriverInfo
OsThunkDdDeleteDirectDrawObject
OsThunkDdReleaseDC
OsThunkDdReenableDirectDrawObject
OsThunkDdDestroyD3DBuffer
OsThunkDdDestroySurface
OsThunkDdDeleteSurfaceObject
OsThunkDdSetGammaRamp
OsThunkDdCreateSurface
OsThunkDdCreateD3DBuffer
OsThunkDdAttachSurface
OsThunkDdCreateSurfaceObject
OsThunkDdCanCreateSurface
OsThunkDdQueryDirectDrawObject
OsThunkDdBlt
OsThunkDdGetDC
OsThunkDdGetAvailDriverMemory
OsThunkDdGetScanLine
OsThunkDdWaitForVerticalBlank
OsThunkDdGetFlipStatus
OsThunkDdGetBltStatus
OsThunkDdLock
OsThunkDdLockD3D
OsThunkDdResetVisrgn
OsThunkDdFlip
OsThunkD3dDrawPrimitives2
OsThunkD3dValidateTextureStageState
OsThunkDdGetDriverState
OsThunkD3dContextDestroy
OsThunkD3dContextCreate
OsThunkDdCreateSurfaceEx
OsThunkDdCanCreateD3DBuffer

gdi32

D3DKMTDestroyContext
D3DKMTCreateSynchronizationObject
D3DKMTDestroySynchronizationObject
D3DKMTWaitForSynchronizationObject
D3DKMTSignalSynchronizationObject
D3DKMTGetRuntimeData
D3DKMTQueryAdapterInfo
D3DKMTLock
D3DKMTUnlock
D3DKMTGetDisplayModeList
D3DKMTSetDisplayMode
D3DKMTGetMultisampleMethodList
D3DKMTPresent
D3DKMTRender
D3DKMTCloseAdapter
D3DKMTGetSharedPrimaryHandle
D3DKMTEscape
D3DKMTSetVidPnSourceOwner
D3DKMTSetGammaRamp
D3DKMTGetDeviceState
D3DKMTCreateContext
D3DKMTDestroyDCFromMemory
D3DKMTGetScanLine
D3DKMTSetDisplayPrivateDriverFormat
D3DKMTSharedPrimaryLockNotification
D3DKMTSharedPrimaryUnLockNotification
CreateCompatibleDC
SelectObject
GetNearestColor
GetDeviceCaps
SetStretchBltMode
GetDeviceGammaRamp
GdiEntry1
GdiEntry13
CreateDCA
DeleteDC
CreateCompatibleBitmap
GetDIBits
CreateRectRgn
GetRandomRgn
DeleteObject
GetRegionData
BitBlt
D3DKMTDestroyDevice
D3DKMTCreateDevice
D3DKMTQueryAllocationResidency
D3DKMTSetAllocationPriority
D3DKMTDestroyAllocation
D3DKMTOpenResource2
D3DKMTOpenResource
D3DKMTQueryResourceInfo
D3DKMTCreateAllocation2
D3DKMTCreateAllocation
D3DKMTOpenAdapterFromHdc
GetSystemPaletteEntries
CreateDIBitmap
GetObjectA
D3DKMTCreateDCFromMemory
StretchBlt

kernel32

VirtualProtect
WaitForSingleObject
ReleaseMutex
GetLastError
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
FreeLibrary
GetProcAddress
LoadLibraryA
GetNativeSystemInfo
VirtualFree
VirtualAlloc
GetVersionExA
GetSystemInfo
GetModuleFileNameA
IsProcessorFeaturePresent
InterlockedDecrement
HeapFree
GetModuleHandleA
HeapAlloc
GetProcessHeap
CloseHandle
LocalFree
OpenMutexA
CreateMutexA
DisableThreadLibraryCalls
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
PeekNamedPipe
WriteFile
ReadFile
FlushFileBuffers
DisconnectNamedPipe
SetNamedPipeHandleState
ConnectNamedPipe
OutputDebugStringA
LoadLibraryW
OutputDebugStringW
DebugBreak
GlobalAddAtomA
lstrcmpA
CreateSemaphoreA
ReleaseSemaphore
InterlockedExchange
lstrlenA
GetSystemDirectoryA
GetCurrentProcess
MultiByteToWideChar
CreateFileA
WideCharToMultiByte
GetCurrentProcessId
LocalAlloc
VerifyVersionInfoA
InterlockedIncrement
InterlockedCompareExchange
Sleep
GetTickCount
SetErrorMode

dwmapi

ord100
ord101
ord129
ord130

Exports

Exports

DebugSetMute
Direct3DCreate8
ValidatePixelShader
ValidateVertexShader

Sections

.text
Size: 972KB - Virtual size: 971KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

41bebae527fe60181304d1fa15e5e4a3

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

user32

advapi32

version

ntdll

d3d8thk

gdi32

kernel32

dwmapi

Exports

Exports

Sections

.text Size: 972KB - Virtual size: 971KB

.data Size: 9KB - Virtual size: 28KB

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 169KB - Virtual size: 168KB

.text
Size: 972KB - Virtual size: 971KB

.data
Size: 9KB - Virtual size: 28KB

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 169KB - Virtual size: 168KB