NEAS[.]affa601aedab26dce868c4545a1dc2e0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.affa601aedab26dce868c4545a1dc2e0.exe
Size

768KB
MD5

affa601aedab26dce868c4545a1dc2e0
SHA1

22b36d09d9f48922466828f20abb0225a194bdb0
SHA256

7b1f28e1eb5704202b78d2c8b566262d5431905f94e0124b9b8a79f0dd053545
SHA512

65e568eaaa8b64c6ba62d24f3b9a059b75b3e8da54083fd550771cdd7356c96031b7564b7e7ef982c5d1003d1124a5deea9ef2cded867a722225c2c35aa85158
SSDEEP

24576:yllzSmX+43zwwwwwwwwwwwwwwwwwwww8wwwwewwwwwwwwwwwwwwwwwwwwww5wwwi:WrX+6wwwwwwwwwwwwwwwwwwww8wwwwe/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.affa601aedab26dce868c4545a1dc2e0.exe

Files

NEAS.affa601aedab26dce868c4545a1dc2e0.exe
.exe windows:5 windows x86

aa33d98c611f6d78b014f19ebe39ab73

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileSize
OpenFile
GetModuleFileNameA
HeapFree
lstrcatA
lstrcpyA
lstrlenA
lstrcmpW
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleHandleW
ExitProcess
CreateMutexW
CreateFileW
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetProcessHeap
GetConsoleCP
SetFilePointer
GetStringTypeW
LCMapStringW
OutputDebugStringW
WriteConsoleW
OutputDebugStringA
HeapQueryInformation
HeapSize
HeapReAlloc
RtlUnwind
GetLocaleInfoW
InterlockedExchange
SetConsoleCtrlHandler
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
HeapAlloc
ReadFile
OpenProcess
SuspendThread
GetSystemInfo
VirtualQueryEx
ReadProcessMemory
lstrlenW
ResumeThread
lstrcpyW
GetCurrentProcess
GetLastError
GetConsoleMode
CloseHandle
VirtualQuery
WriteFile
GetModuleFileNameW
FlushFileBuffers
HeapDestroy
HeapCreate
GetCurrentThread
SetLastError
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
WideCharToMultiByte
IsDebuggerPresent
MultiByteToWideChar
RaiseException
GetProcAddress
LoadLibraryW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InterlockedIncrement
InterlockedDecrement
HeapValidate
IsBadReadPtr
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree

user32

ReleaseDC
UpdateWindow
SetForegroundWindow
ShowWindow
SendMessageW
SetWindowTextW
SendMessageA
GetMessageA
TranslateMessage
DispatchMessageA
LoadCursorA
LoadIconA
RegisterClassW
SetWindowRgn
GetWindowTextA
SetWindowTextA
DefWindowProcA
SetTimer
CreateWindowExA
CreateWindowExW
SetWindowLongA
CallWindowProcA
GetDC
GetForegroundWindow
GetClassNameW
FindWindowExW
GetWindowThreadProcessId
MoveWindow

gdi32

CreateRoundRectRgn
GetObjectA
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
CreateFontIndirectA
CreateDIBitmap
GetDeviceCaps

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

ws2_32

sendto
htons
WSACleanup
socket
WSAStartup
closesocket
inet_addr

Sections

.textbss
Size: - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 347KB - Virtual size: 346KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa33d98c611f6d78b014f19ebe39ab73

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ws2_32

Sections

.textbss Size: - Virtual size: 152KB

.text Size: 328KB - Virtual size: 328KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 5KB - Virtual size: 14KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 347KB - Virtual size: 346KB

.reloc Size: 16KB - Virtual size: 15KB

.textbss
Size: - Virtual size: 152KB

.text
Size: 328KB - Virtual size: 328KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 5KB - Virtual size: 14KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 347KB - Virtual size: 346KB

.reloc
Size: 16KB - Virtual size: 15KB