NEAS[.]99d4f72ae3890f8313b8d2cd631ce2a0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NEAS.99d4f72ae3890f8313b8d2cd631ce2a0.exe
Size 1.1MB
Sample231115-aml5lsha85
SHA256 e02f9227ac23ab107053351d3806f105766afe4652474a4cf06ddb915d2f61c4
MD5 99d4f72ae3890f8313b8d2cd631ce2a0
SHA1 3495df4d5ba737d4fbab4f964cd7467d33af79ba
SHA512 c925f7f908081f482678140c6063462bb273c799b61edb17b1d45abf0ba541c240c4e259086706436685c9450eaf854fb6eddd3fd5ff182bb769b3fd6f9fa397
SSDEEP 24576:DNMCnXnMzKGBBxfZAKOf7JI9XjGKOf7JI9XKK:DNuzzzZeJSXjAJSX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.99d4f72ae3890f8313b8d2cd631ce2a0.exe

File Explorer

NEAS.99d4f72ae3890f8313b8d2cd631ce2a0.exe

.exe 1.1MB

NEAS.99d4f72ae3890f8313b8d2cd631ce2a0.exe

IMPHASH e17f7b1d002ab984875bfae146483af9
SHA256 e02f9227ac23ab107053351d3806f105766afe4652474a4cf06ddb915d2f61c4
MD5 99d4f72ae3890f8313b8d2cd631ce2a0
SHA1 3495df4d5ba737d4fbab4f964cd7467d33af79ba
SHA512 c925f7f908081f482678140c6063462bb273c799b61edb17b1d45abf0ba541c240c4e259086706436685c9450eaf854fb6eddd3fd5ff182bb769b3fd6f9fa397
SSDEEP 24576:DNMCnXnMzKGBBxfZAKOf7JI9XjGKOf7JI9XKK:DNuzzzZeJSXjAJSX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29856

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess GetFileSize GlobalDeleteAtom SetFilePointer TlsGetValue GetConsoleAliasExesA SetLocalTime CommConfigDialogA GetProcessIoCounters FreeLibrary InterlockedDecrement ZombifyActCtx GetNamedPipeHandleStateA CreateDirectoryW GetProfileSectionA SetComputerNameW GetComputerNameW SetTapeParameters GetTickCount CreateNamedPipeW GetConsoleAliasesLengthA GetPrivateProfileStringW WriteFile EnumTimeFormatsW WriteFileGather CreateDirectoryExW SetProcessPriorityBoost GetSystemDirectoryW LoadLibraryW GetConsoleMode SetCommConfig _hread SizeofResource GetSystemWow64DirectoryW SetSystemTimeAdjustment GetSystemWindowsDirectoryA GetVersionExW InterlockedPopEntrySList GlobalFlags GetAtomNameW ReadFile GetBinaryTypeW GetOverlappedResult CompareStringW lstrlenW GlobalUnlock VerifyVersionInfoW GetStartupInfoA GetCurrentDirectoryW ReadConsoleOutputCharacterA GetProcessHeaps GetComputerNameExW WriteProfileSectionA SetStdHandle FreeUserPhysicalPages VerLanguageNameW LoadLibraryA Process32FirstW LocalAlloc SetCalendarInfoW SetConsoleCtrlHandler SetCurrentDirectoryW VirtualLock SetConsoleWindowInfo FindAtomA GetTapeParameters WriteProfileStringA WTSGetActiveConsoleSessionId SetConsoleTitleW GetProcessShutdownParameters QueryMemoryResourceNotification FreeEnvironmentStringsW VirtualProtect GetFileAttributesExW GetCPInfoExA _lopen GetWindowsDirectoryW GetVersion GetVolumeNameForVolumeMountPointW GetCurrentProcessId FindActCtxSectionStringW LCMapStringW CopyFileExA DeleteFileA InterlockedIncrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW GetCommandLineA HeapValidate IsBadReadPtr RaiseException RtlUnwind GetProcAddress GetModuleHandleW TlsAlloc TlsSetValue GetCurrentThreadId TlsFree SetLastError GetLastError GetACP GetOEMCP GetCPInfo IsValidCodePage DebugBreak GetStdHandle OutputDebugStringA WriteConsoleW GetFileType OutputDebugStringW QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW SetHandleCount HeapDestroy HeapCreate HeapFree VirtualFree FlushFileBuffers GetConsoleCP HeapAlloc HeapSize HeapReAlloc VirtualAlloc MultiByteToWideChar GetStringTypeA GetStringTypeW GetLocaleInfoA LCMapStringA InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP GetModuleHandleA CloseHandle CreateFileA

user32

GetCursorInfo

Name

.text

Size

660KB

Virtual Size

659KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

52KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

VxHFGOUW

Size

2KB

Virtual Size

1KB

Characteristics

Name

VrQkWoog

Size

14KB

Virtual Size

14KB

Characteristics

Name

fnNiyEdQ

Size

9KB

Virtual Size

9KB

Characteristics

Name

vtvJQODM

Size

2KB

Virtual Size

2KB

Characteristics

Name

iSCJbZzC

Size

512B

Virtual Size

247B

Characteristics

Name

BXZUMckp

Size

1024B

Virtual Size

974B

Characteristics

Name

mWTyyksN

Size

196KB

Virtual Size

196KB

Characteristics

Name

WesOocau

Size

5KB

Virtual Size

5KB

Characteristics

Name

JplMhoVo

Size

54KB

Virtual Size

53KB

Characteristics

Name

ArfapILu

Size

18KB

Virtual Size

17KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

NEAS.99d4f72ae3890f8313b8d2cd631ce2a0.exe

kernel32

user32

generic