NEAS[.]f122b4ab576902c76b6f127399d6fa51c94fcc90a87c4f870acb6aa2c74fc2be[.]dll

General

Target

NEAS.f122b4ab576902c76b6f127399d6fa51c94fcc90a87c4f870acb6aa2c74fc2be.dll
Size

403KB
MD5

5598835cf0f9e5521ab14c75ed0f6bf0
SHA1

bfa3bc91e48042db136e6ebb6b17409655dd3340
SHA256

f122b4ab576902c76b6f127399d6fa51c94fcc90a87c4f870acb6aa2c74fc2be
SHA512

c5f468e89b68681fd0dbef6e0a5ec93db35b94935b74b8c64975f03c751ad7b153b28b6378b77923481c1ad101215fd505dc148137e090c0d5c8af3d249fce90
SSDEEP

6144:IQhz787QsKxf/h355gOQYlTKxdBCmkGymUnebcGNxz3tx0ic5CmsIPDZ:rIXofpgOKlOGBOYtz3tg1LZ

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
sample	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
NEAS.f122b4ab576902c76b6f127399d6fa51c94fcc90a87c4f870acb6aa2c74fc2be.dll
unpack001/out.upx

Files

NEAS.f122b4ab576902c76b6f127399d6fa51c94fcc90a87c4f870acb6aa2c74fc2be.dll
.dll windows:5 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CaptureScreen
ChangeWindow
CloseDLL
DllAbout
DllConfig
DllTest
DrawScreen
FBGetFrameBufferInfo
FBRead
FBWList
FBWrite
GetDllInfo
GetFullScreenStatus
InitiateGFX
MoveScreen
ProcessDList
ProcessDListCountCycles
ProcessRDPList
RomClosed
RomOpen
SetOnScreenText
ShowCFB
UpdateScreen
ViStatusChanged
ViWidthChanged
_AllocateBMGImage@4
_CompressBMGImage@4
_ConvertPaletteToRGB@36
_ConvertToGrayScale@4
_ConvertToPseudoGrayScale@4
_CopyBMGImage@36
_CreateBitmapFromData@36
_FreeBMGImage@4
_FreeBMGMemory@4
_GetDataFromBitmap@12
_GetLastBMGError@0
_GetLastBMGErrorMessage@4
_InitBMGImage@4
_ReadJPEG@8
_ReadPNG@8
_SetBMGBackgroundBitmap@4
_SetBMGBackgroundColor@4
_SetBMGBackgroundImage@32
_WriteJPEG@40
_WritePNG@36

Sections

UPX0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 399KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 1022KB - Virtual size: 1022KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 87KB - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 1.3MB

UPX1 Size: 399KB - Virtual size: 400KB

.rsrc Size: 3KB - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 1022KB - Virtual size: 1022KB

.rdata Size: 108KB - Virtual size: 108KB

.data Size: 87KB - Virtual size: 464KB

.data1 Size: 2KB - Virtual size: 2KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 48KB - Virtual size: 48KB

UPX0
Size: - Virtual size: 1.3MB

UPX1
Size: 399KB - Virtual size: 400KB

.rsrc
Size: 3KB - Virtual size: 4KB

.text
Size: 1022KB - Virtual size: 1022KB

.rdata
Size: 108KB - Virtual size: 108KB

.data
Size: 87KB - Virtual size: 464KB

.data1
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 48KB - Virtual size: 48KB