NEAS[.]58d4555439611666c1e825f655630fa0[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.58d4555439611666c1e825f655630fa0.exe
Size

61KB
MD5

58d4555439611666c1e825f655630fa0
SHA1

60902fee2b7467f1501fa1df275eed9aeebae4fd
SHA256

93052eeac5635a7252e3b370ec8a0f7671358dab9121c17486133214511d292b
SHA512

ce4d6911d5376404965cceacd0fee739c137f5575709d4cc0f1dc968c276af0685c533809287e5d888b59710e38fa4a35346e7879abcc61ce8a1e4132ec7a7e4
SSDEEP

1536:KlQlslJisJ+19dCXoGAIzrhDKQTLbNbRkL:m6s04XojIz5KWbNbRkL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.58d4555439611666c1e825f655630fa0.exe

Files

NEAS.58d4555439611666c1e825f655630fa0.exe
.dll windows:6 windows x86

6e58cf339821953c5248e15d4ff9bba7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
Sleep
CreateThread
CreateFileA
DeleteFileA
WriteFile
FreeLibrary
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsA
CreateProcessA
GetTickCount
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcpyA
lstrcatA
GetTempPathA
HeapAlloc
HeapFree
GetProcessHeap
VirtualProtect
EnterCriticalSection
GetComputerNameA
OutputDebugStringA
GetLastError
CreateMutexA
GetFileAttributesA
GetCurrentThreadId
lstrcmpiA
CreateToolhelp32Snapshot
Process32First
Process32Next
TerminateProcess
MapViewOfFile
GetModuleFileNameA
CreateFileMappingA
OpenFileMappingA
InitializeCriticalSection
LocalFree
WideCharToMultiByte
MultiByteToWideChar
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
CancelIo
CloseHandle
VirtualFree
lstrlenA
VirtualAlloc

user32

OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
GetLastInputInfo
ExitWindowsEx
SetThreadDesktop
CloseDesktop
wsprintfA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
MessageBoxA

advapi32

CloseEventLog
OpenEventLogA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ClearEventLogA

shell32

ShellExecuteA

ole32

CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantClear

ws2_32

send
getsockname
inet_addr
WSAIoctl
WSACleanup
WSAStartup
gethostbyname
socket
setsockopt
closesocket
connect
htons
inet_ntoa
recv
select
gethostname

msvcp120

?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

msvcr120

_amsg_exit
__CppXcptFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
??1type_info@@UAE@XZ
_except1
_onexit
__dllonexit
_calloc_crt
malloc
_malloc_crt
_lock
_beginthreadex
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
_localtime64
??0exception@std@@QAE@ABQBD@Z
memchr
strchr
realloc
free
strrchr
strncpy
exit
_initterm
_initterm_e
_stricmp
__clean_type_info_names_internal
?terminate@@YAXXZ
_unlock
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
memmove
strstr
_CxxThrowException
__CxxFrameHandler3
ceil
memcpy
rand
srand
??_V@YAXPAX@Z
_time64
memset

Exports

Exports

CallOneToOne
CallRobot24
CheckBatteryPlanStatus
CheckCameraStatus
CheckEyeProtectionMode
CheckMicphoneStatus
CheckNetState
CheckSettingHost
ClearMemory
CloseMicphone
CloudInitConfig
CloudSyncDeviceIdLogin
CloudSyncGenDeviceId
ContrlTopSpeedMode
CreateCamera
CreateDirByPath
CreateFileIcon
DecrpyData
DeleteFileEx
DestroyCamera
DisableServiceEx
DoTask
EncrptyData
GarbageStopAnyOperator
GetAPSStatus
GetAllProjectorSettings
GetAppChannel
GetAppVersion
GetAutoDisable
GetAutomaticModeSetting
GetBackCameraFriendlyName
GetBrightness
GetBrightnessRange
GetBrowserPolicy
GetCPUFrequency
GetCPUThermal
GetCPUUsage
GetCallRobotData
GetCallRobotParam
GetCameraAbility
GetColorEffectCapability
GetConfig
GetConfigByKey
GetContrast
GetContrastRange
GetCoolQuiteAbilityBySettingHost
GetCoolQuiteSetting
GetCurrentMode
GetDeviceMac
GetDeviceSN
GetDeviceSNHash
GetDualFanCommand
GetExposure
GetExposureRange
GetFileIcon
GetFileMd5
GetFlipOpenStatus
GetFrontCameraFriendlyName
GetGarbageCleanSize
GetGarbageSize
GetHotWordChannel
GetHotwordUpdateInterval
GetITSAbility
GetITSVersion
GetInputCapility
GetInstallPath
GetIntelligentSmartSettings
GetIsSupportLogodiy
GetIsSupportSR2
GetKeyboardLightCapacity
GetKeyboardLightStatus
GetLUDPMacAddress
GetLastModuleCapility
GetLocalToken
GetMMCCAbility
GetMMCCapableMode
GetMTM
GetMachineType
GetMemoryRatio
GetMicroftAccountId
GetNetworkSpeed
GetNumberofHDDs
GetOLEDCapility
GetOLEDSettings
GetPSensorCapability
GetPSensorSetting
GetPathForLog
GetPenCapability
GetPenDelayTime
GetPenInputSetting
GetPicoPJAbility
GetPicoPJPopupWndCloseOption
GetPicoPJPopupWndOpenOption
GetPicoPJPreventSleepWhenOn
GetPicoProjectorBatteryLevel
GetPicoProjectorBatteryStatus
GetPicoProjectorColorMode
GetPicoProjectorDisplayDimMins
GetPrivacy
GetProgramDataPath
GetRealmKey
GetRealmString
GetSensitivityRange
GetSensitivityRequestLevel
GetSettingsModuleCapility
GetSmartHibernationCommand
GetSnoozeEnableDisable
GetSnoozeTime
GetSpeedBallAPI
GetThermalDownTimeStableToUnstable
GetThermalDownTimeUnstableToStable
GetThermalFeatureAbility
GetThermalFeatureSetting
GetTouchCapability
GetTouchInputSetting
GetUpdateDriver
GetUpdateSoftware
GetWarrantyInfo
GetWidgetDefaultModeChannel
GetXiangxiuPolicy
HttpForSecurity
Initialize
InitializeCancelDelay
InitializeWithContext
IsAPSDriverLoaded
IsAPSEnabled
IsAlwaysOnUsbCapability
IsCameraAccessDenied
IsDictoryExists
IsEMDriverInstalled
IsLenovoAppsChannel
IsLenovoMachine
IsLenovoSignature
IsNoteBookPC
IsPCMParentProcess
IsPCMServerAllowLeWindow
IsPMDriverInstalled
IsPreloadChannel
IsShowAppStoreEntry
IsSupportColorTemperature
IsSupportPen
IsSystemCamera
IsThinkPadComputer
IsThinpadSMB
IsV3Version
IsWelcomeAllowPop
IsWindowsNewOS
IsXiaoXinPC
IsZhengJiuZhePC
JsPluginRequest
LAV_GetLockedPage
LAV_LockedPage
LAV_ShowLav
LanguageGetCurrent
LanguageLoadString
LaunchCPL
LoadAPSDriver
LoadPowerPlugin
MoveCameraArea
OnReceiveGraphEvent
OpenHumanService
OpenMicphone
PCM_HttpsPost
QueryBatteryInfo
QueryBatteryStretch
QueryChargeThreshold
QueryDualFanCapability
QueryGaugeResetCapability
QueryGaugeResetStatus
QuerySmartHibernationCapability
QueryUSB
QuitSettingHost
ResetOLEDsettings
ResetPicoProjectorSettings
RestoreColorEffect
RobotXgjEncodeData
SMBIOS_GetSysEnclosureType
SaveHIconToPngFile
SendNotifyOfTSModeChanged
SetAPSEnableDisable
SetAccessedCamera
SetAutoDisable
SetAutomaticMode
SetBalanceMode
SetBatterySavingMode
SetBatteryStretch
SetBrightness
SetCameraNormalMode
SetCameraPrivacyMode
SetChargeThreshold
SetClickZoneReverse
SetColorEffectState
SetContrast
SetCoolQuiteAbilityBySettingHost
SetCoolQuiteSetting
SetDYTCMode
SetDualFanCommand
SetExposure
SetEyeProtectionMode
SetFlipOpenStatus
SetFnKeyLocation
SetFnLock
SetFnStickKey
SetForceHighPerformanceMode
SetGaugeResetCommand
SetKeyboardLightStatus
SetLastModuleCapility
SetManualModeControlMode
SetManualSensitivitySetting
SetMiddleButtonAction
SetNormalMode
SetOLEDmode
SetOLEDsettings
SetPSensorSetting
SetPenDelayTime
SetPenInputSetting
SetPicoPJPopupWndCloseOption
SetPicoPJPopupWndOpenOption
SetPicoPJPreventSleepWhenOn
SetPicoProjectorColorMode
SetPicoProjectorDisplayDimMins
SetPrimaryFunction
SetPrivacy
SetSettingValueChangedCallback
SetSmartHibernationCommand
SetSmartSenseSettings
SetSnoozeEnableDisable
SetSnoozeTime
SetThermalDownTimeStableToUnstable
SetThermalDownTimeUnstableToStable
SetThermalFeatureSetting
SetTouchEnable
SetTouchInputSetting
SetTouchSpeed
SetTrackPoint
SetTrackPointSpeed
SetUSB
SnoozeNow
StartCapture
StartNetStateMoniter
StartServiceEx
StopCapture
SyncUploadFile
SysGetMachinePenCapability
TakeLocalColorEffect
TestFun
UnloadAPSDriver
UnloadPowerPlugin
UseHotWord
UseLongtimeReminder
UseOfficeReminder
UseSearchPanel
WP_AllowDrag
WP_Auth_IsPCM
WP_DeletePoint
WP_DownloadFile
WP_GetAppName
WP_GetConfigApiNew
WP_GetCtsToken
WP_GetGlobalConfigNew
WP_GetGlobalData
WP_GetHardwareInfo
WP_GetLUDPUUID
WP_GetLenovoIdLoginInfo
WP_GetMachineMarketingName
WP_GetMarketingName
WP_GetModuleConfigNew
WP_GetModuleConfigVersionNew
WP_GetOSName
WP_GetOpenAccessToken
WP_GetRegistryPath
WP_GetSettingsConfig
WP_GetSmartHomePath
WP_GetSoftwareUpdateCount
WP_GetStoragePath
WP_HttpRequest
WP_InitlizeLenovoId
WP_IsOpenServerAlived
WP_IsShowExtendWarranty
WP_LenovoIdLogin
WP_LenovoIdLogout
WP_PCM_Auth
WP_Plugin_Auth
WP_Plugin_Get_Paramter
WP_Plugin_Paramter_Init
WP_RefreshAccessToken
WP_SetGlobalData
WelcomeAllowPopFlag
WrapIsServiceRunning
WrapStartService
isThinkMachine
pcm_plugin_action
pcm_plugin_buffer_allocate
pcm_plugin_buffer_free
pcm_plugin_ininitialize

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e58cf339821953c5248e15d4ff9bba7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

msvcp120

msvcr120

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 1024B - Virtual size: 11KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 1024B - Virtual size: 11KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB