NEAS[.]c273d717812dbbc6f5f24e86bca8b6d0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NEAS.c273d717812dbbc6f5f24e86bca8b6d0.exe
Size

4.5MB
MD5

c273d717812dbbc6f5f24e86bca8b6d0
SHA1

f82be267a9cf3c1a9efc7d033deb8697034e8852
SHA256

b3b0555b422e93e10a53e761baf8ce1beea51bf8e3d01a0812db1f9c022b9d5c
SHA512

6bb4cafeda1f32103c053a2d74ac49244d4f93b43819a140d2c5fd3d53cb29db5be2b42864da3cfd4ea03e89bcec38735a49c34c864f7daa92ad3f3f1b464e3c
SSDEEP

98304:jZCk5ZjXckSKCqcfIPNnw8CncZhaunt2n5C/E1zk7Vx3HbZe:jZCk0lmuI2cZ0utu8czWVxrE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c273d717812dbbc6f5f24e86bca8b6d0.exe

Files

NEAS.c273d717812dbbc6f5f24e86bca8b6d0.exe
.exe windows:5 windows x86

dfc8645270ceb59f393a21b56cbd94ee

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetWaitableTimer
CreateToolhelp32Snapshot
Process32First
Process32Next
IsWow64Process
VirtualAllocEx
WriteProcessMemory
WaitForSingleObject
GetExitCodeThread
GetModuleFileNameW
GetEnvironmentVariableW
SetPriorityClass
GetCurrentThread
SetThreadPriority
ExitProcess
MultiByteToWideChar
GetCurrentProcessId
GlobalAlloc
GlobalFree
lstrlenW
WideCharToMultiByte
CreateWaitableTimerA
GetTempPathW
QueryDosDeviceW
TerminateProcess
GetProcessHeap
GetModuleHandleA
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
ReadFile
GetFileSize
CreateFileA
DeleteFileA
GetEnvironmentVariableA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
RtlMoveMemory
CloseHandle
lstrcpyn
OpenProcess
GetCurrentProcess
Module32First
OpenEventA
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

TranslateMessage
wsprintfA
MessageBoxA
MsgWaitForMultipleObjects
DispatchMessageA
GetMessageA
PeekMessageA

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
SHChangeNotify

psapi

GetProcessImageFileNameW

msvcrt

realloc
calloc
strstr
malloc
_stricmp
sprintf
atoi
_ftol
strrchr
strchr
free

shlwapi

PathFileExistsA

oleaut32

VariantTimeToSystemTime

Sections

.text
Size: - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pn0
Size: - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.(n(
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.%pv
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dfc8645270ceb59f393a21b56cbd94ee

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

psapi

msvcrt

shlwapi

oleaut32

Sections

.text Size: - Virtual size: 66KB

.rdata Size: - Virtual size: 5KB

.data Size: - Virtual size: 180KB

.pn0 Size: - Virtual size: 1.7MB

.(n( Size: 1024B - Virtual size: 756B

.%pv Size: 3.7MB - Virtual size: 3.7MB

.text
Size: - Virtual size: 66KB

.rdata
Size: - Virtual size: 5KB

.data
Size: - Virtual size: 180KB

.pn0
Size: - Virtual size: 1.7MB

.(n(
Size: 1024B - Virtual size: 756B

.%pv
Size: 3.7MB - Virtual size: 3.7MB